Support using self in the provisioner of resources that use for_each

terraform/eval_validate.go

@@ -117,6 +117,7 @@ type EvalValidateProvisioner struct {
 	Schema             **configschema.Block
 	Config             *configs.Provisioner
 	ResourceHasCount   bool
+	ResourceHasForEach bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -198,6 +199,19 @@ func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body,
 		// expected type since none of these elements are known at this
 		// point anyway.
 		selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
+	} else if n.ResourceHasForEach {
+		// For a resource that has for_each, we allow each.value and each.key
+		// but don't know at this stage what it will return.
+		keyData = InstanceKeyEvalData{
+			EachKey:   cty.UnknownVal(cty.String),
+			EachValue: cty.DynamicVal,
+		}
+
+		// "self" can't point to an unknown key, but we'll force it to be
+		// key "" here, which should return an unknown value of the
+		// expected type since none of these elements are known at
+		// this point anyway.
+		selfAddr = n.ResourceAddr.Instance(addrs.StringKey(""))
 	}
 
 	return ctx.EvaluateBlock(body, schema, selfAddr, keyData)

terraform/node_resource_validate.go

@@ -54,6 +54,7 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
 
 	if managed := n.Config.Managed; managed != nil {
 		hasCount := n.Config.Count != nil
+		hasForEach := n.Config.ForEach != nil
 
 		// Validate all the provisioners
 		for _, p := range managed.Provisioners {
@@ -79,6 +80,7 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
 					Schema:             &provisionerSchema,
 					Config:             p,
 					ResourceHasCount:   hasCount,
+					ResourceHasForEach: hasForEach,
 				},
 			)
 		}