diff --git a/builtin/providers/aws/resource_aws_glacier_vault.go b/builtin/providers/aws/resource_aws_glacier_vault.go
index 0ae09b61b..64ac267e8 100644
--- a/builtin/providers/aws/resource_aws_glacier_vault.go
+++ b/builtin/providers/aws/resource_aws_glacier_vault.go
@@ -6,6 +6,7 @@ import (
 	"log"
 	"regexp"
 
+	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform/helper/schema"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -33,7 +34,7 @@ func resourceAwsGlacierVault() *schema.Resource {
 					value := v.(string)
 					if !regexp.MustCompile(`^[.0-9A-Za-z-_]+$`).MatchString(value) {
 						errors = append(errors, fmt.Errorf(
-							"only alphanumeric characters, hyphens, underscores, and periods allowed in %q", k))
+							"only alphanumeric characters, hyphens, underscores, and periods are allowed in %q", k))
 					}
 					if len(value) > 255 {
 						errors = append(errors, fmt.Errorf(
@@ -163,7 +164,10 @@ func resourceAwsGlacierVaultRead(d *schema.ResourceData, meta interface{}) error
 	if awserr, ok := err.(awserr.Error); ok && awserr.Code() == "ResourceNotFoundException" {
 		d.Set("access_policy", "")
 	} else if pol != nil {
-		policy, _ := normalizeJsonString(*pol.Policy.Policy)
+		policy, err := normalizeJsonString(*pol.Policy.Policy)
+		if err != nil {
+			return errwrap.Wrapf("access policy contains an invalid JSON: {{err}}", err)
+		}
 		d.Set("access_policy", policy)
 	} else {
 		return err