From 15c0b25d011f37e7c20aeca9eaf461f78285b8d9 Mon Sep 17 00:00:00 2001
From: Alex Pilon <apilon@hashicorp.com>
Date: Fri, 22 Feb 2019 18:24:37 -0500
Subject: deps: github.com/hashicorp/terraform@sdk-v0.11-with-go-modules
 Updated via: go get github.com/hashicorp/terraform@sdk-v0.11-with-go-modules
 and go mod tidy

---
 .../terraform/helper/experiment/experiment.go      | 154 ------
 .../hashicorp/terraform/helper/experiment/id.go    |  34 --
 .../terraform/helper/hashcode/hashcode.go          |  13 +
 .../hashicorp/terraform/helper/logging/logging.go  |   8 +-
 .../terraform/helper/logging/transport.go          |  21 +-
 .../hashicorp/terraform/helper/resource/id.go      |   5 +
 .../hashicorp/terraform/helper/resource/state.go   |   2 +-
 .../hashicorp/terraform/helper/resource/testing.go | 348 ++++++++++---
 .../terraform/helper/resource/testing_config.go    |  41 +-
 .../helper/resource/testing_import_state.go        |  15 +-
 .../hashicorp/terraform/helper/resource/wait.go    |   2 +-
 .../hashicorp/terraform/helper/schema/backend.go   |   2 +-
 .../terraform/helper/schema/core_schema.go         | 155 ++++++
 .../helper/schema/data_source_resource_shim.go     |   2 +-
 .../terraform/helper/schema/field_reader.go        |  11 +-
 .../terraform/helper/schema/field_reader_config.go |   2 +-
 .../terraform/helper/schema/field_reader_diff.go   |  43 +-
 .../terraform/helper/schema/field_reader_map.go    |   2 +-
 .../terraform/helper/schema/field_writer_map.go    |  32 ++
 .../terraform/helper/schema/getsource_string.go    |   6 +-
 .../hashicorp/terraform/helper/schema/provider.go  |  40 +-
 .../terraform/helper/schema/provisioner.go         |   4 +-
 .../hashicorp/terraform/helper/schema/resource.go  |  98 +++-
 .../terraform/helper/schema/resource_data.go       |  39 +-
 .../terraform/helper/schema/resource_diff.go       | 559 +++++++++++++++++++++
 .../hashicorp/terraform/helper/schema/schema.go    | 252 +++++++---
 .../hashicorp/terraform/helper/schema/set.go       |  31 ++
 .../hashicorp/terraform/helper/schema/testing.go   |   4 +-
 .../terraform/helper/schema/valuetype_string.go    |   4 +-
 .../hashicorp/terraform/helper/shadow/closer.go    |  83 ---
 .../terraform/helper/shadow/compared_value.go      | 128 -----
 .../terraform/helper/shadow/keyed_value.go         | 151 ------
 .../terraform/helper/shadow/ordered_value.go       |  66 ---
 .../hashicorp/terraform/helper/shadow/value.go     |  87 ----
 34 files changed, 1529 insertions(+), 915 deletions(-)
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/experiment/id.go
 create mode 100644 vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
 create mode 100644 vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
 delete mode 100644 vendor/github.com/hashicorp/terraform/helper/shadow/value.go

(limited to 'vendor/github.com/hashicorp/terraform/helper')

diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go b/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
deleted file mode 100644
index 18b8837..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
+++ /dev/null
@@ -1,154 +0,0 @@
-// experiment package contains helper functions for tracking experimental
-// features throughout Terraform.
-//
-// This package should be used for creating, enabling, querying, and deleting
-// experimental features. By unifying all of that onto a single interface,
-// we can have the Go compiler help us by enforcing every place we touch
-// an experimental feature.
-//
-// To create a new experiment:
-//
-//   1. Add the experiment to the global vars list below, prefixed with X_
-//
-//   2. Add the experiment variable to the All listin the init() function
-//
-//   3. Use it!
-//
-// To remove an experiment:
-//
-//   1. Delete the experiment global var.
-//
-//   2. Try to compile and fix all the places where the var was referenced.
-//
-// To use an experiment:
-//
-//   1. Use Flag() if you want the experiment to be available from the CLI.
-//
-//   2. Use Enabled() to check whether it is enabled.
-//
-// As a general user:
-//
-//   1. The `-Xexperiment-name` flag
-//   2. The `TF_X_<experiment-name>` env var.
-//   3. The `TF_X_FORCE` env var can be set to force an experimental feature
-//      without human verifications.
-//
-package experiment
-
-import (
-	"flag"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-)
-
-// The experiments that are available are listed below. Any package in
-// Terraform defining an experiment should define the experiments below.
-// By keeping them all within the experiment package we force a single point
-// of definition and use. This allows the compiler to enforce references
-// so it becomes easy to remove the features.
-var (
-	// Shadow graph. This is already on by default. Disabling it will be
-	// allowed for awhile in order for it to not block operations.
-	X_shadow = newBasicID("shadow", "SHADOW", false)
-)
-
-// Global variables this package uses because we are a package
-// with global state.
-var (
-	// all is the list of all experiements. Do not modify this.
-	All []ID
-
-	// enabled keeps track of what flags have been enabled
-	enabled     map[string]bool
-	enabledLock sync.Mutex
-
-	// Hidden "experiment" that forces all others to be on without verification
-	x_force = newBasicID("force", "FORCE", false)
-)
-
-func init() {
-	// The list of all experiments, update this when an experiment is added.
-	All = []ID{
-		X_shadow,
-		x_force,
-	}
-
-	// Load
-	reload()
-}
-
-// reload is used by tests to reload the global state. This is called by
-// init publicly.
-func reload() {
-	// Initialize
-	enabledLock.Lock()
-	enabled = make(map[string]bool)
-	enabledLock.Unlock()
-
-	// Set defaults and check env vars
-	for _, id := range All {
-		// Get the default value
-		def := id.Default()
-
-		// If we set it in the env var, default it to true
-		key := fmt.Sprintf("TF_X_%s", strings.ToUpper(id.Env()))
-		if v := os.Getenv(key); v != "" {
-			def = v != "0"
-		}
-
-		// Set the default
-		SetEnabled(id, def)
-	}
-}
-
-// Enabled returns whether an experiment has been enabled or not.
-func Enabled(id ID) bool {
-	enabledLock.Lock()
-	defer enabledLock.Unlock()
-	return enabled[id.Flag()]
-}
-
-// SetEnabled sets an experiment to enabled/disabled. Please check with
-// the experiment docs for when calling this actually affects the experiment.
-func SetEnabled(id ID, v bool) {
-	enabledLock.Lock()
-	defer enabledLock.Unlock()
-	enabled[id.Flag()] = v
-}
-
-// Force returns true if the -Xforce of TF_X_FORCE flag is present, which
-// advises users of this package to not verify with the user that they want
-// experimental behavior and to just continue with it.
-func Force() bool {
-	return Enabled(x_force)
-}
-
-// Flag configures the given FlagSet with the flags to configure
-// all active experiments.
-func Flag(fs *flag.FlagSet) {
-	for _, id := range All {
-		desc := id.Flag()
-		key := fmt.Sprintf("X%s", id.Flag())
-		fs.Var(&idValue{X: id}, key, desc)
-	}
-}
-
-// idValue implements flag.Value for setting the enabled/disabled state
-// of an experiment from the CLI.
-type idValue struct {
-	X ID
-}
-
-func (v *idValue) IsBoolFlag() bool { return true }
-func (v *idValue) String() string   { return strconv.FormatBool(Enabled(v.X)) }
-func (v *idValue) Set(raw string) error {
-	b, err := strconv.ParseBool(raw)
-	if err == nil {
-		SetEnabled(v.X, b)
-	}
-
-	return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go b/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
deleted file mode 100644
index 8e2f707..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package experiment
-
-// ID represents an experimental feature.
-//
-// The global vars defined on this package should be used as ID values.
-// This interface is purposely not implement-able outside of this package
-// so that we can rely on the Go compiler to enforce all experiment references.
-type ID interface {
-	Env() string
-	Flag() string
-	Default() bool
-
-	unexported() // So the ID can't be implemented externally.
-}
-
-// basicID implements ID.
-type basicID struct {
-	EnvValue     string
-	FlagValue    string
-	DefaultValue bool
-}
-
-func newBasicID(flag, env string, def bool) ID {
-	return &basicID{
-		EnvValue:     env,
-		FlagValue:    flag,
-		DefaultValue: def,
-	}
-}
-
-func (id *basicID) Env() string   { return id.EnvValue }
-func (id *basicID) Flag() string  { return id.FlagValue }
-func (id *basicID) Default() bool { return id.DefaultValue }
-func (id *basicID) unexported()   {}
diff --git a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
index 64d8263..6ccc523 100644
--- a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
+++ b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
@@ -1,6 +1,8 @@
 package hashcode
 
 import (
+	"bytes"
+	"fmt"
 	"hash/crc32"
 )
 
@@ -20,3 +22,14 @@ func String(s string) int {
 	// v == MinInt
 	return 0
 }
+
+// Strings hashes a list of strings to a unique hashcode.
+func Strings(strings []string) string {
+	var buf bytes.Buffer
+
+	for _, s := range strings {
+		buf.WriteString(fmt.Sprintf("%s-", s))
+	}
+
+	return fmt.Sprintf("%d", String(buf.String()))
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
index 433cd77..6bd92f7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
@@ -18,7 +18,7 @@ const (
 	EnvLogFile = "TF_LOG_PATH" // Set to a file
 )
 
-var validLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
+var ValidLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
 
 // LogOutput determines where we should send logs (if anywhere) and the log level.
 func LogOutput() (logOutput io.Writer, err error) {
@@ -40,7 +40,7 @@ func LogOutput() (logOutput io.Writer, err error) {
 
 	// This was the default since the beginning
 	logOutput = &logutils.LevelFilter{
-		Levels:   validLevels,
+		Levels:   ValidLevels,
 		MinLevel: logutils.LogLevel(logLevel),
 		Writer:   logOutput,
 	}
@@ -77,7 +77,7 @@ func LogLevel() string {
 		logLevel = strings.ToUpper(envLevel)
 	} else {
 		log.Printf("[WARN] Invalid log level: %q. Defaulting to level: TRACE. Valid levels are: %+v",
-			envLevel, validLevels)
+			envLevel, ValidLevels)
 	}
 
 	return logLevel
@@ -90,7 +90,7 @@ func IsDebugOrHigher() bool {
 }
 
 func isValidLogLevel(level string) bool {
-	for _, l := range validLevels {
+	for _, l := range ValidLevels {
 		if strings.ToUpper(level) == string(l) {
 			return true
 		}
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
index 4477924..bddabe6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
@@ -1,9 +1,12 @@
 package logging
 
 import (
+	"bytes"
+	"encoding/json"
 	"log"
 	"net/http"
 	"net/http/httputil"
+	"strings"
 )
 
 type transport struct {
@@ -15,7 +18,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
 	if IsDebugOrHigher() {
 		reqData, err := httputil.DumpRequestOut(req, true)
 		if err == nil {
-			log.Printf("[DEBUG] "+logReqMsg, t.name, string(reqData))
+			log.Printf("[DEBUG] "+logReqMsg, t.name, prettyPrintJsonLines(reqData))
 		} else {
 			log.Printf("[ERROR] %s API Request error: %#v", t.name, err)
 		}
@@ -29,7 +32,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
 	if IsDebugOrHigher() {
 		respData, err := httputil.DumpResponse(resp, true)
 		if err == nil {
-			log.Printf("[DEBUG] "+logRespMsg, t.name, string(respData))
+			log.Printf("[DEBUG] "+logRespMsg, t.name, prettyPrintJsonLines(respData))
 		} else {
 			log.Printf("[ERROR] %s API Response error: %#v", t.name, err)
 		}
@@ -42,6 +45,20 @@ func NewTransport(name string, t http.RoundTripper) *transport {
 	return &transport{name, t}
 }
 
+// prettyPrintJsonLines iterates through a []byte line-by-line,
+// transforming any lines that are complete json into pretty-printed json.
+func prettyPrintJsonLines(b []byte) string {
+	parts := strings.Split(string(b), "\n")
+	for i, p := range parts {
+		if b := []byte(p); json.Valid(b) {
+			var out bytes.Buffer
+			json.Indent(&out, b, "", " ")
+			parts[i] = out.String()
+		}
+	}
+	return strings.Join(parts, "\n")
+}
+
 const logReqMsg = `%s API Request Details:
 ---[ REQUEST ]---------------------------------------
 %s
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/id.go b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
index 1cde67c..4494955 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/id.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
@@ -18,6 +18,11 @@ func UniqueId() string {
 	return PrefixedUniqueId(UniqueIdPrefix)
 }
 
+// UniqueIDSuffixLength is the string length of the suffix generated by
+// PrefixedUniqueId. This can be used by length validation functions to
+// ensure prefixes are the correct length for the target field.
+const UniqueIDSuffixLength = 26
+
 // Helper for a resource to generate a unique identifier w/ given prefix
 //
 // After the prefix, the ID consists of an incrementing 26 digit value (to match
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index 37c586a..c34e21b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -46,7 +46,7 @@ type StateChangeConf struct {
 // If the Timeout is exceeded before reaching the Target state, return an
 // error.
 //
-// Otherwise, result the result of the first call to the Refresh function to
+// Otherwise, the result is the result of the first call to the Refresh function to
 // reach the target state.
 func (conf *StateChangeConf) WaitForState() (interface{}, error) {
 	log.Printf("[DEBUG] Waiting for state to become: %s", conf.Target)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index d7de1a0..b97673f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -11,11 +11,13 @@ import (
 	"reflect"
 	"regexp"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/davecgh/go-spew/spew"
-	"github.com/hashicorp/go-getter"
+	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/logutils"
 	"github.com/hashicorp/terraform/config/module"
 	"github.com/hashicorp/terraform/helper/logging"
 	"github.com/hashicorp/terraform/terraform"
@@ -186,6 +188,10 @@ type TestCheckFunc func(*terraform.State) error
 // ImportStateCheckFunc is the check function for ImportState tests
 type ImportStateCheckFunc func([]*terraform.InstanceState) error
 
+// ImportStateIdFunc is an ID generation function to help with complex ID
+// generation for ImportState tests.
+type ImportStateIdFunc func(*terraform.State) (string, error)
+
 // TestCase is a single acceptance test case used to test the apply/destroy
 // lifecycle of a resource in a specific configuration.
 //
@@ -260,6 +266,15 @@ type TestStep struct {
 	// below.
 	PreConfig func()
 
+	// Taint is a list of resource addresses to taint prior to the execution of
+	// the step. Be sure to only include this at a step where the referenced
+	// address will be present in state, as it will fail the test if the resource
+	// is missing.
+	//
+	// This option is ignored on ImportState tests, and currently only works for
+	// resources in the root module path.
+	Taint []string
+
 	//---------------------------------------------------------------
 	// Test modes. One of the following groups of settings must be
 	// set to determine what the test step will do. Ideally we would've
@@ -304,10 +319,19 @@ type TestStep struct {
 	// no-op plans
 	PlanOnly bool
 
+	// PreventDiskCleanup can be set to true for testing terraform modules which
+	// require access to disk at runtime. Note that this will leave files in the
+	// temp folder
+	PreventDiskCleanup bool
+
 	// PreventPostDestroyRefresh can be set to true for cases where data sources
 	// are tested alongside real resources
 	PreventPostDestroyRefresh bool
 
+	// SkipFunc is called before applying config, but after PreConfig
+	// This is useful for defining test steps with platform-dependent checks
+	SkipFunc func() (bool, error)
+
 	//---------------------------------------------------------------
 	// ImportState testing
 	//---------------------------------------------------------------
@@ -329,6 +353,12 @@ type TestStep struct {
 	// the unset ImportStateId field.
 	ImportStateIdPrefix string
 
+	// ImportStateIdFunc is a function that can be used to dynamically generate
+	// the ID for the ImportState tests. It is sent the state, which can be
+	// checked to derive the attributes necessary and generate the string in the
+	// desired format.
+	ImportStateIdFunc ImportStateIdFunc
+
 	// ImportStateCheck checks the results of ImportState. It should be
 	// used to verify that the resulting value of ImportState has the
 	// proper resources, IDs, and attributes.
@@ -345,6 +375,60 @@ type TestStep struct {
 	ImportStateVerifyIgnore []string
 }
 
+// Set to a file mask in sprintf format where %s is test name
+const EnvLogPathMask = "TF_LOG_PATH_MASK"
+
+func LogOutput(t TestT) (logOutput io.Writer, err error) {
+	logOutput = ioutil.Discard
+
+	logLevel := logging.LogLevel()
+	if logLevel == "" {
+		return
+	}
+
+	logOutput = os.Stderr
+
+	if logPath := os.Getenv(logging.EnvLogFile); logPath != "" {
+		var err error
+		logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if logPathMask := os.Getenv(EnvLogPathMask); logPathMask != "" {
+		// Escape special characters which may appear if we have subtests
+		testName := strings.Replace(t.Name(), "/", "__", -1)
+
+		logPath := fmt.Sprintf(logPathMask, testName)
+		var err error
+		logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// This was the default since the beginning
+	logOutput = &logutils.LevelFilter{
+		Levels:   logging.ValidLevels,
+		MinLevel: logutils.LogLevel(logLevel),
+		Writer:   logOutput,
+	}
+
+	return
+}
+
+// ParallelTest performs an acceptance test on a resource, allowing concurrency
+// with other ParallelTest.
+//
+// Tests will fail if they do not properly handle conditions to allow multiple
+// tests to occur against the same resource or service (e.g. random naming).
+// All other requirements of the Test function also apply to this function.
+func ParallelTest(t TestT, c TestCase) {
+	t.Parallel()
+	Test(t, c)
+}
+
 // Test performs an acceptance test on a resource.
 //
 // Tests are not run unless an environmental variable "TF_ACC" is
@@ -366,7 +450,7 @@ func Test(t TestT, c TestCase) {
 		return
 	}
 
-	logWriter, err := logging.LogOutput()
+	logWriter, err := LogOutput(t)
 	if err != nil {
 		t.Error(fmt.Errorf("error setting up logging: %s", err))
 	}
@@ -398,7 +482,18 @@ func Test(t TestT, c TestCase) {
 	errored := false
 	for i, step := range c.Steps {
 		var err error
-		log.Printf("[WARN] Test: Executing step %d", i)
+		log.Printf("[DEBUG] Test: Executing step %d", i)
+
+		if step.SkipFunc != nil {
+			skip, err := step.SkipFunc()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if skip {
+				log.Printf("[WARN] Skipping step %d", i)
+				continue
+			}
+		}
 
 		if step.Config == "" && !step.ImportState {
 			err = fmt.Errorf(
@@ -418,6 +513,15 @@ func Test(t TestT, c TestCase) {
 			}
 		}
 
+		// If we expected an error, but did not get one, fail
+		if err == nil && step.ExpectError != nil {
+			errored = true
+			t.Error(fmt.Sprintf(
+				"Step %d, no error received, but expected a match to:\n\n%s\n\n",
+				i, step.ExpectError))
+			break
+		}
+
 		// If there was an error, exit
 		if err != nil {
 			// Perhaps we expected an error? Check if it matches
@@ -485,6 +589,7 @@ func Test(t TestT, c TestCase) {
 			Config:                    lastStep.Config,
 			Check:                     c.CheckDestroy,
 			Destroy:                   true,
+			PreventDiskCleanup:        lastStep.PreventDiskCleanup,
 			PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
 		}
 
@@ -593,18 +698,12 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
 	if err != nil {
 		return err
 	}
-	if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-		if len(es) > 0 {
-			estrs := make([]string, len(es))
-			for i, e := range es {
-				estrs[i] = e.Error()
-			}
-			return fmt.Errorf(
-				"Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-				ws, estrs)
+	if diags := ctx.Validate(); len(diags) > 0 {
+		if diags.HasErrors() {
+			return errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
 		}
 
-		log.Printf("[WARN] Config warnings: %#v", ws)
+		log.Printf("[WARN] Config warnings:\n%s", diags.Err().Error())
 	}
 
 	// Refresh!
@@ -657,9 +756,7 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
 	return nil
 }
 
-func testModule(
-	opts terraform.ContextOpts,
-	step TestStep) (*module.Tree, error) {
+func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
 	if step.PreConfig != nil {
 		step.PreConfig()
 	}
@@ -669,7 +766,12 @@ func testModule(
 		return nil, fmt.Errorf(
 			"Error creating temporary directory for config: %s", err)
 	}
-	defer os.RemoveAll(cfgPath)
+
+	if step.PreventDiskCleanup {
+		log.Printf("[INFO] Skipping defer os.RemoveAll call")
+	} else {
+		defer os.RemoveAll(cfgPath)
+	}
 
 	// Write the configuration
 	cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
@@ -693,10 +795,11 @@ func testModule(
 	}
 
 	// Load the modules
-	modStorage := &getter.FolderStorage{
+	modStorage := &module.Storage{
 		StorageDir: filepath.Join(cfgPath, ".tfmodules"),
+		Mode:       module.GetModeGet,
 	}
-	err = mod.Load(modStorage, module.GetModeGet)
+	err = mod.Load(modStorage)
 	if err != nil {
 		return nil, fmt.Errorf("Error downloading modules: %s", err)
 	}
@@ -771,12 +874,29 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 			return err
 		}
 
-		if val, ok := is.Attributes[key]; ok && val != "" {
-			return nil
+		return testCheckResourceAttrSet(is, name, key)
+	}
+}
+
+// TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
+// support for non-root modules
+func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+	return func(s *terraform.State) error {
+		is, err := modulePathPrimaryInstanceState(s, mp, name)
+		if err != nil {
+			return err
 		}
 
+		return testCheckResourceAttrSet(is, name, key)
+	}
+}
+
+func testCheckResourceAttrSet(is *terraform.InstanceState, name string, key string) error {
+	if val, ok := is.Attributes[key]; !ok || val == "" {
 		return fmt.Errorf("%s: Attribute '%s' expected to be set", name, key)
 	}
+
+	return nil
 }
 
 // TestCheckResourceAttr is a TestCheckFunc which validates
@@ -788,21 +908,37 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 			return err
 		}
 
-		if v, ok := is.Attributes[key]; !ok || v != value {
-			if !ok {
-				return fmt.Errorf("%s: Attribute '%s' not found", name, key)
-			}
+		return testCheckResourceAttr(is, name, key, value)
+	}
+}
 
-			return fmt.Errorf(
-				"%s: Attribute '%s' expected %#v, got %#v",
-				name,
-				key,
-				value,
-				v)
+// TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
+// support for non-root modules
+func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+	return func(s *terraform.State) error {
+		is, err := modulePathPrimaryInstanceState(s, mp, name)
+		if err != nil {
+			return err
 		}
 
-		return nil
+		return testCheckResourceAttr(is, name, key, value)
+	}
+}
+
+func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+	if v, ok := is.Attributes[key]; !ok || v != value {
+		if !ok {
+			return fmt.Errorf("%s: Attribute '%s' not found", name, key)
+		}
+
+		return fmt.Errorf(
+			"%s: Attribute '%s' expected %#v, got %#v",
+			name,
+			key,
+			value,
+			v)
 	}
+	return nil
 }
 
 // TestCheckNoResourceAttr is a TestCheckFunc which ensures that
@@ -814,14 +950,31 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 			return err
 		}
 
-		if _, ok := is.Attributes[key]; ok {
-			return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+		return testCheckNoResourceAttr(is, name, key)
+	}
+}
+
+// TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
+// support for non-root modules
+func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+	return func(s *terraform.State) error {
+		is, err := modulePathPrimaryInstanceState(s, mp, name)
+		if err != nil {
+			return err
 		}
 
-		return nil
+		return testCheckNoResourceAttr(is, name, key)
 	}
 }
 
+func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
+	if _, ok := is.Attributes[key]; ok {
+		return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+	}
+
+	return nil
+}
+
 // TestMatchResourceAttr is a TestCheckFunc which checks that the value
 // in state for the given name/key combination matches the given regex.
 func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
@@ -831,17 +984,34 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 			return err
 		}
 
-		if !r.MatchString(is.Attributes[key]) {
-			return fmt.Errorf(
-				"%s: Attribute '%s' didn't match %q, got %#v",
-				name,
-				key,
-				r.String(),
-				is.Attributes[key])
+		return testMatchResourceAttr(is, name, key, r)
+	}
+}
+
+// TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
+// support for non-root modules
+func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+	return func(s *terraform.State) error {
+		is, err := modulePathPrimaryInstanceState(s, mp, name)
+		if err != nil {
+			return err
 		}
 
-		return nil
+		return testMatchResourceAttr(is, name, key, r)
+	}
+}
+
+func testMatchResourceAttr(is *terraform.InstanceState, name string, key string, r *regexp.Regexp) error {
+	if !r.MatchString(is.Attributes[key]) {
+		return fmt.Errorf(
+			"%s: Attribute '%s' didn't match %q, got %#v",
+			name,
+			key,
+			r.String(),
+			is.Attributes[key])
 	}
+
+	return nil
 }
 
 // TestCheckResourceAttrPtr is like TestCheckResourceAttr except the
@@ -853,6 +1023,14 @@ func TestCheckResourceAttrPtr(name string, key string, value *string) TestCheckF
 	}
 }
 
+// TestCheckModuleResourceAttrPtr - as per TestCheckResourceAttrPtr but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPtr(mp []string, name string, key string, value *string) TestCheckFunc {
+	return func(s *terraform.State) error {
+		return TestCheckModuleResourceAttr(mp, name, key, *value)(s)
+	}
+}
+
 // TestCheckResourceAttrPair is a TestCheckFunc which validates that the values
 // in state for a pair of name/key combinations are equal.
 func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string) TestCheckFunc {
@@ -861,33 +1039,57 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 		if err != nil {
 			return err
 		}
-		vFirst, ok := isFirst.Attributes[keyFirst]
-		if !ok {
-			return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
-		}
 
 		isSecond, err := primaryInstanceState(s, nameSecond)
 		if err != nil {
 			return err
 		}
-		vSecond, ok := isSecond.Attributes[keySecond]
-		if !ok {
-			return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+
+		return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
+	}
+}
+
+// TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+	return func(s *terraform.State) error {
+		isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+		if err != nil {
+			return err
 		}
 
-		if vFirst != vSecond {
-			return fmt.Errorf(
-				"%s: Attribute '%s' expected %#v, got %#v",
-				nameFirst,
-				keyFirst,
-				vSecond,
-				vFirst)
+		isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+		if err != nil {
+			return err
 		}
 
-		return nil
+		return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
 	}
 }
 
+func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
+	vFirst, ok := isFirst.Attributes[keyFirst]
+	if !ok {
+		return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+	}
+
+	vSecond, ok := isSecond.Attributes[keySecond]
+	if !ok {
+		return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+	}
+
+	if vFirst != vSecond {
+		return fmt.Errorf(
+			"%s: Attribute '%s' expected %#v, got %#v",
+			nameFirst,
+			keyFirst,
+			vSecond,
+			vFirst)
+	}
+
+	return nil
+}
+
 // TestCheckOutput checks an output in the Terraform configuration
 func TestCheckOutput(name, value string) TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -936,23 +1138,43 @@ type TestT interface {
 	Error(args ...interface{})
 	Fatal(args ...interface{})
 	Skip(args ...interface{})
+	Name() string
+	Parallel()
 }
 
 // This is set to true by unit tests to alter some behavior
 var testTesting = false
 
-// primaryInstanceState returns the primary instance state for the given resource name.
-func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
-	ms := s.RootModule()
+// modulePrimaryInstanceState returns the instance state for the given resource
+// name in a ModuleState
+func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, name string) (*terraform.InstanceState, error) {
 	rs, ok := ms.Resources[name]
 	if !ok {
-		return nil, fmt.Errorf("Not found: %s", name)
+		return nil, fmt.Errorf("Not found: %s in %s", name, ms.Path)
 	}
 
 	is := rs.Primary
 	if is == nil {
-		return nil, fmt.Errorf("No primary instance: %s", name)
+		return nil, fmt.Errorf("No primary instance: %s in %s", name, ms.Path)
 	}
 
 	return is, nil
 }
+
+// modulePathPrimaryInstanceState returns the primary instance state for the
+// given resource name in a given module path.
+func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+	ms := s.ModuleByPath(mp)
+	if ms == nil {
+		return nil, fmt.Errorf("No module found at: %s", mp)
+	}
+
+	return modulePrimaryInstanceState(s, ms, name)
+}
+
+// primaryInstanceState returns the primary instance state for the given
+// resource name in the root module.
+func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
+	ms := s.RootModule()
+	return modulePrimaryInstanceState(s, ms, name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 537a11c..033f126 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,10 +1,12 @@
 package resource
 
 import (
+	"errors"
 	"fmt"
 	"log"
 	"strings"
 
+	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -20,6 +22,14 @@ func testStep(
 	opts terraform.ContextOpts,
 	state *terraform.State,
 	step TestStep) (*terraform.State, error) {
+	// Pre-taint any resources that have been defined in Taint, as long as this
+	// is not a destroy step.
+	if !step.Destroy {
+		if err := testStepTaint(state, step); err != nil {
+			return state, err
+		}
+	}
+
 	mod, err := testModule(opts, step)
 	if err != nil {
 		return state, err
@@ -33,17 +43,12 @@ func testStep(
 	if err != nil {
 		return state, fmt.Errorf("Error initializing context: %s", err)
 	}
-	if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-		if len(es) > 0 {
-			estrs := make([]string, len(es))
-			for i, e := range es {
-				estrs[i] = e.Error()
-			}
-			return state, fmt.Errorf(
-				"Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-				ws, estrs)
+	if diags := ctx.Validate(); len(diags) > 0 {
+		if diags.HasErrors() {
+			return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
 		}
-		log.Printf("[WARN] Config warnings: %#v", ws)
+
+		log.Printf("[WARN] Config warnings:\n%s", diags)
 	}
 
 	// Refresh!
@@ -158,3 +163,19 @@ func testStep(
 	// Made it here? Good job test step!
 	return state, nil
 }
+
+func testStepTaint(state *terraform.State, step TestStep) error {
+	for _, p := range step.Taint {
+		m := state.RootModule()
+		if m == nil {
+			return errors.New("no state")
+		}
+		rs, ok := m.Resources[p]
+		if !ok {
+			return fmt.Errorf("resource %q not found in state", p)
+		}
+		log.Printf("[WARN] Test: Explicitly tainting resource %q", p)
+		rs.Taint()
+	}
+	return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 28ad105..94fef3c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -16,15 +16,24 @@ func testStepImportState(
 	state *terraform.State,
 	step TestStep) (*terraform.State, error) {
 	// Determine the ID to import
-	importId := step.ImportStateId
-	if importId == "" {
+	var importId string
+	switch {
+	case step.ImportStateIdFunc != nil:
+		var err error
+		importId, err = step.ImportStateIdFunc(state)
+		if err != nil {
+			return state, err
+		}
+	case step.ImportStateId != "":
+		importId = step.ImportStateId
+	default:
 		resource, err := testResource(step, state)
 		if err != nil {
 			return state, err
 		}
-
 		importId = resource.Primary.ID
 	}
+
 	importPrefix := step.ImportStateIdPrefix
 	if importPrefix != "" {
 		importId = fmt.Sprintf("%s%s", importPrefix, importId)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
index ca50e29..e56a515 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
@@ -74,7 +74,7 @@ func RetryableError(err error) *RetryError {
 	return &RetryError{Err: err, Retryable: true}
 }
 
-// NonRetryableError is a helper to create a RetryError that's _not)_ retryable
+// NonRetryableError is a helper to create a RetryError that's _not_ retryable
 // from a given error.
 func NonRetryableError(err error) *RetryError {
 	if err == nil {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index a0729c0..57fbba7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -65,7 +65,7 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
 
 	// Get a ResourceData for this configuration. To do this, we actually
 	// generate an intermediary "diff" although that is never exposed.
-	diff, err := sm.Diff(nil, c)
+	diff, err := sm.Diff(nil, c, nil, nil)
 	if err != nil {
 		return err
 	}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
new file mode 100644
index 0000000..bf952f6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -0,0 +1,155 @@
+package schema
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform/config/configschema"
+	"github.com/zclconf/go-cty/cty"
+)
+
+// The functions and methods in this file are concerned with the conversion
+// of this package's schema model into the slightly-lower-level schema model
+// used by Terraform core for configuration parsing.
+
+// CoreConfigSchema lowers the receiver to the schema model expected by
+// Terraform core.
+//
+// This lower-level model has fewer features than the schema in this package,
+// describing only the basic structure of configuration and state values we
+// expect. The full schemaMap from this package is still required for full
+// validation, handling of default values, etc.
+//
+// This method presumes a schema that passes InternalValidate, and so may
+// panic or produce an invalid result if given an invalid schemaMap.
+func (m schemaMap) CoreConfigSchema() *configschema.Block {
+	if len(m) == 0 {
+		// We return an actual (empty) object here, rather than a nil,
+		// because a nil result would mean that we don't have a schema at
+		// all, rather than that we have an empty one.
+		return &configschema.Block{}
+	}
+
+	ret := &configschema.Block{
+		Attributes: map[string]*configschema.Attribute{},
+		BlockTypes: map[string]*configschema.NestedBlock{},
+	}
+
+	for name, schema := range m {
+		if schema.Elem == nil {
+			ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+			continue
+		}
+		switch schema.Elem.(type) {
+		case *Schema:
+			ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+		case *Resource:
+			ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+		default:
+			// Should never happen for a valid schema
+			panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+		}
+	}
+
+	return ret
+}
+
+// coreConfigSchemaAttribute prepares a configschema.Attribute representation
+// of a schema. This is appropriate only for primitives or collections whose
+// Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
+// whose elem is a whole resource.
+func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+	return &configschema.Attribute{
+		Type:      s.coreConfigSchemaType(),
+		Optional:  s.Optional,
+		Required:  s.Required,
+		Computed:  s.Computed,
+		Sensitive: s.Sensitive,
+	}
+}
+
+// coreConfigSchemaBlock prepares a configschema.NestedBlock representation of
+// a schema. This is appropriate only for collections whose Elem is an instance
+// of Resource, and will panic otherwise.
+func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
+	ret := &configschema.NestedBlock{}
+	if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+		ret.Block = *nested
+	}
+	switch s.Type {
+	case TypeList:
+		ret.Nesting = configschema.NestingList
+	case TypeSet:
+		ret.Nesting = configschema.NestingSet
+	case TypeMap:
+		ret.Nesting = configschema.NestingMap
+	default:
+		// Should never happen for a valid schema
+		panic(fmt.Errorf("invalid s.Type %s for s.Elem being resource", s.Type))
+	}
+
+	ret.MinItems = s.MinItems
+	ret.MaxItems = s.MaxItems
+
+	if s.Required && s.MinItems == 0 {
+		// configschema doesn't have a "required" representation for nested
+		// blocks, but we can fake it by requiring at least one item.
+		ret.MinItems = 1
+	}
+
+	return ret
+}
+
+// coreConfigSchemaType determines the core config schema type that corresponds
+// to a particular schema's type.
+func (s *Schema) coreConfigSchemaType() cty.Type {
+	switch s.Type {
+	case TypeString:
+		return cty.String
+	case TypeBool:
+		return cty.Bool
+	case TypeInt, TypeFloat:
+		// configschema doesn't distinguish int and float, so helper/schema
+		// will deal with this as an additional validation step after
+		// configuration has been parsed and decoded.
+		return cty.Number
+	case TypeList, TypeSet, TypeMap:
+		var elemType cty.Type
+		switch set := s.Elem.(type) {
+		case *Schema:
+			elemType = set.coreConfigSchemaType()
+		case *Resource:
+			// In practice we don't actually use this for normal schema
+			// construction because we construct a NestedBlock in that
+			// case instead. See schemaMap.CoreConfigSchema.
+			elemType = set.CoreConfigSchema().ImpliedType()
+		default:
+			if set != nil {
+				// Should never happen for a valid schema
+				panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", s.Elem))
+			}
+			// Some pre-existing schemas assume string as default, so we need
+			// to be compatible with them.
+			elemType = cty.String
+		}
+		switch s.Type {
+		case TypeList:
+			return cty.List(elemType)
+		case TypeSet:
+			return cty.Set(elemType)
+		case TypeMap:
+			return cty.Map(elemType)
+		default:
+			// can never get here in practice, due to the case we're inside
+			panic("invalid collection type")
+		}
+	default:
+		// should never happen for a valid schema
+		panic(fmt.Errorf("invalid Schema.Type %s", s.Type))
+	}
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the resource's schema.
+func (r *Resource) CoreConfigSchema() *configschema.Block {
+	return schemaMap(r.Schema).CoreConfigSchema()
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
index 5a03d2d..8d93750 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
@@ -32,7 +32,7 @@ func DataSourceResourceShim(name string, dataSource *Resource) *Resource {
 
 	// FIXME: Link to some further docs either on the website or in the
 	// changelog, once such a thing exists.
-	dataSource.deprecationMessage = fmt.Sprintf(
+	dataSource.DeprecationMessage = fmt.Sprintf(
 		"using %s as a resource is deprecated; consider using the data source instead",
 		name,
 	)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index 1660a67..b80b223 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -126,6 +126,8 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
 				switch v := current.Elem.(type) {
 				case ValueType:
 					current = &Schema{Type: v}
+				case *Schema:
+					current, _ = current.Elem.(*Schema)
 				default:
 					// maps default to string values. This is all we can have
 					// if this is nested in another list or map.
@@ -249,11 +251,10 @@ func readObjectField(
 }
 
 // convert map values to the proper primitive type based on schema.Elem
-func mapValuesToPrimitive(m map[string]interface{}, schema *Schema) error {
-
-	elemType := TypeString
-	if et, ok := schema.Elem.(ValueType); ok {
-		elemType = et
+func mapValuesToPrimitive(k string, m map[string]interface{}, schema *Schema) error {
+	elemType, err := getValueType(k, schema)
+	if err != nil {
+		return err
 	}
 
 	switch elemType {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index f958bbc..55a301d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -206,7 +206,7 @@ func (r *ConfigFieldReader) readMap(k string, schema *Schema) (FieldReadResult,
 		panic(fmt.Sprintf("unknown type: %#v", mraw))
 	}
 
-	err := mapValuesToPrimitive(result, schema)
+	err := mapValuesToPrimitive(k, result, schema)
 	if err != nil {
 		return FieldReadResult{}, nil
 	}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index 16bbae2..d558a5b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -29,29 +29,59 @@ type DiffFieldReader struct {
 	Diff   *terraform.InstanceDiff
 	Source FieldReader
 	Schema map[string]*Schema
+
+	// cache for memoizing ReadField calls.
+	cache map[string]cachedFieldReadResult
+}
+
+type cachedFieldReadResult struct {
+	val FieldReadResult
+	err error
 }
 
 func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
+	if r.cache == nil {
+		r.cache = make(map[string]cachedFieldReadResult)
+	}
+
+	// Create the cache key by joining around a value that isn't a valid part
+	// of an address. This assumes that the Source and Schema are not changed
+	// for the life of this DiffFieldReader.
+	cacheKey := strings.Join(address, "|")
+	if cached, ok := r.cache[cacheKey]; ok {
+		return cached.val, cached.err
+	}
+
 	schemaList := addrToSchema(address, r.Schema)
 	if len(schemaList) == 0 {
+		r.cache[cacheKey] = cachedFieldReadResult{}
 		return FieldReadResult{}, nil
 	}
 
+	var res FieldReadResult
+	var err error
+
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
 	case TypeBool, TypeInt, TypeFloat, TypeString:
-		return r.readPrimitive(address, schema)
+		res, err = r.readPrimitive(address, schema)
 	case TypeList:
-		return readListField(r, address, schema)
+		res, err = readListField(r, address, schema)
 	case TypeMap:
-		return r.readMap(address, schema)
+		res, err = r.readMap(address, schema)
 	case TypeSet:
-		return r.readSet(address, schema)
+		res, err = r.readSet(address, schema)
 	case typeObject:
-		return readObjectField(r, address, schema.Elem.(map[string]*Schema))
+		res, err = readObjectField(r, address, schema.Elem.(map[string]*Schema))
 	default:
 		panic(fmt.Sprintf("Unknown type: %#v", schema.Type))
 	}
+
+	r.cache[cacheKey] = cachedFieldReadResult{
+		val: res,
+		err: err,
+	}
+	return res, err
 }
 
 func (r *DiffFieldReader) readMap(
@@ -92,7 +122,8 @@ func (r *DiffFieldReader) readMap(
 		result[k] = v.New
 	}
 
-	err = mapValuesToPrimitive(result, schema)
+	key := address[len(address)-1]
+	err = mapValuesToPrimitive(key, result, schema)
 	if err != nil {
 		return FieldReadResult{}, nil
 	}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 9533981..054efe0 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -61,7 +61,7 @@ func (r *MapFieldReader) readMap(k string, schema *Schema) (FieldReadResult, err
 		return true
 	})
 
-	err := mapValuesToPrimitive(result, schema)
+	err := mapValuesToPrimitive(k, result, schema)
 	if err != nil {
 		return FieldReadResult{}, nil
 	}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 689ed8d..814c7ba 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -39,6 +39,19 @@ func (w *MapFieldWriter) unsafeWriteField(addr string, value string) {
 	w.result[addr] = value
 }
 
+// clearTree clears a field and any sub-fields of the given address out of the
+// map. This should be used to reset some kind of complex structures (namely
+// sets) before writing to make sure that any conflicting data is removed (for
+// example, if the set was previously written to the writer's layer).
+func (w *MapFieldWriter) clearTree(addr []string) {
+	prefix := strings.Join(addr, ".") + "."
+	for k := range w.result {
+		if strings.HasPrefix(k, prefix) {
+			delete(w.result, k)
+		}
+	}
+}
+
 func (w *MapFieldWriter) WriteField(addr []string, value interface{}) error {
 	w.lock.Lock()
 	defer w.lock.Unlock()
@@ -115,6 +128,14 @@ func (w *MapFieldWriter) setList(
 		return fmt.Errorf("%s: %s", k, err)
 	}
 
+	// Wipe the set from the current writer prior to writing if it exists.
+	// Multiple writes to the same layer is a lot safer for lists than sets due
+	// to the fact that indexes are always deterministic and the length will
+	// always be updated with the current length on the last write, but making
+	// sure we have a clean namespace removes any chance for edge cases to pop up
+	// and ensures that the last write to the set is the correct value.
+	w.clearTree(addr)
+
 	// Set the entire list.
 	var err error
 	for i, elem := range vs {
@@ -162,6 +183,10 @@ func (w *MapFieldWriter) setMap(
 		vs[mk.String()] = mv.Interface()
 	}
 
+	// Wipe this address tree. The contents of the map should always reflect the
+	// last write made to it.
+	w.clearTree(addr)
+
 	// Remove the pure key since we're setting the full map value
 	delete(w.result, k)
 
@@ -308,6 +333,13 @@ func (w *MapFieldWriter) setSet(
 		value = s
 	}
 
+	// Clear any keys that match the set address first. This is necessary because
+	// it's always possible and sometimes may be necessary to write to a certain
+	// writer layer more than once with different set data each time, which will
+	// lead to different keys being inserted, which can lead to determinism
+	// problems when the old data isn't wiped first.
+	w.clearTree(addr)
+
 	for code, elem := range value.(*Set).m {
 		if err := w.set(append(addrCopy, code), elem); err != nil {
 			return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 3a97629..38cd8c7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const (
 	_getSource_name_0 = "getSourceStategetSourceConfig"
@@ -13,8 +13,6 @@ const (
 
 var (
 	_getSource_index_0 = [...]uint8{0, 14, 29}
-	_getSource_index_1 = [...]uint8{0, 13}
-	_getSource_index_2 = [...]uint8{0, 12}
 	_getSource_index_3 = [...]uint8{0, 18, 32}
 )
 
@@ -31,6 +29,6 @@ func (i getSource) String() string {
 		i -= 15
 		return _getSource_name_3[_getSource_index_3[i]:_getSource_index_3[i+1]]
 	default:
-		return fmt.Sprintf("getSource(%d)", i)
+		return "getSource(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index fb28b41..6cd325d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform/config"
+	"github.com/hashicorp/terraform/config/configschema"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -58,7 +59,7 @@ type Provider struct {
 
 	meta interface{}
 
-	// a mutex is required because TestReset can directly repalce the stopCtx
+	// a mutex is required because TestReset can directly replace the stopCtx
 	stopMu        sync.Mutex
 	stopCtx       context.Context
 	stopCtxCancel context.CancelFunc
@@ -185,6 +186,29 @@ func (p *Provider) TestReset() error {
 	return nil
 }
 
+// GetSchema implementation of terraform.ResourceProvider interface
+func (p *Provider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+	resourceTypes := map[string]*configschema.Block{}
+	dataSources := map[string]*configschema.Block{}
+
+	for _, name := range req.ResourceTypes {
+		if r, exists := p.ResourcesMap[name]; exists {
+			resourceTypes[name] = r.CoreConfigSchema()
+		}
+	}
+	for _, name := range req.DataSources {
+		if r, exists := p.DataSourcesMap[name]; exists {
+			dataSources[name] = r.CoreConfigSchema()
+		}
+	}
+
+	return &terraform.ProviderSchema{
+		Provider:      schemaMap(p.Schema).CoreConfigSchema(),
+		ResourceTypes: resourceTypes,
+		DataSources:   dataSources,
+	}, nil
+}
+
 // Input implementation of terraform.ResourceProvider interface.
 func (p *Provider) Input(
 	input terraform.UIInput,
@@ -227,7 +251,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
 	// Get a ResourceData for this configuration. To do this, we actually
 	// generate an intermediary "diff" although that is never exposed.
-	diff, err := sm.Diff(nil, c)
+	diff, err := sm.Diff(nil, c, nil, p.meta)
 	if err != nil {
 		return err
 	}
@@ -269,7 +293,7 @@ func (p *Provider) Diff(
 		return nil, fmt.Errorf("unknown resource type: %s", info.Type)
 	}
 
-	return r.Diff(s, c)
+	return r.Diff(s, c, p.meta)
 }
 
 // Refresh implementation of terraform.ResourceProvider interface.
@@ -305,6 +329,10 @@ func (p *Provider) Resources() []terraform.ResourceType {
 		result = append(result, terraform.ResourceType{
 			Name:       k,
 			Importable: resource.Importer != nil,
+
+			// Indicates that a provider is compiled against a new enough
+			// version of core to support the GetSchema method.
+			SchemaAvailable: true,
 		})
 	}
 
@@ -382,7 +410,7 @@ func (p *Provider) ReadDataDiff(
 		return nil, fmt.Errorf("unknown data source: %s", info.Type)
 	}
 
-	return r.Diff(nil, c)
+	return r.Diff(nil, c, p.meta)
 }
 
 // RefreshData implementation of terraform.ResourceProvider interface.
@@ -410,6 +438,10 @@ func (p *Provider) DataSources() []terraform.DataSource {
 	for _, k := range keys {
 		result = append(result, terraform.DataSource{
 			Name: k,
+
+			// Indicates that a provider is compiled against a new enough
+			// version of core to support the GetSchema method.
+			SchemaAvailable: true,
 		})
 	}
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index 476192e..a8d42db 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -146,7 +146,7 @@ func (p *Provisioner) Apply(
 		}
 
 		sm := schemaMap(p.ConnSchema)
-		diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+		diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
 		if err != nil {
 			return err
 		}
@@ -160,7 +160,7 @@ func (p *Provisioner) Apply(
 		// Build the configuration data. Doing this requires making a "diff"
 		// even though that's never used. We use that just to get the correct types.
 		configMap := schemaMap(p.Schema)
-		diff, err := configMap.Diff(nil, c)
+		diff, err := configMap.Diff(nil, c, nil, nil)
 		if err != nil {
 			return err
 		}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index ddba109..d3be2d6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -85,6 +85,37 @@ type Resource struct {
 	Delete DeleteFunc
 	Exists ExistsFunc
 
+	// CustomizeDiff is a custom function for working with the diff that
+	// Terraform has created for this resource - it can be used to customize the
+	// diff that has been created, diff values not controlled by configuration,
+	// or even veto the diff altogether and abort the plan. It is passed a
+	// *ResourceDiff, a structure similar to ResourceData but lacking most write
+	// functions like Set, while introducing new functions that work with the
+	// diff such as SetNew, SetNewComputed, and ForceNew.
+	//
+	// The phases Terraform runs this in, and the state available via functions
+	// like Get and GetChange, are as follows:
+	//
+	//  * New resource: One run with no state
+	//  * Existing resource: One run with state
+	//   * Existing resource, forced new: One run with state (before ForceNew),
+	//     then one run without state (as if new resource)
+	//  * Tainted resource: No runs (custom diff logic is skipped)
+	//  * Destroy: No runs (standard diff logic is skipped on destroy diffs)
+	//
+	// This function needs to be resilient to support all scenarios.
+	//
+	// If this function needs to access external API resources, remember to flag
+	// the RequiresRefresh attribute mentioned below to ensure that
+	// -refresh=false is blocked when running plan or apply, as this means that
+	// this resource requires refresh-like behaviour to work effectively.
+	//
+	// For the most part, only computed fields can be customized by this
+	// function.
+	//
+	// This function is only allowed on regular resources (not data sources).
+	CustomizeDiff CustomizeDiffFunc
+
 	// Importer is the ResourceImporter implementation for this resource.
 	// If this is nil, then this resource does not support importing. If
 	// this is non-nil, then it supports importing and ResourceImporter
@@ -93,9 +124,7 @@ type Resource struct {
 	Importer *ResourceImporter
 
 	// If non-empty, this string is emitted as a warning during Validate.
-	// This is a private interface for now, for use by DataSourceResourceShim,
-	// and not for general use. (But maybe later...)
-	deprecationMessage string
+	DeprecationMessage string
 
 	// Timeouts allow users to specify specific time durations in which an
 	// operation should time out, to allow them to extend an action to suit their
@@ -126,6 +155,9 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
 	int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+// See Resource documentation.
+type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
+
 // Apply creates, updates, and/or deletes a resource.
 func (r *Resource) Apply(
 	s *terraform.InstanceState,
@@ -202,11 +234,11 @@ func (r *Resource) Apply(
 	return r.recordCurrentSchemaVersion(data.State()), err
 }
 
-// Diff returns a diff of this resource and is API compatible with the
-// ResourceProvider interface.
+// Diff returns a diff of this resource.
 func (r *Resource) Diff(
 	s *terraform.InstanceState,
-	c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+	c *terraform.ResourceConfig,
+	meta interface{}) (*terraform.InstanceDiff, error) {
 
 	t := &ResourceTimeout{}
 	err := t.ConfigDecode(r, c)
@@ -215,7 +247,7 @@ func (r *Resource) Diff(
 		return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
 	}
 
-	instanceDiff, err := schemaMap(r.Schema).Diff(s, c)
+	instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
 	if err != nil {
 		return instanceDiff, err
 	}
@@ -235,8 +267,8 @@ func (r *Resource) Diff(
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 	warns, errs := schemaMap(r.Schema).Validate(c)
 
-	if r.deprecationMessage != "" {
-		warns = append(warns, r.deprecationMessage)
+	if r.DeprecationMessage != "" {
+		warns = append(warns, r.DeprecationMessage)
 	}
 
 	return warns, errs
@@ -248,7 +280,6 @@ func (r *Resource) ReadDataApply(
 	d *terraform.InstanceDiff,
 	meta interface{},
 ) (*terraform.InstanceState, error) {
-
 	// Data sources are always built completely from scratch
 	// on each read, so the source state is always nil.
 	data, err := schemaMap(r.Schema).Data(nil, d)
@@ -346,6 +377,11 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 		if r.Create != nil || r.Update != nil || r.Delete != nil {
 			return fmt.Errorf("must not implement Create, Update or Delete")
 		}
+
+		// CustomizeDiff cannot be defined for read-only resources
+		if r.CustomizeDiff != nil {
+			return fmt.Errorf("cannot implement CustomizeDiff")
+		}
 	}
 
 	tsm := topSchemaMap
@@ -393,19 +429,43 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 				return err
 			}
 		}
+
+		for k, f := range tsm {
+			if isReservedResourceFieldName(k, f) {
+				return fmt.Errorf("%s is a reserved field name", k)
+			}
+		}
 	}
 
-	// Resource-specific checks
-	for k, _ := range tsm {
-		if isReservedResourceFieldName(k) {
-			return fmt.Errorf("%s is a reserved field name for a resource", k)
+	// Data source
+	if r.isTopLevel() && !writable {
+		tsm = schemaMap(r.Schema)
+		for k, _ := range tsm {
+			if isReservedDataSourceFieldName(k) {
+				return fmt.Errorf("%s is a reserved field name", k)
+			}
 		}
 	}
 
 	return schemaMap(r.Schema).InternalValidate(tsm)
 }
 
-func isReservedResourceFieldName(name string) bool {
+func isReservedDataSourceFieldName(name string) bool {
+	for _, reservedName := range config.ReservedDataSourceFields {
+		if name == reservedName {
+			return true
+		}
+	}
+	return false
+}
+
+func isReservedResourceFieldName(name string, s *Schema) bool {
+	// Allow phasing out "id"
+	// See https://github.com/terraform-providers/terraform-provider-aws/pull/1626#issuecomment-328881415
+	if name == "id" && (s.Deprecated != "" || s.Removed != "") {
+		return false
+	}
+
 	for _, reservedName := range config.ReservedResourceFields {
 		if name == reservedName {
 			return true
@@ -430,6 +490,12 @@ func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
 		panic(err)
 	}
 
+	// load the Resource timeouts
+	result.timeouts = r.Timeouts
+	if result.timeouts == nil {
+		result.timeouts = &ResourceTimeout{}
+	}
+
 	// Set the schema version to latest by default
 	result.meta = map[string]interface{}{
 		"schema_version": strconv.Itoa(r.SchemaVersion),
@@ -450,7 +516,7 @@ func (r *Resource) TestResourceData() *ResourceData {
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
 	// TODO: This is a heuristic; replace with a definitive attribute?
-	return r.Create != nil
+	return (r.Create != nil || r.Read != nil)
 }
 
 // Determines if a given InstanceState needs to be migrated by checking the
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index b2bc8f6..6cc01ee 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -35,6 +35,8 @@ type ResourceData struct {
 	partialMap  map[string]struct{}
 	once        sync.Once
 	isNew       bool
+
+	panicOnError bool
 }
 
 // getResult is the internal structure that is generated when a Get
@@ -104,6 +106,22 @@ func (d *ResourceData) GetOk(key string) (interface{}, bool) {
 	return r.Value, exists
 }
 
+// GetOkExists returns the data for a given key and whether or not the key
+// has been set to a non-zero value. This is only useful for determining
+// if boolean attributes have been set, if they are Optional but do not
+// have a Default value.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+// This should only be used if absolutely required/needed.
+func (d *ResourceData) GetOkExists(key string) (interface{}, bool) {
+	r := d.getRaw(key, getSourceSet)
+	exists := r.Exists && !r.Computed
+	return r.Value, exists
+}
+
 func (d *ResourceData) getRaw(key string, level getSource) getResult {
 	var parts []string
 	if key != "" {
@@ -168,7 +186,11 @@ func (d *ResourceData) Set(key string, value interface{}) error {
 		}
 	}
 
-	return d.setWriter.WriteField(strings.Split(key, "."), value)
+	err := d.setWriter.WriteField(strings.Split(key, "."), value)
+	if err != nil && d.panicOnError {
+		panic(err)
+	}
+	return err
 }
 
 // SetPartial adds the key to the final state output while
@@ -293,6 +315,7 @@ func (d *ResourceData) State() *terraform.InstanceState {
 
 	mapW := &MapFieldWriter{Schema: d.schema}
 	if err := mapW.WriteField(nil, rawMap); err != nil {
+		log.Printf("[ERR] Error writing fields: %s", err)
 		return nil
 	}
 
@@ -344,6 +367,13 @@ func (d *ResourceData) State() *terraform.InstanceState {
 func (d *ResourceData) Timeout(key string) time.Duration {
 	key = strings.ToLower(key)
 
+	// System default of 20 minutes
+	defaultTimeout := 20 * time.Minute
+
+	if d.timeouts == nil {
+		return defaultTimeout
+	}
+
 	var timeout *time.Duration
 	switch key {
 	case TimeoutCreate:
@@ -364,8 +394,7 @@ func (d *ResourceData) Timeout(key string) time.Duration {
 		return *d.timeouts.Default
 	}
 
-	// Return system default of 20 minutes
-	return 20 * time.Minute
+	return defaultTimeout
 }
 
 func (d *ResourceData) init() {
@@ -423,7 +452,7 @@ func (d *ResourceData) init() {
 }
 
 func (d *ResourceData) diffChange(
-	k string) (interface{}, interface{}, bool, bool) {
+	k string) (interface{}, interface{}, bool, bool, bool) {
 	// Get the change between the state and the config.
 	o, n := d.getChange(k, getSourceState, getSourceConfig|getSourceExact)
 	if !o.Exists {
@@ -434,7 +463,7 @@ func (d *ResourceData) diffChange(
 	}
 
 	// Return the old, new, and whether there is a change
-	return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed
+	return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed, false
 }
 
 func (d *ResourceData) getChange(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
new file mode 100644
index 0000000..7db3dec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -0,0 +1,559 @@
+package schema
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"sync"
+
+	"github.com/hashicorp/terraform/terraform"
+)
+
+// newValueWriter is a minor re-implementation of MapFieldWriter to include
+// keys that should be marked as computed, to represent the new part of a
+// pseudo-diff.
+type newValueWriter struct {
+	*MapFieldWriter
+
+	// A list of keys that should be marked as computed.
+	computedKeys map[string]bool
+
+	// A lock to prevent races on writes. The underlying writer will have one as
+	// well - this is for computed keys.
+	lock sync.Mutex
+
+	// To be used with init.
+	once sync.Once
+}
+
+// init performs any initialization tasks for the newValueWriter.
+func (w *newValueWriter) init() {
+	if w.computedKeys == nil {
+		w.computedKeys = make(map[string]bool)
+	}
+}
+
+// WriteField overrides MapValueWriter's WriteField, adding the ability to flag
+// the address as computed.
+func (w *newValueWriter) WriteField(address []string, value interface{}, computed bool) error {
+	// Fail the write if we have a non-nil value and computed is true.
+	// NewComputed values should not have a value when written.
+	if value != nil && computed {
+		return errors.New("Non-nil value with computed set")
+	}
+
+	if err := w.MapFieldWriter.WriteField(address, value); err != nil {
+		return err
+	}
+
+	w.once.Do(w.init)
+
+	w.lock.Lock()
+	defer w.lock.Unlock()
+	if computed {
+		w.computedKeys[strings.Join(address, ".")] = true
+	}
+	return nil
+}
+
+// ComputedKeysMap returns the underlying computed keys map.
+func (w *newValueWriter) ComputedKeysMap() map[string]bool {
+	w.once.Do(w.init)
+	return w.computedKeys
+}
+
+// newValueReader is a minor re-implementation of MapFieldReader and is the
+// read counterpart to MapValueWriter, allowing the read of keys flagged as
+// computed to accommodate the diff override logic in ResourceDiff.
+type newValueReader struct {
+	*MapFieldReader
+
+	// The list of computed keys from a newValueWriter.
+	computedKeys map[string]bool
+}
+
+// ReadField reads the values from the underlying writer, returning the
+// computed value if it is found as well.
+func (r *newValueReader) ReadField(address []string) (FieldReadResult, error) {
+	addrKey := strings.Join(address, ".")
+	v, err := r.MapFieldReader.ReadField(address)
+	if err != nil {
+		return FieldReadResult{}, err
+	}
+	for computedKey := range r.computedKeys {
+		if childAddrOf(addrKey, computedKey) {
+			if strings.HasSuffix(addrKey, ".#") {
+				// This is a count value for a list or set that has been marked as
+				// computed, or a sub-list/sub-set of a complex resource that has
+				// been marked as computed.  We need to pass through to other readers
+				// so that an accurate previous count can be fetched for the diff.
+				v.Exists = false
+			}
+			v.Computed = true
+		}
+	}
+
+	return v, nil
+}
+
+// ResourceDiff is used to query and make custom changes to an in-flight diff.
+// It can be used to veto particular changes in the diff, customize the diff
+// that has been created, or diff values not controlled by config.
+//
+// The object functions similar to ResourceData, however most notably lacks
+// Set, SetPartial, and Partial, as it should be used to change diff values
+// only.  Most other first-class ResourceData functions exist, namely Get,
+// GetOk, HasChange, and GetChange exist.
+//
+// All functions in ResourceDiff, save for ForceNew, can only be used on
+// computed fields.
+type ResourceDiff struct {
+	// The schema for the resource being worked on.
+	schema map[string]*Schema
+
+	// The current config for this resource.
+	config *terraform.ResourceConfig
+
+	// The state for this resource as it exists post-refresh, after the initial
+	// diff.
+	state *terraform.InstanceState
+
+	// The diff created by Terraform. This diff is used, along with state,
+	// config, and custom-set diff data, to provide a multi-level reader
+	// experience similar to ResourceData.
+	diff *terraform.InstanceDiff
+
+	// The internal reader structure that contains the state, config, the default
+	// diff, and the new diff.
+	multiReader *MultiLevelFieldReader
+
+	// A writer that writes overridden new fields.
+	newWriter *newValueWriter
+
+	// Tracks which keys have been updated by ResourceDiff to ensure that the
+	// diff does not get re-run on keys that were not touched, or diffs that were
+	// just removed (re-running on the latter would just roll back the removal).
+	updatedKeys map[string]bool
+
+	// Tracks which keys were flagged as forceNew. These keys are not saved in
+	// newWriter, but we need to track them so that they can be re-diffed later.
+	forcedNewKeys map[string]bool
+}
+
+// newResourceDiff creates a new ResourceDiff instance.
+func newResourceDiff(schema map[string]*Schema, config *terraform.ResourceConfig, state *terraform.InstanceState, diff *terraform.InstanceDiff) *ResourceDiff {
+	d := &ResourceDiff{
+		config: config,
+		state:  state,
+		diff:   diff,
+		schema: schema,
+	}
+
+	d.newWriter = &newValueWriter{
+		MapFieldWriter: &MapFieldWriter{Schema: d.schema},
+	}
+	readers := make(map[string]FieldReader)
+	var stateAttributes map[string]string
+	if d.state != nil {
+		stateAttributes = d.state.Attributes
+		readers["state"] = &MapFieldReader{
+			Schema: d.schema,
+			Map:    BasicMapReader(stateAttributes),
+		}
+	}
+	if d.config != nil {
+		readers["config"] = &ConfigFieldReader{
+			Schema: d.schema,
+			Config: d.config,
+		}
+	}
+	if d.diff != nil {
+		readers["diff"] = &DiffFieldReader{
+			Schema: d.schema,
+			Diff:   d.diff,
+			Source: &MultiLevelFieldReader{
+				Levels:  []string{"state", "config"},
+				Readers: readers,
+			},
+		}
+	}
+	readers["newDiff"] = &newValueReader{
+		MapFieldReader: &MapFieldReader{
+			Schema: d.schema,
+			Map:    BasicMapReader(d.newWriter.Map()),
+		},
+		computedKeys: d.newWriter.ComputedKeysMap(),
+	}
+	d.multiReader = &MultiLevelFieldReader{
+		Levels: []string{
+			"state",
+			"config",
+			"diff",
+			"newDiff",
+		},
+
+		Readers: readers,
+	}
+
+	d.updatedKeys = make(map[string]bool)
+	d.forcedNewKeys = make(map[string]bool)
+
+	return d
+}
+
+// UpdatedKeys returns the keys that were updated by this ResourceDiff run.
+// These are the only keys that a diff should be re-calculated for.
+//
+// This is the combined result of both keys for which diff values were updated
+// for or cleared, and also keys that were flagged to be re-diffed as a result
+// of ForceNew.
+func (d *ResourceDiff) UpdatedKeys() []string {
+	var s []string
+	for k := range d.updatedKeys {
+		s = append(s, k)
+	}
+	for k := range d.forcedNewKeys {
+		for _, l := range s {
+			if k == l {
+				break
+			}
+		}
+		s = append(s, k)
+	}
+	return s
+}
+
+// Clear wipes the diff for a particular key. It is called by ResourceDiff's
+// functionality to remove any possibility of conflicts, but can be called on
+// its own to just remove a specific key from the diff completely.
+//
+// Note that this does not wipe an override. This function is only allowed on
+// computed keys.
+func (d *ResourceDiff) Clear(key string) error {
+	if err := d.checkKey(key, "Clear", true); err != nil {
+		return err
+	}
+
+	return d.clear(key)
+}
+
+func (d *ResourceDiff) clear(key string) error {
+	// Check the schema to make sure that this key exists first.
+	schemaL := addrToSchema(strings.Split(key, "."), d.schema)
+	if len(schemaL) == 0 {
+		return fmt.Errorf("%s is not a valid key", key)
+	}
+
+	for k := range d.diff.Attributes {
+		if strings.HasPrefix(k, key) {
+			delete(d.diff.Attributes, k)
+		}
+	}
+	return nil
+}
+
+// GetChangedKeysPrefix helps to implement Resource.CustomizeDiff
+// where we need to act on all nested fields
+// without calling out each one separately
+func (d *ResourceDiff) GetChangedKeysPrefix(prefix string) []string {
+	keys := make([]string, 0)
+	for k := range d.diff.Attributes {
+		if strings.HasPrefix(k, prefix) {
+			keys = append(keys, k)
+		}
+	}
+	return keys
+}
+
+// diffChange helps to implement resourceDiffer and derives its change values
+// from ResourceDiff's own change data, in addition to existing diff, config, and state.
+func (d *ResourceDiff) diffChange(key string) (interface{}, interface{}, bool, bool, bool) {
+	old, new, customized := d.getChange(key)
+
+	if !old.Exists {
+		old.Value = nil
+	}
+	if !new.Exists || d.removed(key) {
+		new.Value = nil
+	}
+
+	return old.Value, new.Value, !reflect.DeepEqual(old.Value, new.Value), new.Computed, customized
+}
+
+// SetNew is used to set a new diff value for the mentioned key. The value must
+// be correct for the attribute's schema (mostly relevant for maps, lists, and
+// sets). The original value from the state is used as the old value.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNew(key string, value interface{}) error {
+	if err := d.checkKey(key, "SetNew", false); err != nil {
+		return err
+	}
+
+	return d.setDiff(key, value, false)
+}
+
+// SetNewComputed functions like SetNew, except that it blanks out a new value
+// and marks it as computed.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNewComputed(key string) error {
+	if err := d.checkKey(key, "SetNewComputed", false); err != nil {
+		return err
+	}
+
+	return d.setDiff(key, nil, true)
+}
+
+// setDiff performs common diff setting behaviour.
+func (d *ResourceDiff) setDiff(key string, new interface{}, computed bool) error {
+	if err := d.clear(key); err != nil {
+		return err
+	}
+
+	if err := d.newWriter.WriteField(strings.Split(key, "."), new, computed); err != nil {
+		return fmt.Errorf("Cannot set new diff value for key %s: %s", key, err)
+	}
+
+	d.updatedKeys[key] = true
+
+	return nil
+}
+
+// ForceNew force-flags ForceNew in the schema for a specific key, and
+// re-calculates its diff, effectively causing this attribute to force a new
+// resource.
+//
+// Keep in mind that forcing a new resource will force a second run of the
+// resource's CustomizeDiff function (with a new ResourceDiff) once the current
+// one has completed. This second run is performed without state. This behavior
+// will be the same as if a new resource is being created and is performed to
+// ensure that the diff looks like the diff for a new resource as much as
+// possible. CustomizeDiff should expect such a scenario and act correctly.
+//
+// This function is a no-op/error if there is no diff.
+//
+// Note that the change to schema is permanent for the lifecycle of this
+// specific ResourceDiff instance.
+func (d *ResourceDiff) ForceNew(key string) error {
+	if !d.HasChange(key) {
+		return fmt.Errorf("ForceNew: No changes for %s", key)
+	}
+
+	keyParts := strings.Split(key, ".")
+	var schema *Schema
+	schemaL := addrToSchema(keyParts, d.schema)
+	if len(schemaL) > 0 {
+		schema = schemaL[len(schemaL)-1]
+	} else {
+		return fmt.Errorf("ForceNew: %s is not a valid key", key)
+	}
+
+	schema.ForceNew = true
+
+	// Flag this for a re-diff. Don't save any values to guarantee that existing
+	// diffs aren't messed with, as this gets messy when dealing with complex
+	// structures, zero values, etc.
+	d.forcedNewKeys[keyParts[0]] = true
+
+	return nil
+}
+
+// Get hands off to ResourceData.Get.
+func (d *ResourceDiff) Get(key string) interface{} {
+	r, _ := d.GetOk(key)
+	return r
+}
+
+// GetChange gets the change between the state and diff, checking first to see
+// if a overridden diff exists.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) GetChange(key string) (interface{}, interface{}) {
+	old, new, _ := d.getChange(key)
+	return old.Value, new.Value
+}
+
+// GetOk functions the same way as ResourceData.GetOk, but it also checks the
+// new diff levels to provide data consistent with the current state of the
+// customized diff.
+func (d *ResourceDiff) GetOk(key string) (interface{}, bool) {
+	r := d.get(strings.Split(key, "."), "newDiff")
+	exists := r.Exists && !r.Computed
+	if exists {
+		// If it exists, we also want to verify it is not the zero-value.
+		value := r.Value
+		zero := r.Schema.Type.Zero()
+
+		if eq, ok := value.(Equal); ok {
+			exists = !eq.Equal(zero)
+		} else {
+			exists = !reflect.DeepEqual(value, zero)
+		}
+	}
+
+	return r.Value, exists
+}
+
+// GetOkExists functions the same way as GetOkExists within ResourceData, but
+// it also checks the new diff levels to provide data consistent with the
+// current state of the customized diff.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+func (d *ResourceDiff) GetOkExists(key string) (interface{}, bool) {
+	r := d.get(strings.Split(key, "."), "newDiff")
+	exists := r.Exists && !r.Computed
+	return r.Value, exists
+}
+
+// NewValueKnown returns true if the new value for the given key is available
+// as its final value at diff time. If the return value is false, this means
+// either the value is based of interpolation that was unavailable at diff
+// time, or that the value was explicitly marked as computed by SetNewComputed.
+func (d *ResourceDiff) NewValueKnown(key string) bool {
+	r := d.get(strings.Split(key, "."), "newDiff")
+	return !r.Computed
+}
+
+// HasChange checks to see if there is a change between state and the diff, or
+// in the overridden diff.
+func (d *ResourceDiff) HasChange(key string) bool {
+	old, new := d.GetChange(key)
+
+	// If the type implements the Equal interface, then call that
+	// instead of just doing a reflect.DeepEqual. An example where this is
+	// needed is *Set
+	if eq, ok := old.(Equal); ok {
+		return !eq.Equal(new)
+	}
+
+	return !reflect.DeepEqual(old, new)
+}
+
+// Id returns the ID of this resource.
+//
+// Note that technically, ID does not change during diffs (it either has
+// already changed in the refresh, or will change on update), hence we do not
+// support updating the ID or fetching it from anything else other than state.
+func (d *ResourceDiff) Id() string {
+	var result string
+
+	if d.state != nil {
+		result = d.state.ID
+	}
+	return result
+}
+
+// getChange gets values from two different levels, designed for use in
+// diffChange, HasChange, and GetChange.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) getChange(key string) (getResult, getResult, bool) {
+	old := d.get(strings.Split(key, "."), "state")
+	var new getResult
+	for p := range d.updatedKeys {
+		if childAddrOf(key, p) {
+			new = d.getExact(strings.Split(key, "."), "newDiff")
+			return old, new, true
+		}
+	}
+	new = d.get(strings.Split(key, "."), "newDiff")
+	return old, new, false
+}
+
+// removed checks to see if the key is present in the existing, pre-customized
+// diff and if it was marked as NewRemoved.
+func (d *ResourceDiff) removed(k string) bool {
+	diff, ok := d.diff.Attributes[k]
+	if !ok {
+		return false
+	}
+	return diff.NewRemoved
+}
+
+// get performs the appropriate multi-level reader logic for ResourceDiff,
+// starting at source. Refer to newResourceDiff for the level order.
+func (d *ResourceDiff) get(addr []string, source string) getResult {
+	result, err := d.multiReader.ReadFieldMerge(addr, source)
+	if err != nil {
+		panic(err)
+	}
+
+	return d.finalizeResult(addr, result)
+}
+
+// getExact gets an attribute from the exact level referenced by source.
+func (d *ResourceDiff) getExact(addr []string, source string) getResult {
+	result, err := d.multiReader.ReadFieldExact(addr, source)
+	if err != nil {
+		panic(err)
+	}
+
+	return d.finalizeResult(addr, result)
+}
+
+// finalizeResult does some post-processing of the result produced by get and getExact.
+func (d *ResourceDiff) finalizeResult(addr []string, result FieldReadResult) getResult {
+	// If the result doesn't exist, then we set the value to the zero value
+	var schema *Schema
+	if schemaL := addrToSchema(addr, d.schema); len(schemaL) > 0 {
+		schema = schemaL[len(schemaL)-1]
+	}
+
+	if result.Value == nil && schema != nil {
+		result.Value = result.ValueOrZero(schema)
+	}
+
+	// Transform the FieldReadResult into a getResult. It might be worth
+	// merging these two structures one day.
+	return getResult{
+		Value:          result.Value,
+		ValueProcessed: result.ValueProcessed,
+		Computed:       result.Computed,
+		Exists:         result.Exists,
+		Schema:         schema,
+	}
+}
+
+// childAddrOf does a comparison of two addresses to see if one is the child of
+// the other.
+func childAddrOf(child, parent string) bool {
+	cs := strings.Split(child, ".")
+	ps := strings.Split(parent, ".")
+	if len(ps) > len(cs) {
+		return false
+	}
+	return reflect.DeepEqual(ps, cs[:len(ps)])
+}
+
+// checkKey checks the key to make sure it exists and is computed.
+func (d *ResourceDiff) checkKey(key, caller string, nested bool) error {
+	var schema *Schema
+	if nested {
+		keyParts := strings.Split(key, ".")
+		schemaL := addrToSchema(keyParts, d.schema)
+		if len(schemaL) > 0 {
+			schema = schemaL[len(schemaL)-1]
+		}
+	} else {
+		s, ok := d.schema[key]
+		if ok {
+			schema = s
+		}
+	}
+	if schema == nil {
+		return fmt.Errorf("%s: invalid key: %s", caller, key)
+	}
+	if !schema.Computed {
+		return fmt.Errorf("%s only operates on computed keys - %s is not one", caller, key)
+	}
+	return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index acb5618..0ea5aad 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -21,9 +21,13 @@ import (
 	"strings"
 
 	"github.com/hashicorp/terraform/terraform"
+	"github.com/mitchellh/copystructure"
 	"github.com/mitchellh/mapstructure"
 )
 
+// Name of ENV variable which (if not empty) prefers panic over error
+const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
+
 // type used for schema package context keys
 type contextKey string
 
@@ -116,12 +120,16 @@ type Schema struct {
 	ForceNew  bool
 	StateFunc SchemaStateFunc
 
-	// The following fields are only set for a TypeList or TypeSet Type.
+	// The following fields are only set for a TypeList, TypeSet, or TypeMap.
 	//
-	// Elem must be either a *Schema or a *Resource only if the Type is
-	// TypeList, and represents what the element type is. If it is *Schema,
-	// the element type is just a simple value. If it is *Resource, the
-	// element type is a complex structure, potentially with its own lifecycle.
+	// Elem represents the element type. For a TypeMap, it must be a *Schema
+	// with a Type of TypeString, otherwise it may be either a *Schema or a
+	// *Resource. If it is *Schema, the element type is just a simple value.
+	// If it is *Resource, the element type is a complex structure,
+	// potentially with its own lifecycle.
+	Elem interface{}
+
+	// The following fields are only set for a TypeList or TypeSet.
 	//
 	// MaxItems defines a maximum amount of items that can exist within a
 	// TypeSet or TypeList. Specific use cases would be if a TypeSet is being
@@ -138,7 +146,6 @@ type Schema struct {
 	// ["foo"] automatically. This is primarily for legacy reasons and the
 	// ambiguity is not recommended for new usage. Promotion is only allowed
 	// for primitive element types.
-	Elem          interface{}
 	MaxItems      int
 	MinItems      int
 	PromoteSingle bool
@@ -192,7 +199,7 @@ type Schema struct {
 	Sensitive bool
 }
 
-// SchemaDiffSuppresFunc is a function which can be used to determine
+// SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
 //
@@ -289,8 +296,7 @@ func (s *Schema) ZeroValue() interface{} {
 	}
 }
 
-func (s *Schema) finalizeDiff(
-	d *terraform.ResourceAttrDiff) *terraform.ResourceAttrDiff {
+func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *terraform.ResourceAttrDiff {
 	if d == nil {
 		return d
 	}
@@ -331,13 +337,20 @@ func (s *Schema) finalizeDiff(
 	}
 
 	if s.Computed {
-		if d.Old != "" && d.New == "" {
-			// This is a computed value with an old value set already,
-			// just let it go.
-			return nil
+		// FIXME: This is where the customized bool from getChange finally
+		//        comes into play.  It allows the previously incorrect behavior
+		//        of an empty string being used as "unset" when the value is
+		//        computed. This should be removed once we can properly
+		//        represent an unset/nil value from the configuration.
+		if !customized {
+			if d.Old != "" && d.New == "" {
+				// This is a computed value with an old value set already,
+				// just let it go.
+				return nil
+			}
 		}
 
-		if d.New == "" {
+		if d.New == "" && !d.NewComputed {
 			// Computed attribute without a new value set
 			d.NewComputed = true
 		}
@@ -354,6 +367,13 @@ func (s *Schema) finalizeDiff(
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
+func (m schemaMap) panicOnError() bool {
+	if os.Getenv(PanicOnErr) != "" {
+		return true
+	}
+	return false
+}
+
 // Data returns a ResourceData for the given schema, state, and diff.
 //
 // The diff is optional.
@@ -361,17 +381,30 @@ func (m schemaMap) Data(
 	s *terraform.InstanceState,
 	d *terraform.InstanceDiff) (*ResourceData, error) {
 	return &ResourceData{
-		schema: m,
-		state:  s,
-		diff:   d,
+		schema:       m,
+		state:        s,
+		diff:         d,
+		panicOnError: m.panicOnError(),
 	}, nil
 }
 
+// DeepCopy returns a copy of this schemaMap. The copy can be safely modified
+// without affecting the original.
+func (m *schemaMap) DeepCopy() schemaMap {
+	copy, err := copystructure.Config{Lock: true}.Copy(m)
+	if err != nil {
+		panic(err)
+	}
+	return *copy.(*schemaMap)
+}
+
 // Diff returns the diff for a resource given the schema map,
 // state, and configuration.
 func (m schemaMap) Diff(
 	s *terraform.InstanceState,
-	c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+	c *terraform.ResourceConfig,
+	customizeDiff CustomizeDiffFunc,
+	meta interface{}) (*terraform.InstanceDiff, error) {
 	result := new(terraform.InstanceDiff)
 	result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -381,9 +414,10 @@ func (m schemaMap) Diff(
 	}
 
 	d := &ResourceData{
-		schema: m,
-		state:  s,
-		config: c,
+		schema:       m,
+		state:        s,
+		config:       c,
+		panicOnError: m.panicOnError(),
 	}
 
 	for k, schema := range m {
@@ -393,6 +427,29 @@ func (m schemaMap) Diff(
 		}
 	}
 
+	// Remove any nil diffs just to keep things clean
+	for k, v := range result.Attributes {
+		if v == nil {
+			delete(result.Attributes, k)
+		}
+	}
+
+	// If this is a non-destroy diff, call any custom diff logic that has been
+	// defined.
+	if !result.DestroyTainted && customizeDiff != nil {
+		mc := m.DeepCopy()
+		rd := newResourceDiff(mc, c, s, result)
+		if err := customizeDiff(rd, meta); err != nil {
+			return nil, err
+		}
+		for _, k := range rd.UpdatedKeys() {
+			err := m.diff(k, mc[k], result, rd, false)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
 	// If the diff requires a new resource, then we recompute the diff
 	// so we have the complete new resource diff, and preserve the
 	// RequiresNew fields where necessary so the user knows exactly what
@@ -418,6 +475,21 @@ func (m schemaMap) Diff(
 			}
 		}
 
+		// Re-run customization
+		if !result2.DestroyTainted && customizeDiff != nil {
+			mc := m.DeepCopy()
+			rd := newResourceDiff(mc, c, d.state, result2)
+			if err := customizeDiff(rd, meta); err != nil {
+				return nil, err
+			}
+			for _, k := range rd.UpdatedKeys() {
+				err := m.diff(k, mc[k], result2, rd, false)
+				if err != nil {
+					return nil, err
+				}
+			}
+		}
+
 		// Force all the fields to not force a new since we know what we
 		// want to force new.
 		for k, attr := range result2.Attributes {
@@ -456,13 +528,6 @@ func (m schemaMap) Diff(
 		result = result2
 	}
 
-	// Remove any nil diffs just to keep things clean
-	for k, v := range result.Attributes {
-		if v == nil {
-			delete(result.Attributes, k)
-		}
-	}
-
 	// Go through and detect all of the ComputedWhens now that we've
 	// finished the diff.
 	// TODO
@@ -681,11 +746,23 @@ func isValidFieldName(name string) bool {
 	return re.MatchString(name)
 }
 
+// resourceDiffer is an interface that is used by the private diff functions.
+// This helps facilitate diff logic for both ResourceData and ResoureDiff with
+// minimal divergence in code.
+type resourceDiffer interface {
+	diffChange(string) (interface{}, interface{}, bool, bool, bool)
+	Get(string) interface{}
+	GetChange(string) (interface{}, interface{})
+	GetOk(string) (interface{}, bool)
+	HasChange(string) bool
+	Id() string
+}
+
 func (m schemaMap) diff(
 	k string,
 	schema *Schema,
 	diff *terraform.InstanceDiff,
-	d *ResourceData,
+	d resourceDiffer,
 	all bool) error {
 
 	unsupressedDiff := new(terraform.InstanceDiff)
@@ -706,12 +783,14 @@ func (m schemaMap) diff(
 	}
 
 	for attrK, attrV := range unsupressedDiff.Attributes {
-		if schema.DiffSuppressFunc != nil &&
-			attrV != nil &&
-			schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, d) {
-			continue
+		switch rd := d.(type) {
+		case *ResourceData:
+			if schema.DiffSuppressFunc != nil &&
+				attrV != nil &&
+				schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
+				continue
+			}
 		}
-
 		diff.Attributes[attrK] = attrV
 	}
 
@@ -722,9 +801,9 @@ func (m schemaMap) diffList(
 	k string,
 	schema *Schema,
 	diff *terraform.InstanceDiff,
-	d *ResourceData,
+	d resourceDiffer,
 	all bool) error {
-	o, n, _, computedList := d.diffChange(k)
+	o, n, _, computedList, customized := d.diffChange(k)
 	if computedList {
 		n = nil
 	}
@@ -791,10 +870,13 @@ func (m schemaMap) diffList(
 			oldStr = ""
 		}
 
-		diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-			Old: oldStr,
-			New: newStr,
-		})
+		diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+			&terraform.ResourceAttrDiff{
+				Old: oldStr,
+				New: newStr,
+			},
+			customized,
+		)
 	}
 
 	// Figure out the maximum
@@ -841,13 +923,13 @@ func (m schemaMap) diffMap(
 	k string,
 	schema *Schema,
 	diff *terraform.InstanceDiff,
-	d *ResourceData,
+	d resourceDiffer,
 	all bool) error {
 	prefix := k + "."
 
 	// First get all the values from the state
 	var stateMap, configMap map[string]string
-	o, n, _, nComputed := d.diffChange(k)
+	o, n, _, nComputed, customized := d.diffChange(k)
 	if err := mapstructure.WeakDecode(o, &stateMap); err != nil {
 		return fmt.Errorf("%s: %s", k, err)
 	}
@@ -899,6 +981,7 @@ func (m schemaMap) diffMap(
 				Old: oldStr,
 				New: newStr,
 			},
+			customized,
 		)
 	}
 
@@ -916,16 +999,22 @@ func (m schemaMap) diffMap(
 			continue
 		}
 
-		diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-			Old: old,
-			New: v,
-		})
+		diff.Attributes[prefix+k] = schema.finalizeDiff(
+			&terraform.ResourceAttrDiff{
+				Old: old,
+				New: v,
+			},
+			customized,
+		)
 	}
 	for k, v := range stateMap {
-		diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-			Old:        v,
-			NewRemoved: true,
-		})
+		diff.Attributes[prefix+k] = schema.finalizeDiff(
+			&terraform.ResourceAttrDiff{
+				Old:        v,
+				NewRemoved: true,
+			},
+			customized,
+		)
 	}
 
 	return nil
@@ -935,10 +1024,10 @@ func (m schemaMap) diffSet(
 	k string,
 	schema *Schema,
 	diff *terraform.InstanceDiff,
-	d *ResourceData,
+	d resourceDiffer,
 	all bool) error {
 
-	o, n, _, computedSet := d.diffChange(k)
+	o, n, _, computedSet, customized := d.diffChange(k)
 	if computedSet {
 		n = nil
 	}
@@ -997,20 +1086,26 @@ func (m schemaMap) diffSet(
 			countStr = ""
 		}
 
-		diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-			Old:         countStr,
-			NewComputed: true,
-		})
+		diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+			&terraform.ResourceAttrDiff{
+				Old:         countStr,
+				NewComputed: true,
+			},
+			customized,
+		)
 		return nil
 	}
 
 	// If the counts are not the same, then record that diff
 	changed := oldLen != newLen
 	if changed || all {
-		diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-			Old: oldStr,
-			New: newStr,
-		})
+		diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+			&terraform.ResourceAttrDiff{
+				Old: oldStr,
+				New: newStr,
+			},
+			customized,
+		)
 	}
 
 	// Build the list of codes that will make up our set. This is the
@@ -1056,11 +1151,11 @@ func (m schemaMap) diffString(
 	k string,
 	schema *Schema,
 	diff *terraform.InstanceDiff,
-	d *ResourceData,
+	d resourceDiffer,
 	all bool) error {
 	var originalN interface{}
 	var os, ns string
-	o, n, _, computed := d.diffChange(k)
+	o, n, _, computed, customized := d.diffChange(k)
 	if schema.StateFunc != nil && n != nil {
 		originalN = n
 		n = schema.StateFunc(n)
@@ -1090,20 +1185,23 @@ func (m schemaMap) diffString(
 	}
 
 	removed := false
-	if o != nil && n == nil {
+	if o != nil && n == nil && !computed {
 		removed = true
 	}
 	if removed && schema.Computed {
 		return nil
 	}
 
-	diff.Attributes[k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-		Old:         os,
-		New:         ns,
-		NewExtra:    originalN,
-		NewRemoved:  removed,
-		NewComputed: computed,
-	})
+	diff.Attributes[k] = schema.finalizeDiff(
+		&terraform.ResourceAttrDiff{
+			Old:         os,
+			New:         ns,
+			NewExtra:    originalN,
+			NewRemoved:  removed,
+			NewComputed: computed,
+		},
+		customized,
+	)
 
 	return nil
 }
@@ -1172,9 +1270,9 @@ func (m schemaMap) validateConflictingAttributes(
 	}
 
 	for _, conflicting_key := range schema.ConflictsWith {
-		if value, ok := c.Get(conflicting_key); ok {
+		if _, ok := c.Get(conflicting_key); ok {
 			return fmt.Errorf(
-				"%q: conflicts with %s (%#v)", k, conflicting_key, value)
+				"%q: conflicts with %s", k, conflicting_key)
 		}
 	}
 
@@ -1363,13 +1461,10 @@ func getValueType(k string, schema *Schema) (ValueType, error) {
 		return vt, nil
 	}
 
+	// If a Schema is provided to a Map, we use the Type of that schema
+	// as the type for each element in the Map.
 	if s, ok := schema.Elem.(*Schema); ok {
-		if s.Elem == nil {
-			return TypeString, nil
-		}
-		if vt, ok := s.Elem.(ValueType); ok {
-			return vt, nil
-		}
+		return s.Type, nil
 	}
 
 	if _, ok := schema.Elem.(*Resource); ok {
@@ -1430,7 +1525,6 @@ func (m schemaMap) validatePrimitive(
 	raw interface{},
 	schema *Schema,
 	c *terraform.ResourceConfig) ([]string, []error) {
-
 	// Catch if the user gave a complex type where a primitive was
 	// expected, so we can return a friendly error message that
 	// doesn't contain Go type system terminology.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index de05f40..cba2890 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -17,6 +17,12 @@ func HashString(v interface{}) int {
 	return hashcode.String(v.(string))
 }
 
+// HashInt hashes integers. If you want a Set of integers, this is the
+// SchemaSetFunc you want.
+func HashInt(v interface{}) int {
+	return hashcode.String(strconv.Itoa(v.(int)))
+}
+
 // HashResource hashes complex structures that are described using
 // a *Resource. This is the default set implementation used when a set's
 // element type is a full resource.
@@ -153,6 +159,31 @@ func (s *Set) Equal(raw interface{}) bool {
 	return reflect.DeepEqual(s.m, other.m)
 }
 
+// HashEqual simply checks to the keys the top-level map to the keys in the
+// other set's top-level map to see if they are equal. This obviously assumes
+// you have a properly working hash function - use HashResource if in doubt.
+func (s *Set) HashEqual(raw interface{}) bool {
+	other, ok := raw.(*Set)
+	if !ok {
+		return false
+	}
+
+	ks1 := make([]string, 0)
+	ks2 := make([]string, 0)
+
+	for k := range s.m {
+		ks1 = append(ks1, k)
+	}
+	for k := range other.m {
+		ks2 = append(ks2, k)
+	}
+
+	sort.Strings(ks1)
+	sort.Strings(ks2)
+
+	return reflect.DeepEqual(ks1, ks2)
+}
+
 func (s *Set) GoString() string {
 	return fmt.Sprintf("*Set(%#v)", s.m)
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index 9765bdb..da754ac 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -10,13 +10,15 @@ import (
 // TestResourceDataRaw creates a ResourceData from a raw configuration map.
 func TestResourceDataRaw(
 	t *testing.T, schema map[string]*Schema, raw map[string]interface{}) *ResourceData {
+	t.Helper()
+
 	c, err := config.NewRawConfig(raw)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
 
 	sm := schemaMap(schema)
-	diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+	diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 1610cec..3bc3ac4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
@@ -10,7 +10,7 @@ var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
 	if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
-		return fmt.Sprintf("ValueType(%d)", i)
+		return "ValueType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
 	return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
deleted file mode 100644
index edc1e2a..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package shadow
-
-import (
-	"fmt"
-	"io"
-	"reflect"
-
-	"github.com/hashicorp/go-multierror"
-	"github.com/mitchellh/reflectwalk"
-)
-
-// Close will close all shadow values within the given structure.
-//
-// This uses reflection to walk the structure, find all shadow elements,
-// and close them. Currently this will only find struct fields that are
-// shadow values, and not slice elements, etc.
-func Close(v interface{}) error {
-	// We require a pointer so we can address the internal fields
-	val := reflect.ValueOf(v)
-	if val.Kind() != reflect.Ptr {
-		return fmt.Errorf("value must be a pointer")
-	}
-
-	// Walk and close
-	var w closeWalker
-	if err := reflectwalk.Walk(v, &w); err != nil {
-		return err
-	}
-
-	return w.Err
-}
-
-type closeWalker struct {
-	Err error
-}
-
-func (w *closeWalker) Struct(reflect.Value) error {
-	// Do nothing. We implement this for reflectwalk.StructWalker
-	return nil
-}
-
-var closerType = reflect.TypeOf((*io.Closer)(nil)).Elem()
-
-func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error {
-	// Not sure why this would be but lets avoid some panics
-	if !v.IsValid() {
-		return nil
-	}
-
-	// Empty for exported, so don't check unexported fields
-	if f.PkgPath != "" {
-		return nil
-	}
-
-	// Verify the io.Closer is in this package
-	typ := v.Type()
-	if typ.PkgPath() != "github.com/hashicorp/terraform/helper/shadow" {
-		return nil
-	}
-
-	var closer io.Closer
-	if v.Type().Implements(closerType) {
-		closer = v.Interface().(io.Closer)
-	} else if v.CanAddr() {
-		// The Close method may require a pointer receiver, but we only have a value.
-		v := v.Addr()
-		if v.Type().Implements(closerType) {
-			closer = v.Interface().(io.Closer)
-		}
-	}
-
-	if closer == nil {
-		return reflectwalk.SkipEntry
-	}
-
-	// Close it
-	if err := closer.Close(); err != nil {
-		w.Err = multierror.Append(w.Err, err)
-	}
-
-	// Don't go into the struct field
-	return reflectwalk.SkipEntry
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
deleted file mode 100644
index 4223e92..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package shadow
-
-import (
-	"sync"
-)
-
-// ComparedValue is a struct that finds a value by comparing some key
-// to the list of stored values. This is useful when there is no easy
-// uniquely identifying key that works in a map (for that, use KeyedValue).
-//
-// ComparedValue is very expensive, relative to other Value types. Try to
-// limit the number of values stored in a ComparedValue by potentially
-// nesting it within a KeyedValue (a keyed value points to a compared value,
-// for example).
-type ComparedValue struct {
-	// Func is a function that is given the lookup key and a single
-	// stored value. If it matches, it returns true.
-	Func func(k, v interface{}) bool
-
-	lock    sync.Mutex
-	once    sync.Once
-	closed  bool
-	values  []interface{}
-	waiters map[interface{}]*Value
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *ComparedValue) Close() error {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// Set closed to true always
-	w.closed = true
-
-	// For all waiters, complete with ErrClosed
-	for k, val := range w.waiters {
-		val.SetValue(ErrClosed)
-		delete(w.waiters, k)
-	}
-
-	return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *ComparedValue) Value(k interface{}) interface{} {
-	v, val := w.valueWaiter(k)
-	if val == nil {
-		return v
-	}
-
-	return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *ComparedValue) ValueOk(k interface{}) (interface{}, bool) {
-	v, val := w.valueWaiter(k)
-	return v, val == nil
-}
-
-func (w *ComparedValue) SetValue(v interface{}) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-	w.once.Do(w.init)
-
-	// Check if we already have this exact value (by simply comparing
-	// with == directly). If we do, then we don't insert it again.
-	found := false
-	for _, v2 := range w.values {
-		if v == v2 {
-			found = true
-			break
-		}
-	}
-
-	if !found {
-		// Set the value, always
-		w.values = append(w.values, v)
-	}
-
-	// Go through the waiters
-	for k, val := range w.waiters {
-		if w.Func(k, v) {
-			val.SetValue(v)
-			delete(w.waiters, k)
-		}
-	}
-}
-
-func (w *ComparedValue) valueWaiter(k interface{}) (interface{}, *Value) {
-	w.lock.Lock()
-	w.once.Do(w.init)
-
-	// Look for a pre-existing value
-	for _, v := range w.values {
-		if w.Func(k, v) {
-			w.lock.Unlock()
-			return v, nil
-		}
-	}
-
-	// If we're closed, return that
-	if w.closed {
-		w.lock.Unlock()
-		return ErrClosed, nil
-	}
-
-	// Pre-existing value doesn't exist, create a waiter
-	val := w.waiters[k]
-	if val == nil {
-		val = new(Value)
-		w.waiters[k] = val
-	}
-	w.lock.Unlock()
-
-	// Return the waiter
-	return nil, val
-}
-
-// Must be called with w.lock held.
-func (w *ComparedValue) init() {
-	w.waiters = make(map[interface{}]*Value)
-	if w.Func == nil {
-		w.Func = func(k, v interface{}) bool { return k == v }
-	}
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
deleted file mode 100644
index 432b036..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package shadow
-
-import (
-	"sync"
-)
-
-// KeyedValue is a struct that coordinates a value by key. If a value is
-// not available for a give key, it'll block until it is available.
-type KeyedValue struct {
-	lock    sync.Mutex
-	once    sync.Once
-	values  map[string]interface{}
-	waiters map[string]*Value
-	closed  bool
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *KeyedValue) Close() error {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// Set closed to true always
-	w.closed = true
-
-	// For all waiters, complete with ErrClosed
-	for k, val := range w.waiters {
-		val.SetValue(ErrClosed)
-		delete(w.waiters, k)
-	}
-
-	return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *KeyedValue) Value(k string) interface{} {
-	w.lock.Lock()
-	v, val := w.valueWaiter(k)
-	w.lock.Unlock()
-
-	// If we have no waiter, then return the value
-	if val == nil {
-		return v
-	}
-
-	// We have a waiter, so wait
-	return val.Value()
-}
-
-// WaitForChange waits for the value with the given key to be set again.
-// If the key isn't set, it'll wait for an initial value. Note that while
-// it is called "WaitForChange", the value isn't guaranteed to _change_;
-// this will return when a SetValue is called for the given k.
-func (w *KeyedValue) WaitForChange(k string) interface{} {
-	w.lock.Lock()
-	w.once.Do(w.init)
-
-	// If we're closed, we're closed
-	if w.closed {
-		w.lock.Unlock()
-		return ErrClosed
-	}
-
-	// Check for an active waiter. If there isn't one, make it
-	val := w.waiters[k]
-	if val == nil {
-		val = new(Value)
-		w.waiters[k] = val
-	}
-	w.lock.Unlock()
-
-	// And wait
-	return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *KeyedValue) ValueOk(k string) (interface{}, bool) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	v, val := w.valueWaiter(k)
-	return v, val == nil
-}
-
-func (w *KeyedValue) SetValue(k string, v interface{}) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-	w.setValue(k, v)
-}
-
-// Init will initialize the key to a given value only if the key has
-// not been set before. This is safe to call multiple times and in parallel.
-func (w *KeyedValue) Init(k string, v interface{}) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// If we have a waiter, set the value.
-	_, val := w.valueWaiter(k)
-	if val != nil {
-		w.setValue(k, v)
-	}
-}
-
-// Must be called with w.lock held.
-func (w *KeyedValue) init() {
-	w.values = make(map[string]interface{})
-	w.waiters = make(map[string]*Value)
-}
-
-// setValue is like SetValue but assumes the lock is held.
-func (w *KeyedValue) setValue(k string, v interface{}) {
-	w.once.Do(w.init)
-
-	// Set the value, always
-	w.values[k] = v
-
-	// If we have a waiter, set it
-	if val, ok := w.waiters[k]; ok {
-		val.SetValue(v)
-		delete(w.waiters, k)
-	}
-}
-
-// valueWaiter gets the value or the Value waiter for a given key.
-//
-// This must be called with lock held.
-func (w *KeyedValue) valueWaiter(k string) (interface{}, *Value) {
-	w.once.Do(w.init)
-
-	// If we have this value already, return it
-	if v, ok := w.values[k]; ok {
-		return v, nil
-	}
-
-	// If we're closed, return that
-	if w.closed {
-		return ErrClosed, nil
-	}
-
-	// No pending value, check for a waiter
-	val := w.waiters[k]
-	if val == nil {
-		val = new(Value)
-		w.waiters[k] = val
-	}
-
-	// Return the waiter
-	return nil, val
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
deleted file mode 100644
index 0a43d4d..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package shadow
-
-import (
-	"container/list"
-	"sync"
-)
-
-// OrderedValue is a struct that keeps track of a value in the order
-// it is set. Each time Value() is called, it will return the most recent
-// calls value then discard it.
-//
-// This is unlike Value that returns the same value once it is set.
-type OrderedValue struct {
-	lock    sync.Mutex
-	values  *list.List
-	waiters *list.List
-}
-
-// Value returns the last value that was set, or blocks until one
-// is received.
-func (w *OrderedValue) Value() interface{} {
-	w.lock.Lock()
-
-	// If we have a pending value already, use it
-	if w.values != nil && w.values.Len() > 0 {
-		front := w.values.Front()
-		w.values.Remove(front)
-		w.lock.Unlock()
-		return front.Value
-	}
-
-	// No pending value, create a waiter
-	if w.waiters == nil {
-		w.waiters = list.New()
-	}
-
-	var val Value
-	w.waiters.PushBack(&val)
-	w.lock.Unlock()
-
-	// Return the value once we have it
-	return val.Value()
-}
-
-// SetValue sets the latest value.
-func (w *OrderedValue) SetValue(v interface{}) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// If we have a waiter, notify it
-	if w.waiters != nil && w.waiters.Len() > 0 {
-		front := w.waiters.Front()
-		w.waiters.Remove(front)
-
-		val := front.Value.(*Value)
-		val.SetValue(v)
-		return
-	}
-
-	// Add it to the list of values
-	if w.values == nil {
-		w.values = list.New()
-	}
-
-	w.values.PushBack(v)
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
deleted file mode 100644
index 178b7e7..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package shadow
-
-import (
-	"errors"
-	"sync"
-)
-
-// ErrClosed is returned by any closed values.
-//
-// A "closed value" is when the shadow has been notified that the real
-// side is complete and any blocking values will _never_ be satisfied
-// in the future. In this case, this error is returned. If a value is already
-// available, that is still returned.
-var ErrClosed = errors.New("shadow closed")
-
-// Value is a struct that coordinates a value between two
-// parallel routines. It is similar to atomic.Value except that when
-// Value is called if it isn't set it will wait for it.
-//
-// The Value can be closed with Close, which will cause any future
-// blocking operations to return immediately with ErrClosed.
-type Value struct {
-	lock     sync.Mutex
-	cond     *sync.Cond
-	value    interface{}
-	valueSet bool
-}
-
-func (v *Value) Lock() {
-	v.lock.Lock()
-}
-
-func (v *Value) Unlock() {
-	v.lock.Unlock()
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the struct docs.
-func (w *Value) Close() error {
-	w.lock.Lock()
-	set := w.valueSet
-	w.lock.Unlock()
-
-	// If we haven't set the value, set it
-	if !set {
-		w.SetValue(ErrClosed)
-	}
-
-	// Done
-	return nil
-}
-
-// Value returns the value that was set.
-func (w *Value) Value() interface{} {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// If we already have a value just return
-	for !w.valueSet {
-		// No value, setup the condition variable if we have to
-		if w.cond == nil {
-			w.cond = sync.NewCond(&w.lock)
-		}
-
-		// Wait on it
-		w.cond.Wait()
-	}
-
-	// Return the value
-	return w.value
-}
-
-// SetValue sets the value.
-func (w *Value) SetValue(v interface{}) {
-	w.lock.Lock()
-	defer w.lock.Unlock()
-
-	// Set the value
-	w.valueSet = true
-	w.value = v
-
-	// If we have a condition, clear it
-	if w.cond != nil {
-		w.cond.Broadcast()
-		w.cond = nil
-	}
-}
-- 
cgit v1.2.3