Tidy eval_diff assignments and update plan action

When the sensitivity has changed, we want to write to
state and also display to the user that the sensitivity
has changed, so make this an update action. Also
clean up some assignments, since Contains traverses the val
anyway, this is a little tighter.

terraform/eval_diff.go

@@ -212,23 +212,11 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
 		return nil, diags.Err()
 	}
 
-	// Create an unmarked version of our config val, defaulting
+	// Create an unmarked version of our config val and our prior val.
-	// to the configVal so we don't do the work of unmarking unless
+	// Store the paths for the config val to re-markafter
-	// necessary
+	// we've sent things over the wire.
-	unmarkedConfigVal := configValIgnored
+	unmarkedConfigVal, unmarkedPaths := configValIgnored.UnmarkDeepWithPaths()
-	var unmarkedPaths []cty.PathValueMarks
+	unmarkedPriorVal, priorPaths := priorVal.UnmarkDeep()
-	if configValIgnored.ContainsMarked() {
-		// store the marked values so we can re-mark them later after
-		// we've sent things over the wire.
-		unmarkedConfigVal, unmarkedPaths = configValIgnored.UnmarkDeepWithPaths()
-	}
-
-	unmarkedPriorVal := priorVal
-	if priorVal.ContainsMarked() {
-		// store the marked values so we can re-mark them later after
-		// we've sent things over the wire.
-		unmarkedPriorVal, _ = priorVal.UnmarkDeep()
-	}
 
 	proposedNewVal := objchange.ProposedNewObject(schema, unmarkedPriorVal, unmarkedConfigVal)
 
@@ -395,8 +383,7 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
 		}
 	}
 
-	// Unmark for this test for equality. If only sensitivity has changed,
+	// Unmark for this test for value equality.
-	// this does not require an Update or Replace
 	eqV := unmarkedPlannedNewVal.Equals(unmarkedPriorVal)
 	eq := eqV.IsKnown() && eqV.True()
 
@@ -406,6 +393,11 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
 		action = plans.Create
 	case eq:
 		action = plans.NoOp
+		// If we plan to write or delete sensitive paths from state,
+		// this is an Update action
+		if len(priorPaths) != len(unmarkedPaths) {
+			action = plans.Update
+		}
 	case !reqRep.Empty():
 		// If there are any "requires replace" paths left _after our filtering
 		// above_ then this is a replace action.