terraform: destroy ordering needs to handle destroy provisioner edges

This ensures that things aren't destroyed before their values are used.

terraform/context_apply_test.go

@@ -4701,6 +4701,76 @@ module.child:
 	}
 }
 
+func TestContext2Apply_provisionerDestroyRef(t *testing.T) {
+	m := testModule(t, "apply-provisioner-destroy-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["foo"]
+		if !ok || val != "hello" {
+			return fmt.Errorf("bad value for foo: %v %#v", val, c)
+		}
+
+		return nil
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"key": "hello",
+							},
+						},
+					},
+
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module:  m,
+		State:   state,
+		Destroy: true,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `<no state>`)
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
 func TestContext2Apply_provisionerResourceRef(t *testing.T) {
 	m := testModule(t, "apply-provisioner-resource-ref")
 	p := testProvider("aws")

terraform/node_resource_abstract.go

@@ -96,8 +96,10 @@ func (n *NodeAbstractResource) References() []string {
 		result = append(result, ReferencesFromConfig(c.RawCount)...)
 		result = append(result, ReferencesFromConfig(c.RawConfig)...)
 		for _, p := range c.Provisioners {
-			result = append(result, ReferencesFromConfig(p.ConnInfo)...)
+			if p.When == config.ProvisionerWhenCreate {
-			result = append(result, ReferencesFromConfig(p.RawConfig)...)
+				result = append(result, ReferencesFromConfig(p.ConnInfo)...)
+				result = append(result, ReferencesFromConfig(p.RawConfig)...)
+			}
 		}
 
 		return result

terraform/test-fixtures/apply-provisioner-destroy-ref/main.tf

@@ -0,0 +1,12 @@
+resource "aws_instance" "bar" {
+    key = "hello"
+}
+
+resource "aws_instance" "foo" {
+    foo = "bar"
+
+    provisioner "shell" {
+        foo  = "${aws_instance.bar.key}"
+        when = "destroy"
+    }
+}

terraform/transform_destroy_edge.go

@@ -159,9 +159,15 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
 		// This part is a little bit weird but is the best way to
 		// find the dependencies we need to: build a graph and use the
 		// attach config and state transformers then ask for references.
-		node := &NodeAbstractResource{Addr: addr}
+		abstract := &NodeAbstractResource{Addr: addr}
-		tempG.Add(node)
+		tempG.Add(abstract)
-		tempDestroyed = append(tempDestroyed, node)
+		tempDestroyed = append(tempDestroyed, abstract)
+
+		// We also add the destroy version here since the destroy can
+		// depend on things that the creation doesn't (destroy provisioners).
+		destroy := &NodeDestroyResource{NodeAbstractResource: abstract}
+		tempG.Add(destroy)
+		tempDestroyed = append(tempDestroyed, destroy)
 	}
 
 	// Run the graph transforms so we have the information we need to