diff --git a/configs/configupgrade/test-fixtures/valid/provisioner/input/provisioner.tf b/configs/configupgrade/test-fixtures/valid/provisioner/input/provisioner.tf
index 815dd31f4..50b22c466 100644
--- a/configs/configupgrade/test-fixtures/valid/provisioner/input/provisioner.tf
+++ b/configs/configupgrade/test-fixtures/valid/provisioner/input/provisioner.tf
@@ -1,8 +1,18 @@
 resource "test_instance" "foo" {
+  connection {
+    type = "ssh"
+    host = "${self.private_ip}"
+  }
+
   provisioner "test" {
     commands = "${list("a", "b", "c")}"
 
     when       = "create"
     on_failure = "fail"
+
+    connection {
+      type = "winrm"
+      host = "${self.public_ip}"
+    }
   }
 }
diff --git a/configs/configupgrade/test-fixtures/valid/provisioner/want/provisioner.tf b/configs/configupgrade/test-fixtures/valid/provisioner/want/provisioner.tf
index 55fbbfbe8..34361c927 100644
--- a/configs/configupgrade/test-fixtures/valid/provisioner/want/provisioner.tf
+++ b/configs/configupgrade/test-fixtures/valid/provisioner/want/provisioner.tf
@@ -1,8 +1,18 @@
 resource "test_instance" "foo" {
+  connection {
+    type = "ssh"
+    host = self.private_ip
+  }
+
   provisioner "test" {
     commands = ["a", "b", "c"]
 
     when       = create
     on_failure = fail
+
+    connection {
+      type = "winrm"
+      host = self.public_ip
+    }
   }
 }
diff --git a/configs/configupgrade/upgrade_body.go b/configs/configupgrade/upgrade_body.go
index 5baa2108d..954528308 100644
--- a/configs/configupgrade/upgrade_body.go
+++ b/configs/configupgrade/upgrade_body.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 
 	hcl1ast "github.com/hashicorp/hcl/hcl/ast"
-	hcl1printer "github.com/hashicorp/hcl/hcl/printer"
 	hcl1token "github.com/hashicorp/hcl/hcl/token"
 	hcl2 "github.com/hashicorp/hcl2/hcl"
 	hcl2syntax "github.com/hashicorp/hcl2/hcl/hclsyntax"
 	"github.com/zclconf/go-cty/cty"
 
 	"github.com/hashicorp/terraform/configs/configschema"
+	"github.com/hashicorp/terraform/terraform"
 	"github.com/hashicorp/terraform/tfdiags"
 )
 
@@ -611,13 +611,25 @@ func connectionBlockRule(filename string, an *analysis, adhocComments *commentQu
 	// connection block, rather than just for its contents. Therefore it must
 	// also produce the block header and body delimiters.
 	return func(buf *bytes.Buffer, blockAddr string, item *hcl1ast.ObjectItem) tfdiags.Diagnostics {
+		var diags tfdiags.Diagnostics
+		body := item.Val.(*hcl1ast.ObjectType)
+
 		// TODO: For the few resource types that were setting ConnInfo in
 		// state after create/update in prior versions, generate the additional
 		// explicit connection settings that are now required if and only if
 		// there's at least one provisioner block.
 		// For now, we just pass this through as-is.
-		hcl1printer.Fprint(buf, item)
-		buf.WriteByte('\n')
-		return nil
+
+		schema := terraform.ConnectionBlockSupersetSchema()
+		rules := schemaDefaultBodyRules(filename, schema, an, adhocComments)
+		rules["type"] = noInterpAttributeRule(filename, cty.String, an) // type is processed early in the config loader, so cannot interpolate
+
+		printComments(buf, item.LeadComment)
+		printBlockOpen(buf, "connection", nil, item.LineComment)
+		bodyDiags := upgradeBlockBody(filename, fmt.Sprintf("%s.connection", blockAddr), buf, body.List.Items, body.Rbrace, rules, adhocComments)
+		diags = diags.Append(bodyDiags)
+		buf.WriteString("}\n")
+
+		return diags
 	}
 }
diff --git a/terraform/eval_validate.go b/terraform/eval_validate.go
index 5fe28b39a..a7e625612 100644
--- a/terraform/eval_validate.go
+++ b/terraform/eval_validate.go
@@ -313,6 +313,18 @@ var connectionBlockSupersetSchema = &configschema.Block{
 	},
 }
 
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. It's exported only for use in the
+// configs/configupgrade package and should not be used from anywhere else.
+// The caller may not modify any part of the returned schema data structure.
+func ConnectionBlockSupersetSchema() *configschema.Block {
+	return connectionBlockSupersetSchema
+}
+
 // EvalValidateResource is an EvalNode implementation that validates
 // the configuration of a resource.
 type EvalValidateResource struct {