diff --git a/config.go b/config.go
index dc843a9c6..d0df909a9 100644
--- a/config.go
+++ b/config.go
@@ -74,6 +74,14 @@ func LoadConfig(path string) (*Config, error) {
 		return nil, err
 	}
 
+	// Replace all env vars
+	for k, v := range result.Providers {
+		result.Providers[k] = os.ExpandEnv(v)
+	}
+	for k, v := range result.Provisioners {
+		result.Provisioners[k] = os.ExpandEnv(v)
+	}
+
 	return &result, nil
 }
 
diff --git a/config_test.go b/config_test.go
index de64ea0cf..712504b98 100644
--- a/config_test.go
+++ b/config_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"os"
 	"path/filepath"
 	"reflect"
 	"testing"
@@ -27,6 +28,30 @@ func TestLoadConfig(t *testing.T) {
 	}
 }
 
+func TestLoadConfig_env(t *testing.T) {
+	defer os.Unsetenv("TFTEST")
+	os.Setenv("TFTEST", "hello")
+
+	c, err := LoadConfig(filepath.Join(fixtureDir, "config-env"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := &Config{
+		Providers: map[string]string{
+			"aws":    "hello",
+			"google": "bar",
+		},
+		Provisioners: map[string]string{
+			"local": "hello",
+		},
+	}
+
+	if !reflect.DeepEqual(c, expected) {
+		t.Fatalf("bad: %#v", c)
+	}
+}
+
 func TestConfig_Merge(t *testing.T) {
 	c1 := &Config{
 		Providers: map[string]string{
diff --git a/test-fixtures/config-env b/test-fixtures/config-env
new file mode 100644
index 000000000..e127b138d
--- /dev/null
+++ b/test-fixtures/config-env
@@ -0,0 +1,8 @@
+providers {
+  aws = "$TFTEST"
+  google = "bar"
+}
+
+provisioners {
+  local = "$TFTEST"
+}