diff --git a/terraform/context_apply_test.go b/terraform/context_apply_test.go
index cab3e986f..382664688 100644
--- a/terraform/context_apply_test.go
+++ b/terraform/context_apply_test.go
@@ -4639,6 +4639,193 @@ aws_instance.foo:
 	}
 }
 
+func TestContext2Apply_provisionerDestroyModule(t *testing.T) {
+	m := testModule(t, "apply-provisioner-destroy-module")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["foo"]
+		if !ok || val != "value" {
+			t.Fatalf("bad value for foo: %v %#v", val, c)
+		}
+
+		return nil
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module:  m,
+		State:   state,
+		Destroy: true,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+module.child:
+  <no state>`)
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+func TestContext2Apply_provisionerDestroyRef(t *testing.T) {
+	m := testModule(t, "apply-provisioner-destroy-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["foo"]
+		if !ok || val != "hello" {
+			return fmt.Errorf("bad value for foo: %v %#v", val, c)
+		}
+
+		return nil
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"key": "hello",
+							},
+						},
+					},
+
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module:  m,
+		State:   state,
+		Destroy: true,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `<no state>`)
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+// Test that a destroy provisioner referencing an invalid key errors.
+func TestContext2Apply_provisionerDestroyRefInvalid(t *testing.T) {
+	m := testModule(t, "apply-provisioner-destroy-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		return nil
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module:  m,
+		State:   state,
+		Destroy: true,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
 func TestContext2Apply_provisionerResourceRef(t *testing.T) {
 	m := testModule(t, "apply-provisioner-resource-ref")
 	p := testProvider("aws")
diff --git a/terraform/interpolate.go b/terraform/interpolate.go
index 4cbfab78e..a59af6e83 100644
--- a/terraform/interpolate.go
+++ b/terraform/interpolate.go
@@ -498,7 +498,7 @@ MISSING:
 	//
 	// For an input walk, computed values are okay to return because we're only
 	// looking for missing variables to prompt the user for.
-	if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy || i.Operation == walkInput {
+	if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkInput {
 		return &unknownVariable, nil
 	}
 
diff --git a/terraform/node_resource_abstract.go b/terraform/node_resource_abstract.go
index c9e9ab03a..e4577e9db 100644
--- a/terraform/node_resource_abstract.go
+++ b/terraform/node_resource_abstract.go
@@ -96,8 +96,10 @@ func (n *NodeAbstractResource) References() []string {
 		result = append(result, ReferencesFromConfig(c.RawCount)...)
 		result = append(result, ReferencesFromConfig(c.RawConfig)...)
 		for _, p := range c.Provisioners {
-			result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-			result = append(result, ReferencesFromConfig(p.RawConfig)...)
+			if p.When == config.ProvisionerWhenCreate {
+				result = append(result, ReferencesFromConfig(p.ConnInfo)...)
+				result = append(result, ReferencesFromConfig(p.RawConfig)...)
+			}
 		}
 
 		return result
diff --git a/terraform/node_resource_destroy.go b/terraform/node_resource_destroy.go
index 9a0bc8c2d..c2efd2c38 100644
--- a/terraform/node_resource_destroy.go
+++ b/terraform/node_resource_destroy.go
@@ -68,6 +68,21 @@ func (n *NodeDestroyResource) ReferenceableName() []string {
 
 // GraphNodeReferencer, overriding NodeAbstractResource
 func (n *NodeDestroyResource) References() []string {
+	// If we have a config, then we need to include destroy-time dependencies
+	if c := n.Config; c != nil {
+		var result []string
+		for _, p := range c.Provisioners {
+			// We include conn info and config for destroy time provisioners
+			// as dependencies that we have.
+			if p.When == config.ProvisionerWhenDestroy {
+				result = append(result, ReferencesFromConfig(p.ConnInfo)...)
+				result = append(result, ReferencesFromConfig(p.RawConfig)...)
+			}
+		}
+
+		return result
+	}
+
 	return nil
 }
 
diff --git a/terraform/test-fixtures/apply-provisioner-destroy-module/child/main.tf b/terraform/test-fixtures/apply-provisioner-destroy-module/child/main.tf
new file mode 100644
index 000000000..f91f2b261
--- /dev/null
+++ b/terraform/test-fixtures/apply-provisioner-destroy-module/child/main.tf
@@ -0,0 +1,10 @@
+variable "key" {}
+
+resource "aws_instance" "foo" {
+    foo = "bar"
+
+    provisioner "shell" {
+        foo  = "${var.key}"
+        when = "destroy"
+    }
+}
diff --git a/terraform/test-fixtures/apply-provisioner-destroy-module/main.tf b/terraform/test-fixtures/apply-provisioner-destroy-module/main.tf
new file mode 100644
index 000000000..817ae043d
--- /dev/null
+++ b/terraform/test-fixtures/apply-provisioner-destroy-module/main.tf
@@ -0,0 +1,4 @@
+module "child" {
+    source = "./child"
+    key    = "value"
+}
diff --git a/terraform/test-fixtures/apply-provisioner-destroy-ref/main.tf b/terraform/test-fixtures/apply-provisioner-destroy-ref/main.tf
new file mode 100644
index 000000000..01561a516
--- /dev/null
+++ b/terraform/test-fixtures/apply-provisioner-destroy-ref/main.tf
@@ -0,0 +1,12 @@
+resource "aws_instance" "bar" {
+    key = "hello"
+}
+
+resource "aws_instance" "foo" {
+    foo = "bar"
+
+    provisioner "shell" {
+        foo  = "${aws_instance.bar.key}"
+        when = "destroy"
+    }
+}
diff --git a/terraform/transform_destroy_edge.go b/terraform/transform_destroy_edge.go
index c837cf172..22be1ab62 100644
--- a/terraform/transform_destroy_edge.go
+++ b/terraform/transform_destroy_edge.go
@@ -159,9 +159,15 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
 		// This part is a little bit weird but is the best way to
 		// find the dependencies we need to: build a graph and use the
 		// attach config and state transformers then ask for references.
-		node := &NodeAbstractResource{Addr: addr}
-		tempG.Add(node)
-		tempDestroyed = append(tempDestroyed, node)
+		abstract := &NodeAbstractResource{Addr: addr}
+		tempG.Add(abstract)
+		tempDestroyed = append(tempDestroyed, abstract)
+
+		// We also add the destroy version here since the destroy can
+		// depend on things that the creation doesn't (destroy provisioners).
+		destroy := &NodeDestroyResource{NodeAbstractResource: abstract}
+		tempG.Add(destroy)
+		tempDestroyed = append(tempDestroyed, destroy)
 	}
 
 	// Run the graph transforms so we have the information we need to