diff --git a/CHANGELOG.md b/CHANGELOG.md
index e67f5ca65..932980236 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,20 +1,266 @@
-## 0.5.1 (unreleased)
+## 0.6.1 (Unreleased)
+
+FEATURES:
+
+  * **New resource: `google_container_cluster`** [GH-2357]
+  * **New resource: `aws_vpc_endpoint`** [GH-2695]
+
+BUG FIXES:
+
+  * core: don't prompt for variables with defaults [GH-2613]
+  * core: Return correct number of planned updates [GH-2620]
+  * core: Fix "provider not found" error that can occur while running
+      a destroy plan with grandchildren modules [GH-2755]
+  * connection/ssh: fix issue on machines with an SSH Agent available
+    preventing `key_file` from being read without explicitly
+    setting `agent = false` [GH-2615]
+  * provider/aws: Allow uppercase characters in `aws_elb.name` [GH-2580]
+  * provider/aws: Allow underscores in `aws_db_subnet_group.name` (undocumented by AWS) [GH-2604]
+  * provider/aws: Allow dots in `aws_db_subnet_group.name` (undocumented by AWS) [GH-2665]
+  * provider/aws: Fix issue with pending Spot Instance requests [GH-2640]
+  * provider/aws: Fix issue in AWS Classic environment with referencing external
+      Security Groups [GH-2644]
+  * provider/aws: Bump internet gateway detach timeout [GH-2669]
+  * provider/aws: `ecs_cluster` rename (recreation) and deletion is handled correctly [GH-2698]
+  * provider/aws: `aws_route_table` ignores routes generated for VPC endpoints [GH-2695]
+  * provider/aws: Fix issue with Launch Configurations and enable_monitoring [GH-2735]
+  * provider/openstack: allow empty api_key and endpoint_type [GH-2626]
 
 IMPROVEMENTS:
 
+  * connection/ssh: Print SSH bastion host details to output [GH-2684]
+  * provider/aws: Create RDS databases from snapshots [GH-2062]
+  * provider/aws: Add support for restoring from Redis backup stored in S3 [GH-2634]
+  * provider/aws: Add `maintenance_window` to ElastiCache cluster [GH-2642]
+  * provider/aws: Availability Zones are optional when specifying VPC Zone Identifiers in
+      Auto Scaling Groups updates [GH-2724]
+  * provider/google: Add metadata_startup_script to google_compute_instance [GH-2375]
+
+## 0.6.0 (June 30, 2015)
+
+BACKWARDS INCOMPATIBILITIES:
+
+ * command/push: If a variable is already set within Atlas, it won't be
+     updated unless the `-overwrite` flag is present [GH-2373]
+ * connection/ssh: The `agent` field now defaults to `true` if
+     the `SSH_AGENT_SOCK` environment variable is present. In other words,
+     `ssh-agent` support is now opt-out instead of opt-in functionality. [GH-2408]
+ * provider/aws: If you were setting access and secret key to blank ("")
+     to force Terraform to load credentials from another source such as the
+     EC2 role, this will now error. Remove the blank lines and Terraform
+     will load from other sources.
+ * `concat()` has been repurposed to combine lists instead of strings (old behavior
+     of joining strings is maintained in this version but is deprecated, strings
+     should be combined using interpolation syntax, like "${var.foo}{var.bar}")
+     [GH-1790]
+
+FEATURES:
+
+  * **New provider: `azure`** [GH-2052, GH-2053, GH-2372, GH-2380, GH-2394, GH-2515, GH-2530, GH-2562]
+  * **New resource: `aws_autoscaling_notification`** [GH-2197]
+  * **New resource: `aws_autoscaling_policy`** [GH-2201]
+  * **New resource: `aws_cloudwatch_metric_alarm`** [GH-2201]
+  * **New resource: `aws_dynamodb_table`** [GH-2121]
+  * **New resource: `aws_ecs_cluster`** [GH-1803]
+  * **New resource: `aws_ecs_service`** [GH-1803]
+  * **New resource: `aws_ecs_task_definition`** [GH-1803, GH-2402]
+  * **New resource: `aws_elasticache_parameter_group`** [GH-2276]
+  * **New resource: `aws_flow_log`** [GH-2384]
+  * **New resource: `aws_iam_group_association`** [GH-2273]
+  * **New resource: `aws_iam_policy_attachment`** [GH-2395]
+  * **New resource: `aws_lambda_function`** [GH-2170]
+  * **New resource: `aws_route53_delegation_set`** [GH-1999]
+  * **New resource: `aws_route53_health_check`** [GH-2226]
+  * **New resource: `aws_spot_instance_request`** [GH-2263]
+  * **New resource: `cloudstack_ssh_keypair`** [GH-2004]
+  * **New remote state backend: `swift`**: You can now store remote state in
+     a OpenStack Swift. [GH-2254]
+  * command/output: support display of module outputs [GH-2102]
+  * core: `keys()` and `values()` funcs for map variables [GH-2198]
+  * connection/ssh: SSH bastion host support and ssh-agent forwarding [GH-2425]
+
+IMPROVEMENTS:
+
+  * core: HTTP remote state now accepts `skip_cert_verification`
+      option to ignore TLS cert verification. [GH-2214]
+  * core: S3 remote state now accepts the 'encrypt' option for SSE [GH-2405]
+  * core: `plan` now reports sum of resources to be changed/created/destroyed [GH-2458]
+  * core: Change string list representation so we can distinguish empty, single
+      element lists [GH-2504]
+  * core: Properly close provider and provisioner plugin connections [GH-2406, GH-2527]
+  * provider/aws: AutoScaling groups now support updating Load Balancers without
+      recreation [GH-2472]
+  * provider/aws: Allow more in-place updates for ElastiCache cluster without recreating
+      [GH-2469]
+  * provider/aws: ElastiCache Subnet Groups can be updated
+      without destroying first [GH-2191]
+  * provider/aws: Normalize `certificate_chain` in `aws_iam_server_certificate` to
+      prevent unnecessary replacement. [GH-2411]
+  * provider/aws: `aws_instance` supports `monitoring' [GH-2489]
+  * provider/aws: `aws_launch_configuration` now supports `enable_monitoring` [GH-2410]
+  * provider/aws: Show outputs after `terraform refresh` [GH-2347]
+  * provider/aws: Add backoff/throttling during DynamoDB creation [GH-2462]
+  * provider/aws: Add validation for aws_vpc.cidr_block [GH-2514]
+  * provider/aws: Add validation for aws_db_subnet_group.name [GH-2513]
+  * provider/aws: Add validation for aws_db_instance.identifier [GH-2516]
+  * provider/aws: Add validation for aws_elb.name [GH-2517]
+  * provider/aws: Add validation for aws_security_group (name+description) [GH-2518]
+  * provider/aws: Add validation for aws_launch_configuration [GH-2519]
+  * provider/aws: Add validation for aws_autoscaling_group.name [GH-2520]
+  * provider/aws: Add validation for aws_iam_role.name [GH-2521]
+  * provider/aws: Add validation for aws_iam_role_policy.name [GH-2552]
+  * provider/aws: Add validation for aws_iam_instance_profile.name [GH-2553]
+  * provider/aws: aws_auto_scaling_group.default_cooldown no longer requires
+      resource replacement [GH-2510]
+  * provider/aws: add AH and ESP protocol integers [GH-2321]
+  * provider/docker: `docker_container` has the `privileged`
+      option. [GH-2227]
+  * provider/openstack: allow `OS_AUTH_TOKEN` environment variable
+      to set the openstack `api_key` field [GH-2234]
+  * provider/openstack: Can now configure endpoint type (public, admin,
+      internal) [GH-2262]
+  * provider/cloudstack: `cloudstack_instance` now supports projects [GH-2115]
+  * provisioner/chef: Added a `os_type` to specifically specify the target OS [GH-2483]
+  * provisioner/chef: Added a `ohai_hints` option to upload hint files [GH-2487]
+
+BUG FIXES:
+
+  * core: lifecycle `prevent_destroy` can be any value that can be
+      coerced into a bool [GH-2268]
+  * core: matching provider types in sibling modules won't override
+      each other's config. [GH-2464]
+  * core: computed provider configurations now properly validate [GH-2457]
+  * core: orphan (commented out) resource dependencies are destroyed in
+      the correct order [GH-2453]
+  * core: validate object types in plugins are actually objects [GH-2450]
+  * core: fix `-no-color` flag in subcommands [GH-2414]
+  * core: Fix error of 'attribute not found for variable' when a computed
+      resource attribute is used as a parameter to a module [GH-2477]
+  * core: moduled orphans will properly inherit provider configs [GH-2476]
+  * core: modules with provider aliases work properly if the parent
+      doesn't implement those aliases [GH-2475]
+  * core: unknown resource attributes passed in as parameters to modules
+      now error [GH-2478]
+  * core: better error messages for missing variables [GH-2479]
+  * core: removed set items now properly appear in diffs and applies [GH-2507]
+  * core: '*' will not be added as part of the variable name when you
+      attempt multiplication without a space [GH-2505]
+  * core: fix target dependency calculation across module boundaries [GH-2555]
+  * command/*: fixed bug where variable input was not asked for unset
+      vars if terraform.tfvars existed [GH-2502]
+  * command/apply: prevent output duplication when reporting errors [GH-2267]
+  * command/apply: destroyed orphan resources are properly counted [GH-2506]
+  * provider/aws: loading credentials from the environment (vars, EC2 role,
+      etc.) is more robust and will not ask for credentials from stdin [GH-1841]
+  * provider/aws: fix panic when route has no `cidr_block` [GH-2215]
+  * provider/aws: fix issue preventing destruction of IAM Roles [GH-2177]
+  * provider/aws: fix issue where Security Group Rules could collide and fail
+      to save to the state file correctly [GH-2376]
+  * provider/aws: fix issue preventing destruction self referencing Securtity
+     Group Rules [GH-2305]
+  * provider/aws: fix issue causing perpetual diff on ELB listeners
+      when non-lowercase protocol strings were used [GH-2246]
+  * provider/aws: corrected frankfurt S3 website region [GH-2259]
+  * provider/aws: `aws_elasticache_cluster` port is required [GH-2160]
+  * provider/aws: Handle AMIs where RootBlockDevice does not appear in the
+      BlockDeviceMapping, preventing root_block_device from working [GH-2271]
+  * provider/aws: fix `terraform show` with remote state [GH-2371]
+  * provider/aws: detect `instance_type` drift on `aws_instance` [GH-2374]
+  * provider/aws: fix crash when `security_group_rule` referenced non-existent
+      security group [GH-2434]
+  * provider/aws: `aws_launch_configuration` retries if IAM instance
+      profile is not ready yet. [GH-2452]
+  * provider/aws: `fqdn` is populated during creation for `aws_route53_record` [GH-2528]
+  * provider/aws: retry VPC delete on DependencyViolation due to eventual
+      consistency [GH-2532]
+  * provider/aws: VPC peering connections in "failed" state are deleted [GH-2544]
+  * provider/aws: EIP deletion works if it was manually disassociated [GH-2543]
+  * provider/aws: `elasticache_subnet_group.subnet_ids` is now a required argument [GH-2534]
+  * provider/aws: handle nil response from VPN connection describes [GH-2533]
+  * provider/cloudflare: manual record deletion doesn't cause error [GH-2545]
+  * provider/digitalocean: handle case where droplet is deleted outside of
+      terraform [GH-2497]
+  * provider/dme: No longer an error if record deleted manually [GH-2546]
+  * provider/docker: Fix issues when using containers with links [GH-2327]
+  * provider/openstack: fix panic case if API returns nil network [GH-2448]
+  * provider/template: fix issue causing "unknown variable" rendering errors
+      when an existing set of template variables is changed [GH-2386]
+  * provisioner/chef: improve the decoding logic to prevent parameter not found errors [GH-2206]
+
+## 0.5.3 (June 1, 2015)
+
+IMPROVEMENTS:
+
+  * **New resource: `aws_kinesis_stream`** [GH-2110]
+  * **New resource: `aws_iam_server_certificate`** [GH-2086]
+  * **New resource: `aws_sqs_queue`** [GH-1939]
+  * **New resource: `aws_sns_topic`** [GH-1974]
+  * **New resource: `aws_sns_topic_subscription`** [GH-1974]
+  * **New resource: `aws_volume_attachment`** [GH-2050]
+  * **New resource: `google_storage_bucket`** [GH-2060]
+  * provider/aws: support ec2 termination protection [GH-1988]
+  * provider/aws: support for RDS Read Replicas [GH-1946]
+  * provider/aws: `aws_s3_bucket` add support for `policy` [GH-1992]
+  * provider/aws: `aws_ebs_volume` add support for `tags` [GH-2135]
+  * provider/aws: `aws_elasticache_cluster` Confirm node status before reporting
+      available
+  * provider/aws: `aws_network_acl` Add support for ICMP Protocol [GH-2148]
+  * provider/aws: New `force_destroy` parameter for S3 buckets, to destroy
+      Buckets that contain objects [GH-2007]
+  * provider/aws: switching `health_check_type` on ASGs no longer requires
+      resource refresh [GH-2147]
+  * provider/aws: ignore empty `vpc_security_group_ids` on `aws_instance` [GH-2311]
+
+BUG FIXES:
+
+  * provider/aws: Correctly handle AWS keypairs which no longer exist [GH-2032]
+  * provider/aws: Fix issue with restoring an Instance from snapshot ID [GH-2120]
+  * provider/template: store relative path in the state [GH-2038]
+  * provisioner/chef: fix interpolation in the Chef provisioner [GH-2168]
+  * provisioner/remote-exec: Don't prepend shebang on scripts that already
+      have one [GH-2041]
+
+## 0.5.2 (May 15, 2015)
+
+FEATURES:
+
+  * **Chef provisioning**: You can now provision new hosts (both Linux and
+     Windows) with [Chef](https://chef.io) using a native provisioner [GH-1868]
+
+IMPROVEMENTS:
+
+  * **New config function: `formatlist`** - Format lists in a similar way to `format`.
+    Useful for creating URLs from a list of IPs. [GH-1829]
+  * **New resource: `aws_route53_zone_association`**
+  * provider/aws: `aws_autoscaling_group` can wait for capacity in ELB
+      via `min_elb_capacity` [GH-1970]
+  * provider/aws: `aws_db_instances` supports `license_model` [GH-1966]
+  * provider/aws: `aws_elasticache_cluster` add support for Tags [GH-1965]
+  * provider/aws: `aws_network_acl` Network ACLs can be applied to multiple subnets [GH-1931]
   * provider/aws: `aws_s3_bucket` exports `hosted_zone_id` and `region` [GH-1865]
+  * provider/aws: `aws_s3_bucket` add support for website `redirect_all_requests_to` [GH-1909]
   * provider/aws: `aws_route53_record` exports `fqdn` [GH-1847]
+  * provider/aws: `aws_route53_zone` can create private hosted zones [GH-1526]
   * provider/google: `google_compute_instance` `scratch` attribute added [GH-1920]
 
 BUG FIXES:
 
   * core: fix "resource not found" for interpolation issues with modules
   * core: fix unflattenable error for orphans [GH-1922]
+  * core: fix deadlock with create-before-destroy + modules [GH-1949]
+  * core: fix "no roots found" error with create-before-destroy [GH-1953]
+  * core: variables set with environment variables won't validate as
+      not set without a default [GH-1930]
+  * core: resources with a blank ID in the state are now assumed to not exist [GH-1905]
   * command/push: local vars override remote ones [GH-1881]
   * provider/aws: Mark `aws_security_group` description as `ForceNew` [GH-1871]
   * provider/aws: `aws_db_instance` ARN value is correct [GH-1910]
   * provider/aws: `aws_db_instance` only submit modify request if there
       is a change. [GH-1906]
+  * provider/aws: `aws_elasticache_cluster` export missing information on cluster nodes [GH-1965]
+  * provider/aws: bad AMI on a launch configuration won't block refresh [GH-1901]
+  * provider/aws: `aws_security_group` + `aws_subnet` - destroy timeout increased
+    to prevent DependencyViolation errors. [GH-1886]
   * provider/google: `google_compute_instance` Local SSDs no-longer cause crash
       [GH-1088]
   * provider/google: `google_http_health_check` Defaults now driven from Terraform,
@@ -23,6 +269,10 @@ BUG FIXES:
       definition to match changes to Instance [GH-980]
   * provider/template: Fix infinite diff [GH-1898]
 
+## 0.5.1 (never released)
+
+This version was never released since we accidentally skipped it!
+
 ## 0.5.0 (May 7, 2015)
 
 BACKWARDS INCOMPATIBILITIES:
@@ -77,7 +327,7 @@ IMPROVEMENTS:
   * **New resource: `google_dns_record_set`**
   * **Migrate to upstream AWS SDK:** Migrate the AWS provider to
       [awslabs/aws-sdk-go](https://github.com/awslabs/aws-sdk-go),
-      the offical `awslabs` library. Previously we had forked the library for
+      the official `awslabs` library. Previously we had forked the library for
       stability while `awslabs` refactored. Now that work has completed, and we've
       migrated back to the upstream version.
   * core: Improve error message on diff mismatch [GH-1501]
@@ -105,7 +355,7 @@ IMPROVEMENTS:
   * provider/aws: `aws_network_acl` improved validation for network ACL ports
       and protocols [GH-1798] [GH-1808]
   * provider/aws: `aws_route_table` can target network interfaces [GH-968]
-  * provider/aws: `aws_route_table` can specify propogating VGWs [GH-1516]
+  * provider/aws: `aws_route_table` can specify propagating VGWs [GH-1516]
   * provider/aws: `aws_route53_record` supports weighted sets [GH-1578]
   * provider/aws: `aws_route53_zone` exports nameservers [GH-1525]
   * provider/aws: `aws_s3_bucket` website support [GH-1738]
@@ -262,7 +512,7 @@ FEATURES:
   * **Math operations** in interpolations. You can now do things like
       `${count.index+1}`. [GH-1068]
   * **New AWS SDK:** Move to `aws-sdk-go` (hashicorp/aws-sdk-go),
-      a fork of the offical `awslabs` repo. We forked for stability while
+      a fork of the official `awslabs` repo. We forked for stability while
       `awslabs` refactored the library, and will move back to the officially
       supported version in the next release.
 
@@ -291,7 +541,7 @@ IMPROVEMENTS:
   * providers/aws: Improve dependency violation error handling, when deleting
       Internet Gateways or Auto Scaling groups [GH-1325].
   * provider/aws: Add non-destructive updates to AWS RDS. You can now upgrade
-      `egine_version`, `parameter_group_name`, and `multi_az` without forcing
+      `engine_version`, `parameter_group_name`, and `multi_az` without forcing
       a new database to be created.[GH-1341]
   * providers/aws: Full support for block device mappings on instances and
       launch configurations [GH-1045, GH-1364]
@@ -797,5 +1047,3 @@ BUG FIXES:
 ## 0.1.0 (July 28, 2014)
 
   * Initial release
-
-
diff --git a/Makefile b/Makefile
index 21a54a8f8..e2725dbd3 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,10 @@ dev: generate
 quickdev: generate
 	@TF_QUICKDEV=1 TF_DEV=1 sh -c "'$(CURDIR)/scripts/build.sh'"
 
+release: updatedeps
+	gox -build-toolchain
+	@$(MAKE) bin
+
 # test runs the unit tests and vets the code
 test: generate
 	TF_ACC= go test $(TEST) $(TESTARGS) -timeout=30s -parallel=4
@@ -23,10 +27,11 @@ test: generate
 # testacc runs acceptance tests
 testacc: generate
 	@if [ "$(TEST)" = "./..." ]; then \
-		echo "ERROR: Set TEST to a specific package"; \
+		echo "ERROR: Set TEST to a specific package. For example,"; \
+		echo "  make testacc TEST=./builtin/providers/aws"; \
 		exit 1; \
 	fi
-	TF_ACC=1 go test $(TEST) -v $(TESTARGS) -timeout 45m
+	TF_ACC=1 go test $(TEST) -v $(TESTARGS) -timeout 90m
 
 # testrace runs the race checker
 testrace: generate
@@ -61,7 +66,8 @@ vet:
 	@go tool vet $(VETARGS) . ; if [ $$? -eq 1 ]; then \
 		echo ""; \
 		echo "Vet found suspicious constructs. Please check the reported constructs"; \
-		echo "and fix them if necessary before submitting the code for reviewal."; \
+		echo "and fix them if necessary before submitting the code for review."; \
+		exit 1; \
 	fi
 
 # generate runs `go generate` to build the dynamically generated
diff --git a/README.md b/README.md
index bda9d7d72..f1f08e737 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ Developing Terraform
 
 If you wish to work on Terraform itself or any of its built-in providers, you'll first need [Go](http://www.golang.org) installed on your machine (version 1.4+ is *required*). Alternatively, you can use the Vagrantfile in the root of this repo to stand up a virtual machine with the appropriate dev tooling already set up for you.
 
-For local dev first make sure Go is properly installed, including setting up a [GOPATH](http://golang.org/doc/code.html#GOPATH). Next, install the following software packages, which are needed for some dependencies:
+For local dev first make sure Go is properly installed, including setting up a [GOPATH](http://golang.org/doc/code.html#GOPATH). You will also need to add `$GOPATH/bin` to your `$PATH`. Next, install the following software packages, which are needed for some dependencies:
 
 -	[Git](http://git-scm.com/)
 -	[Mercurial](http://mercurial.selenic.com/)
@@ -74,7 +74,7 @@ To run the acceptance tests, invoke `make testacc`:
 ```sh
 $ make testacc TEST=./builtin/providers/aws TESTARGS='-run=Vpc'
 go generate ./...
-TF_ACC=1 go test ./builtin/providers/aws -v -run=Vpc -timeout 45m
+TF_ACC=1 go test ./builtin/providers/aws -v -run=Vpc -timeout 90m
 === RUN TestAccVpc_basic
 2015/02/10 14:11:17 [INFO] Test: Using us-west-2 as test region
 [...]
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 000000000..2b8955543
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,84 @@
+# Releasing Terraform
+
+This document contains details about the Terraform release process.
+
+## Schedule
+
+Terraform currently has no fixed release schedule, the HashiCorp maintainers
+can usually give a feel for roughly when the next release is planned.
+
+## Versioning
+
+As a pre-1.0 project, we use the MINOR and PATCH versions as follows:
+
+ * a `MINOR` version increment indicates a release that may contain backwards
+   incompatible changes
+ * a `PATCH` version increment indicates a release that may contain bugfixes as
+   well as additive (backwards compatible) features and enhancements
+
+## Process
+
+For maintainer documentation purposes, here is the current release process:
+
+```sh
+# Spin up a fresh build VM
+vagrant destroy -f
+vagrant up
+vagrant ssh
+cd /opt/gopath/src/github.com/hashicorp/terraform/
+
+# Fetch dependencies
+make updatedeps
+
+# Verify unit tests pass
+make test
+
+# Prep release commit
+export VERSION="vX.Y.Z"
+# Edit CHANGELOG.md, adding current date to unreleased version header
+# Edit version.go, setting VersionPrelease to empty string
+
+# Snapshot dependency information
+go get github.com/tools/godep
+godep save ./...
+cp Godeps/Godeps.json deps/$(echo $VERSION | sed 's/\./-/g').json
+
+# Make and tag release commit (skipping Godeps dir)
+git add CHANGELOG.md terraform/version.go deps/
+git commit -a -m "${VERSION}"
+git tag -m "${VERSION}" "${VERSION}"
+
+# Build the release
+make release
+
+# Make an archive with vendored dependencies
+stashName=$(git stash)
+git archive -o terraform-$VERSION-src.tar.gz $stashName
+
+# Zip and push release to bintray
+export BINTRAY_API_KEY="..."
+./scripts/dist "X.Y.Z" # no `v` prefix here
+
+# -- "Point of no return" --
+# -- Process can be aborted safely at any point before this --
+
+# Push the release commit and tag
+git push origin master
+git push origin vX.Y.Z
+
+# Click "publish" on the release from the Bintray Web UI
+# Upload terraform-$VERSION-src.tar.gz as a file to the GitHub release.
+
+# -- Release is complete! --
+
+# Start release branch (to be used for reproducible builds and docs updates)
+git checkout -b release/$VERSION
+git push origin release/$VERSION
+
+# Clean up master
+git checkout master
+# Set VersionPrerelease to "dev"
+# Add new CHANGELOG section for next release
+git add -A
+git commit -m "release: clean up after ${VERSION}"
+```
diff --git a/Vagrantfile b/Vagrantfile
index 687bc09af..3017ff58c 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -5,34 +5,52 @@
 VAGRANTFILE_API_VERSION = "2"
 
 $script = <<SCRIPT
-# Install Go and prerequisites
-apt-get -qq update
-apt-get -qq install build-essential curl git-core libpcre3-dev mercurial pkg-config zip
-hg clone -u release https://code.google.com/p/go /opt/go
-cd /opt/go/src && ./all.bash
+SRCROOT="/opt/go"
+SRCPATH="/opt/gopath"
 
-# Setup the GOPATH
-mkdir -p /opt/gopath
-cat <<EOF >/etc/profile.d/gopath.sh
-export GOPATH="/opt/gopath"
-export PATH="/opt/go/bin:\$GOPATH/bin:\$PATH"
+# Get the ARCH
+ARCH=`uname -m | sed 's|i686|386|' | sed 's|x86_64|amd64|'`
+
+# Install Prereq Packages
+sudo apt-get update
+sudo apt-get install -y build-essential curl git-core libpcre3-dev mercurial pkg-config zip
+
+# Install Go
+cd /tmp
+wget -q https://storage.googleapis.com/golang/go1.4.2.linux-${ARCH}.tar.gz
+tar -xf go1.4.2.linux-${ARCH}.tar.gz
+sudo mv go $SRCROOT
+sudo chmod 775 $SRCROOT
+sudo chown vagrant:vagrant $SRCROOT
+
+# Setup the GOPATH; even though the shared folder spec gives the working
+# directory the right user/group, we need to set it properly on the
+# parent path to allow subsequent "go get" commands to work.
+sudo mkdir -p $SRCPATH
+sudo chown -R vagrant:vagrant $SRCPATH 2>/dev/null || true
+# ^^ silencing errors here because we expect this to fail for the shared folder
+
+cat <<EOF >/tmp/gopath.sh
+export GOPATH="$SRCPATH"
+export GOROOT="$SRCROOT"
+export PATH="$SRCROOT/bin:$SRCPATH/bin:\$PATH"
 EOF
-
-# Make sure the GOPATH is usable by vagrant
-chown -R vagrant:vagrant /opt/go
-chown -R vagrant:vagrant /opt/gopath
+sudo mv /tmp/gopath.sh /etc/profile.d/gopath.sh
+sudo chmod 0755 /etc/profile.d/gopath.sh
+source /etc/profile.d/gopath.sh
 SCRIPT
 
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
   config.vm.box = "chef/ubuntu-12.04"
 
-  config.vm.provision "shell", inline: $script
+  config.vm.provision "shell", inline: $script, privileged: false
+  config.vm.synced_folder '.', '/opt/gopath/src/github.com/hashicorp/terraform'
 
   ["vmware_fusion", "vmware_workstation"].each do |p|
-    config.vm.provider "p" do |v|
-      v.vmx["memsize"] = "2048"
-      v.vmx["numvcpus"] = "2"
-      v.vmx["cpuid.coresPerSocket"] = "1"
+    config.vm.provider p do |v|
+      v.vmx["memsize"] = "4096"
+      v.vmx["numvcpus"] = "4"
+      v.vmx['cpuid.coresPerSocket'] = '2'
     end
   end
 end
diff --git a/builtin/bins/provider-azure/main.go b/builtin/bins/provider-azure/main.go
new file mode 100644
index 000000000..45af21656
--- /dev/null
+++ b/builtin/bins/provider-azure/main.go
@@ -0,0 +1,12 @@
+package main
+
+import (
+	"github.com/hashicorp/terraform/builtin/providers/azure"
+	"github.com/hashicorp/terraform/plugin"
+)
+
+func main() {
+	plugin.Serve(&plugin.ServeOpts{
+		ProviderFunc: azure.Provider,
+	})
+}
diff --git a/builtin/bins/provider-azure/main_test.go b/builtin/bins/provider-azure/main_test.go
new file mode 100644
index 000000000..06ab7d0f9
--- /dev/null
+++ b/builtin/bins/provider-azure/main_test.go
@@ -0,0 +1 @@
+package main
diff --git a/builtin/bins/provisioner-chef/main.go b/builtin/bins/provisioner-chef/main.go
new file mode 100644
index 000000000..a12c65cf7
--- /dev/null
+++ b/builtin/bins/provisioner-chef/main.go
@@ -0,0 +1,15 @@
+package main
+
+import (
+	"github.com/hashicorp/terraform/builtin/provisioners/chef"
+	"github.com/hashicorp/terraform/plugin"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func main() {
+	plugin.Serve(&plugin.ServeOpts{
+		ProvisionerFunc: func() terraform.ResourceProvisioner {
+			return new(chef.ResourceProvisioner)
+		},
+	})
+}
diff --git a/builtin/bins/provisioner-chef/main_test.go b/builtin/bins/provisioner-chef/main_test.go
new file mode 100644
index 000000000..06ab7d0f9
--- /dev/null
+++ b/builtin/bins/provisioner-chef/main_test.go
@@ -0,0 +1 @@
+package main
diff --git a/builtin/providers/aws/autoscaling_tags.go b/builtin/providers/aws/autoscaling_tags.go
index ee4724852..9a41a3291 100644
--- a/builtin/providers/aws/autoscaling_tags.go
+++ b/builtin/providers/aws/autoscaling_tags.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/autoscaling_tags_test.go b/builtin/providers/aws/autoscaling_tags_test.go
index c14e366ce..b401fa2e4 100644
--- a/builtin/providers/aws/autoscaling_tags_test.go
+++ b/builtin/providers/aws/autoscaling_tags_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/config.go b/builtin/providers/aws/config.go
index 552a0f446..bc465394c 100644
--- a/builtin/providers/aws/config.go
+++ b/builtin/providers/aws/config.go
@@ -7,16 +7,23 @@ import (
 
 	"github.com/hashicorp/terraform/helper/multierror"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/credentials"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/iam"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/aws/aws-sdk-go/service/sqs"
 )
 
 type Config struct {
@@ -31,15 +38,22 @@ type Config struct {
 }
 
 type AWSClient struct {
+	cloudwatchconn  *cloudwatch.CloudWatch
+	dynamodbconn    *dynamodb.DynamoDB
 	ec2conn         *ec2.EC2
+	ecsconn         *ecs.ECS
 	elbconn         *elb.ELB
 	autoscalingconn *autoscaling.AutoScaling
 	s3conn          *s3.S3
+	sqsconn         *sqs.SQS
+	snsconn         *sns.SNS
 	r53conn         *route53.Route53
 	region          string
 	rdsconn         *rds.RDS
 	iamconn         *iam.IAM
+	kinesisconn     *kinesis.Kinesis
 	elasticacheconn *elasticache.ElastiCache
+	lambdaconn      *lambda.Lambda
 }
 
 // Client configures and returns a fully initailized AWSClient
@@ -62,34 +76,39 @@ func (c *Config) Client() (interface{}, error) {
 		client.region = c.Region
 
 		log.Println("[INFO] Building AWS auth structure")
-		creds := credentials.NewChainCredentials([]credentials.Provider{
-			&credentials.StaticProvider{Value: credentials.Value{
-				AccessKeyID:     c.AccessKey,
-				SecretAccessKey: c.SecretKey,
-				SessionToken:    c.Token,
-			}},
-			&credentials.EnvProvider{},
-			&credentials.SharedCredentialsProvider{Filename: "", Profile: ""},
-			&credentials.EC2RoleProvider{},
-		})
+		// We fetched all credential sources in Provider. If they are
+		// available, they'll already be in c. See Provider definition.
+		creds := credentials.NewStaticCredentials(c.AccessKey, c.SecretKey, c.Token)
 		awsConfig := &aws.Config{
 			Credentials: creds,
 			Region:      c.Region,
 			MaxRetries:  c.MaxRetries,
 		}
 
+		log.Println("[INFO] Initializing DynamoDB connection")
+		client.dynamodbconn = dynamodb.New(awsConfig)
+
 		log.Println("[INFO] Initializing ELB connection")
 		client.elbconn = elb.New(awsConfig)
 
 		log.Println("[INFO] Initializing S3 connection")
 		client.s3conn = s3.New(awsConfig)
 
+		log.Println("[INFO] Initializing SQS connection")
+		client.sqsconn = sqs.New(awsConfig)
+
+		log.Println("[INFO] Initializing SNS connection")
+		client.snsconn = sns.New(awsConfig)
+
 		log.Println("[INFO] Initializing RDS Connection")
 		client.rdsconn = rds.New(awsConfig)
 
 		log.Println("[INFO] Initializing IAM Connection")
 		client.iamconn = iam.New(awsConfig)
 
+		log.Println("[INFO] Initializing Kinesis Connection")
+		client.kinesisconn = kinesis.New(awsConfig)
+
 		err := c.ValidateAccountId(client.iamconn)
 		if err != nil {
 			errs = append(errs, err)
@@ -101,6 +120,9 @@ func (c *Config) Client() (interface{}, error) {
 		log.Println("[INFO] Initializing EC2 Connection")
 		client.ec2conn = ec2.New(awsConfig)
 
+		log.Println("[INFO] Initializing ECS Connection")
+		client.ecsconn = ecs.New(awsConfig)
+
 		// aws-sdk-go uses v4 for signing requests, which requires all global
 		// endpoints to use 'us-east-1'.
 		// See http://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html
@@ -113,6 +135,12 @@ func (c *Config) Client() (interface{}, error) {
 
 		log.Println("[INFO] Initializing Elasticache Connection")
 		client.elasticacheconn = elasticache.New(awsConfig)
+
+		log.Println("[INFO] Initializing Lambda Connection")
+		client.lambdaconn = lambda.New(awsConfig)
+
+		log.Println("[INFO] Initializing CloudWatch SDK connection")
+		client.cloudwatchconn = cloudwatch.New(awsConfig)
 	}
 
 	if len(errs) > 0 {
diff --git a/builtin/providers/aws/network_acl_entry.go b/builtin/providers/aws/network_acl_entry.go
index 7ba87712c..908bc885a 100644
--- a/builtin/providers/aws/network_acl_entry.go
+++ b/builtin/providers/aws/network_acl_entry.go
@@ -5,8 +5,8 @@ import (
 	"net"
 	"strconv"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func expandNetworkAclEntries(configured []interface{}, entryType string) ([]*ec2.NetworkACLEntry, error) {
@@ -34,6 +34,18 @@ func expandNetworkAclEntries(configured []interface{}, entryType string) ([]*ec2
 			RuleNumber: aws.Long(int64(data["rule_no"].(int))),
 			CIDRBlock:  aws.String(data["cidr_block"].(string)),
 		}
+
+		// Specify additional required fields for ICMP
+		if p == 1 {
+			e.ICMPTypeCode = &ec2.ICMPTypeCode{}
+			if v, ok := data["icmp_code"]; ok {
+				e.ICMPTypeCode.Code = aws.Long(int64(v.(int)))
+			}
+			if v, ok := data["icmp_type"]; ok {
+				e.ICMPTypeCode.Type = aws.Long(int64(v.(int)))
+			}
+		}
+
 		entries = append(entries, e)
 	}
 	return entries, nil
@@ -60,6 +72,9 @@ func flattenNetworkAclEntries(list []*ec2.NetworkACLEntry) []map[string]interfac
 func protocolIntegers() map[string]int {
 	var protocolIntegers = make(map[string]int)
 	protocolIntegers = map[string]int{
+		// defined at https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+		"ah":   51,
+		"esp":  50,
 		"udp":  17,
 		"tcp":  6,
 		"icmp": 1,
diff --git a/builtin/providers/aws/network_acl_entry_test.go b/builtin/providers/aws/network_acl_entry_test.go
index 95fa69dae..c34b7dfc3 100644
--- a/builtin/providers/aws/network_acl_entry_test.go
+++ b/builtin/providers/aws/network_acl_entry_test.go
@@ -4,8 +4,8 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func Test_expandNetworkACLEntry(t *testing.T) {
diff --git a/builtin/providers/aws/provider.go b/builtin/providers/aws/provider.go
index 095e392dd..d6d877187 100644
--- a/builtin/providers/aws/provider.go
+++ b/builtin/providers/aws/provider.go
@@ -1,6 +1,11 @@
 package aws
 
 import (
+	"net"
+	"sync"
+	"time"
+
+	"github.com/awslabs/aws-sdk-go/aws/credentials"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
@@ -11,35 +16,95 @@ func Provider() terraform.ResourceProvider {
 	// TODO: Move the validation to this, requires conditional schemas
 	// TODO: Move the configuration to this, requires validation
 
+	// These variables are closed within the `getCreds` function below.
+	// This function is responsible for reading credentials from the
+	// environment in the case that they're not explicitly specified
+	// in the Terraform configuration.
+	//
+	// By using the getCreds function here instead of making the default
+	// empty, we avoid asking for input on credentials if they're available
+	// in the environment.
+	var credVal credentials.Value
+	var credErr error
+	var once sync.Once
+	getCreds := func() {
+		// Build the list of providers to look for creds in
+		providers := []credentials.Provider{
+			&credentials.EnvProvider{},
+			&credentials.SharedCredentialsProvider{},
+		}
+
+		// We only look in the EC2 metadata API if we can connect
+		// to the metadata service within a reasonable amount of time
+		conn, err := net.DialTimeout("tcp", "169.254.169.254:80", 100*time.Millisecond)
+		if err == nil {
+			conn.Close()
+			providers = append(providers, &credentials.EC2RoleProvider{})
+		}
+
+		credVal, credErr = credentials.NewChainCredentials(providers).Get()
+
+		// If we didn't successfully find any credentials, just
+		// set the error to nil.
+		if credErr == credentials.ErrNoValidProvidersFoundInChain {
+			credErr = nil
+		}
+	}
+
+	// getCredDefault is a function used by DefaultFunc below to
+	// get the default value for various parts of the credentials.
+	// This function properly handles loading the credentials, checking
+	// for errors, etc.
+	getCredDefault := func(def interface{}, f func() string) (interface{}, error) {
+		once.Do(getCreds)
+
+		// If there was an error, that is always first
+		if credErr != nil {
+			return nil, credErr
+		}
+
+		// If the value is empty string, return nil (not set)
+		val := f()
+		if val == "" {
+			return def, nil
+		}
+
+		return val, nil
+	}
+
+	// The actual provider
 	return &schema.Provider{
 		Schema: map[string]*schema.Schema{
 			"access_key": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_ACCESS_KEY",
-					"AWS_ACCESS_KEY_ID",
-				}, nil),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault(nil, func() string {
+						return credVal.AccessKeyID
+					})
+				},
 				Description: descriptions["access_key"],
 			},
 
 			"secret_key": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_SECRET_KEY",
-					"AWS_SECRET_ACCESS_KEY",
-				}, nil),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault(nil, func() string {
+						return credVal.SecretAccessKey
+					})
+				},
 				Description: descriptions["secret_key"],
 			},
 
 			"token": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_SESSION_TOKEN",
-					"AWS_SECURITY_TOKEN",
-				}, ""),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault("", func() string {
+						return credVal.SessionToken
+					})
+				},
 				Description: descriptions["token"],
 			},
 
@@ -85,47 +150,70 @@ func Provider() terraform.ResourceProvider {
 		ResourcesMap: map[string]*schema.Resource{
 			"aws_app_cookie_stickiness_policy": resourceAwsAppCookieStickinessPolicy(),
 			"aws_autoscaling_group":            resourceAwsAutoscalingGroup(),
+			"aws_autoscaling_notification":     resourceAwsAutoscalingNotification(),
+			"aws_autoscaling_policy":           resourceAwsAutoscalingPolicy(),
+			"aws_cloudwatch_metric_alarm":      resourceAwsCloudWatchMetricAlarm(),
 			"aws_customer_gateway":             resourceAwsCustomerGateway(),
 			"aws_db_instance":                  resourceAwsDbInstance(),
 			"aws_db_parameter_group":           resourceAwsDbParameterGroup(),
 			"aws_db_security_group":            resourceAwsDbSecurityGroup(),
 			"aws_db_subnet_group":              resourceAwsDbSubnetGroup(),
+			"aws_dynamodb_table":               resourceAwsDynamoDbTable(),
 			"aws_ebs_volume":                   resourceAwsEbsVolume(),
+			"aws_ecs_cluster":                  resourceAwsEcsCluster(),
+			"aws_ecs_service":                  resourceAwsEcsService(),
+			"aws_ecs_task_definition":          resourceAwsEcsTaskDefinition(),
 			"aws_eip":                          resourceAwsEip(),
 			"aws_elasticache_cluster":          resourceAwsElasticacheCluster(),
+			"aws_elasticache_parameter_group":  resourceAwsElasticacheParameterGroup(),
 			"aws_elasticache_security_group":   resourceAwsElasticacheSecurityGroup(),
 			"aws_elasticache_subnet_group":     resourceAwsElasticacheSubnetGroup(),
 			"aws_elb":                          resourceAwsElb(),
+			"aws_flow_log":                     resourceAwsFlowLog(),
 			"aws_iam_access_key":               resourceAwsIamAccessKey(),
 			"aws_iam_group_policy":             resourceAwsIamGroupPolicy(),
 			"aws_iam_group":                    resourceAwsIamGroup(),
+			"aws_iam_group_membership":         resourceAwsIamGroupMembership(),
 			"aws_iam_instance_profile":         resourceAwsIamInstanceProfile(),
 			"aws_iam_policy":                   resourceAwsIamPolicy(),
+			"aws_iam_policy_attachment":        resourceAwsIamPolicyAttachment(),
 			"aws_iam_role_policy":              resourceAwsIamRolePolicy(),
 			"aws_iam_role":                     resourceAwsIamRole(),
+			"aws_iam_server_certificate":       resourceAwsIAMServerCertificate(),
 			"aws_iam_user_policy":              resourceAwsIamUserPolicy(),
 			"aws_iam_user":                     resourceAwsIamUser(),
 			"aws_instance":                     resourceAwsInstance(),
 			"aws_internet_gateway":             resourceAwsInternetGateway(),
 			"aws_key_pair":                     resourceAwsKeyPair(),
+			"aws_kinesis_stream":               resourceAwsKinesisStream(),
+			"aws_lambda_function":              resourceAwsLambdaFunction(),
 			"aws_launch_configuration":         resourceAwsLaunchConfiguration(),
 			"aws_lb_cookie_stickiness_policy":  resourceAwsLBCookieStickinessPolicy(),
 			"aws_main_route_table_association": resourceAwsMainRouteTableAssociation(),
 			"aws_network_acl":                  resourceAwsNetworkAcl(),
 			"aws_network_interface":            resourceAwsNetworkInterface(),
 			"aws_proxy_protocol_policy":        resourceAwsProxyProtocolPolicy(),
+			"aws_route53_delegation_set":       resourceAwsRoute53DelegationSet(),
 			"aws_route53_record":               resourceAwsRoute53Record(),
+			"aws_route53_zone_association":     resourceAwsRoute53ZoneAssociation(),
 			"aws_route53_zone":                 resourceAwsRoute53Zone(),
-			"aws_route_table_association":      resourceAwsRouteTableAssociation(),
+			"aws_route53_health_check":         resourceAwsRoute53HealthCheck(),
 			"aws_route_table":                  resourceAwsRouteTable(),
+			"aws_route_table_association":      resourceAwsRouteTableAssociation(),
 			"aws_s3_bucket":                    resourceAwsS3Bucket(),
 			"aws_security_group":               resourceAwsSecurityGroup(),
 			"aws_security_group_rule":          resourceAwsSecurityGroupRule(),
+			"aws_spot_instance_request":        resourceAwsSpotInstanceRequest(),
+			"aws_sqs_queue":                    resourceAwsSqsQueue(),
+			"aws_sns_topic":                    resourceAwsSnsTopic(),
+			"aws_sns_topic_subscription":       resourceAwsSnsTopicSubscription(),
 			"aws_subnet":                       resourceAwsSubnet(),
+			"aws_volume_attachment":            resourceAwsVolumeAttachment(),
 			"aws_vpc_dhcp_options_association": resourceAwsVpcDhcpOptionsAssociation(),
 			"aws_vpc_dhcp_options":             resourceAwsVpcDhcpOptions(),
 			"aws_vpc_peering_connection":       resourceAwsVpcPeeringConnection(),
 			"aws_vpc":                          resourceAwsVpc(),
+			"aws_vpc_endpoint":                 resourceAwsVpcEndpoint(),
 			"aws_vpn_connection":               resourceAwsVpnConnection(),
 			"aws_vpn_connection_route":         resourceAwsVpnConnectionRoute(),
 			"aws_vpn_gateway":                  resourceAwsVpnGateway(),
diff --git a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
index 62a3713fa..ca459ead7 100644
--- a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
+++ b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -90,7 +91,7 @@ func resourceAwsAppCookieStickinessPolicyRead(d *schema.ResourceData, meta inter
 
 	getResp, err := elbconn.DescribeLoadBalancerPolicies(request)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "PolicyNotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "PolicyNotFound" {
 			// The policy is gone.
 			d.SetId("")
 			return nil
diff --git a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
index 3e99ab71d..ff13da285 100644
--- a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
+++ b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSAppCookieStickinessPolicy(t *testing.T) {
+func TestAccAWSAppCookieStickinessPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_autoscaling_group.go b/builtin/providers/aws/resource_aws_autoscaling_group.go
index bd78ee747..ae6c94b33 100644
--- a/builtin/providers/aws/resource_aws_autoscaling_group.go
+++ b/builtin/providers/aws/resource_aws_autoscaling_group.go
@@ -9,8 +9,10 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/elb"
 )
 
 func resourceAwsAutoscalingGroup() *schema.Resource {
@@ -25,6 +27,15 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/9f322b1/botocore/data/autoscaling/2011-01-01/service-2.json#L1862-L1873
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"launch_configuration": &schema.Schema{
@@ -38,6 +49,11 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Computed: true,
 			},
 
+			"min_elb_capacity": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
 			"min_size": &schema.Schema{
 				Type:     schema.TypeInt,
 				Required: true,
@@ -52,7 +68,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeInt,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 
 			"force_delete": &schema.Schema{
@@ -72,13 +87,11 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 
 			"availability_zones": &schema.Schema{
 				Type:     schema.TypeSet,
-				Required: true,
-				ForceNew: true,
+				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set:      schema.HashString,
 			},
@@ -86,7 +99,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 			"load_balancers": &schema.Schema{
 				Type:     schema.TypeSet,
 				Optional: true,
-				ForceNew: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set:      schema.HashString,
 			},
@@ -95,7 +107,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set:      schema.HashString,
 			},
@@ -122,8 +133,11 @@ func resourceAwsAutoscalingGroupCreate(d *schema.ResourceData, meta interface{})
 	autoScalingGroupOpts.LaunchConfigurationName = aws.String(d.Get("launch_configuration").(string))
 	autoScalingGroupOpts.MinSize = aws.Long(int64(d.Get("min_size").(int)))
 	autoScalingGroupOpts.MaxSize = aws.Long(int64(d.Get("max_size").(int)))
-	autoScalingGroupOpts.AvailabilityZones = expandStringList(
-		d.Get("availability_zones").(*schema.Set).List())
+
+	// Availability Zones are optional if VPC Zone Identifer(s) are specified
+	if v, ok := d.GetOk("availability_zones"); ok && v.(*schema.Set).Len() > 0 {
+		autoScalingGroupOpts.AvailabilityZones = expandStringList(v.(*schema.Set).List())
+	}
 
 	if v, ok := d.GetOk("tag"); ok {
 		autoScalingGroupOpts.Tags = autoscalingTagsFromMap(
@@ -152,12 +166,7 @@ func resourceAwsAutoscalingGroupCreate(d *schema.ResourceData, meta interface{})
 	}
 
 	if v, ok := d.GetOk("vpc_zone_identifier"); ok && v.(*schema.Set).Len() > 0 {
-		exp := expandStringList(v.(*schema.Set).List())
-		strs := make([]string, len(exp))
-		for _, s := range exp {
-			strs = append(strs, *s)
-		}
-		autoScalingGroupOpts.VPCZoneIdentifier = aws.String(strings.Join(strs, ","))
+		autoScalingGroupOpts.VPCZoneIdentifier = expandVpcZoneIdentifiers(v.(*schema.Set).List())
 	}
 
 	if v, ok := d.GetOk("termination_policies"); ok && v.(*schema.Set).Len() > 0 {
@@ -214,6 +223,10 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		AutoScalingGroupName: aws.String(d.Id()),
 	}
 
+	if d.HasChange("default_cooldown") {
+		opts.DefaultCooldown = aws.Long(int64(d.Get("default_cooldown").(int)))
+	}
+
 	if d.HasChange("desired_capacity") {
 		opts.DesiredCapacity = aws.Long(int64(d.Get("desired_capacity").(int)))
 	}
@@ -234,6 +247,21 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		opts.HealthCheckGracePeriod = aws.Long(int64(d.Get("health_check_grace_period").(int)))
 	}
 
+	if d.HasChange("health_check_type") {
+		opts.HealthCheckGracePeriod = aws.Long(int64(d.Get("health_check_grace_period").(int)))
+		opts.HealthCheckType = aws.String(d.Get("health_check_type").(string))
+	}
+
+	if d.HasChange("vpc_zone_identifier") {
+		opts.VPCZoneIdentifier = expandVpcZoneIdentifiers(d.Get("vpc_zone_identifier").(*schema.Set).List())
+	}
+
+	if d.HasChange("availability_zones") {
+		if v, ok := d.GetOk("availability_zones"); ok && v.(*schema.Set).Len() > 0 {
+			opts.AvailabilityZones = expandStringList(d.Get("availability_zones").(*schema.Set).List())
+		}
+	}
+
 	if err := setAutoscalingTags(conn, d); err != nil {
 		return err
 	} else {
@@ -247,6 +275,42 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error updating Autoscaling group: %s", err)
 	}
 
+	if d.HasChange("load_balancers") {
+
+		o, n := d.GetChange("load_balancers")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+		remove := expandStringList(os.Difference(ns).List())
+		add := expandStringList(ns.Difference(os).List())
+
+		if len(remove) > 0 {
+			_, err := conn.DetachLoadBalancers(&autoscaling.DetachLoadBalancersInput{
+				AutoScalingGroupName: aws.String(d.Id()),
+				LoadBalancerNames:    remove,
+			})
+			if err != nil {
+				return fmt.Errorf("[WARN] Error updating Load Balancers for AutoScaling Group (%s), error: %s", d.Id(), err)
+			}
+		}
+
+		if len(add) > 0 {
+			_, err := conn.AttachLoadBalancers(&autoscaling.AttachLoadBalancersInput{
+				AutoScalingGroupName: aws.String(d.Id()),
+				LoadBalancerNames:    add,
+			})
+			if err != nil {
+				return fmt.Errorf("[WARN] Error updating Load Balancers for AutoScaling Group (%s), error: %s", d.Id(), err)
+			}
+		}
+	}
+
 	return resourceAwsAutoscalingGroupRead(d, meta)
 }
 
@@ -286,8 +350,8 @@ func resourceAwsAutoscalingGroupDelete(d *schema.ResourceData, meta interface{})
 	// scaling operations within 5m.
 	err = resource.Retry(5*time.Minute, func() error {
 		if _, err := conn.DeleteAutoScalingGroup(&deleteopts); err != nil {
-			if awserr, ok := err.(aws.APIError); ok {
-				switch awserr.Code {
+			if awserr, ok := err.(awserr.Error); ok {
+				switch awserr.Code() {
 				case "InvalidGroup.NotFound":
 					// Already gone? Sure!
 					return nil
@@ -316,7 +380,7 @@ func resourceAwsAutoscalingGroupDelete(d *schema.ResourceData, meta interface{})
 
 func getAwsAutoscalingGroup(
 	d *schema.ResourceData,
-	meta interface{}) (*autoscaling.AutoScalingGroup, error) {
+	meta interface{}) (*autoscaling.Group, error) {
 	conn := meta.(*AWSClient).autoscalingconn
 
 	describeOpts := autoscaling.DescribeAutoScalingGroupsInput{
@@ -326,8 +390,8 @@ func getAwsAutoscalingGroup(
 	log.Printf("[DEBUG] AutoScaling Group describe configuration: %#v", describeOpts)
 	describeGroups, err := conn.DescribeAutoScalingGroups(&describeOpts)
 	if err != nil {
-		autoscalingerr, ok := err.(aws.APIError)
-		if ok && autoscalingerr.Code == "InvalidGroup.NotFound" {
+		autoscalingerr, ok := err.(awserr.Error)
+		if ok && autoscalingerr.Code() == "InvalidGroup.NotFound" {
 			d.SetId("")
 			return nil, nil
 		}
@@ -386,13 +450,19 @@ var waitForASGCapacityTimeout = 10 * time.Minute
 // Waits for a minimum number of healthy instances to show up as healthy in the
 // ASG before continuing. Waits up to `waitForASGCapacityTimeout` for
 // "desired_capacity", or "min_size" if desired capacity is not specified.
+//
+// If "min_elb_capacity" is specified, will also wait for that number of
+// instances to show up InService in all attached ELBs. See "Waiting for
+// Capacity" in docs for more discussion of the feature.
 func waitForASGCapacity(d *schema.ResourceData, meta interface{}) error {
-	waitFor := d.Get("min_size").(int)
+	wantASG := d.Get("min_size").(int)
 	if v := d.Get("desired_capacity").(int); v > 0 {
-		waitFor = v
+		wantASG = v
 	}
+	wantELB := d.Get("min_elb_capacity").(int)
+
+	log.Printf("[DEBUG] Waiting for capacity: %d ASG, %d ELB", wantASG, wantELB)
 
-	log.Printf("[DEBUG] Waiting for group to have %d healthy instances", waitFor)
 	return resource.Retry(waitForASGCapacityTimeout, func() error {
 		g, err := getAwsAutoscalingGroup(d, meta)
 		if err != nil {
@@ -401,24 +471,84 @@ func waitForASGCapacity(d *schema.ResourceData, meta interface{}) error {
 		if g == nil {
 			return nil
 		}
+		lbis, err := getLBInstanceStates(g, meta)
+		if err != nil {
+			return resource.RetryError{Err: err}
+		}
+
+		haveASG := 0
+		haveELB := 0
 
-		healthy := 0
 		for _, i := range g.Instances {
-			if i.HealthStatus == nil {
+			if i.HealthStatus == nil || i.InstanceID == nil || i.LifecycleState == nil {
 				continue
 			}
-			if strings.EqualFold(*i.HealthStatus, "Healthy") {
-				healthy++
+
+			if !strings.EqualFold(*i.HealthStatus, "Healthy") {
+				continue
+			}
+
+			if !strings.EqualFold(*i.LifecycleState, "InService") {
+				continue
+			}
+
+			haveASG++
+
+			if wantELB > 0 {
+				inAllLbs := true
+				for _, states := range lbis {
+					state, ok := states[*i.InstanceID]
+					if !ok || !strings.EqualFold(state, "InService") {
+						inAllLbs = false
+					}
+				}
+				if inAllLbs {
+					haveELB++
+				}
 			}
 		}
 
-		log.Printf(
-			"[DEBUG] %q has %d/%d healthy instances", d.Id(), healthy, waitFor)
+		log.Printf("[DEBUG] %q Capacity: %d/%d ASG, %d/%d ELB",
+			d.Id(), haveASG, wantASG, haveELB, wantELB)
 
-		if healthy >= waitFor {
+		if haveASG >= wantASG && haveELB >= wantELB {
 			return nil
 		}
 
-		return fmt.Errorf("Waiting for healthy instances: %d/%d", healthy, waitFor)
+		return fmt.Errorf("Still need to wait for more healthy instances. This could mean instances failed to launch. See Scaling History for more information.")
 	})
 }
+
+// Returns a mapping of the instance states of all the ELBs attached to the
+// provided ASG.
+//
+// Nested like: lbName -> instanceId -> instanceState
+func getLBInstanceStates(g *autoscaling.Group, meta interface{}) (map[string]map[string]string, error) {
+	lbInstanceStates := make(map[string]map[string]string)
+	elbconn := meta.(*AWSClient).elbconn
+
+	for _, lbName := range g.LoadBalancerNames {
+		lbInstanceStates[*lbName] = make(map[string]string)
+		opts := &elb.DescribeInstanceHealthInput{LoadBalancerName: lbName}
+		r, err := elbconn.DescribeInstanceHealth(opts)
+		if err != nil {
+			return nil, err
+		}
+		for _, is := range r.InstanceStates {
+			if is.InstanceID == nil || is.State == nil {
+				continue
+			}
+			lbInstanceStates[*lbName][*is.InstanceID] = *is.State
+		}
+	}
+
+	return lbInstanceStates, nil
+}
+
+func expandVpcZoneIdentifiers(list []interface{}) *string {
+	strs := make([]string, len(list))
+	for _, s := range list {
+		strs = append(strs, s.(string))
+	}
+	return aws.String(strings.Join(strs, ","))
+}
diff --git a/builtin/providers/aws/resource_aws_autoscaling_group_test.go b/builtin/providers/aws/resource_aws_autoscaling_group_test.go
index 9e3600438..9f26bb7f2 100644
--- a/builtin/providers/aws/resource_aws_autoscaling_group_test.go
+++ b/builtin/providers/aws/resource_aws_autoscaling_group_test.go
@@ -6,14 +6,15 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
 func TestAccAWSAutoScalingGroup_basic(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 	var lc autoscaling.LaunchConfiguration
 
 	resource.Test(t, resource.TestCase{
@@ -67,7 +68,7 @@ func TestAccAWSAutoScalingGroup_basic(t *testing.T) {
 }
 
 func TestAccAWSAutoScalingGroup_tags(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -100,8 +101,34 @@ func TestAccAWSAutoScalingGroup_tags(t *testing.T) {
 	})
 }
 
+func TestAccAWSAutoScalingGroup_VpcUpdates(t *testing.T) {
+	var group autoscaling.Group
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSAutoScalingGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSAutoScalingGroupConfigWithAZ,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSAutoScalingGroupExists("aws_autoscaling_group.bar", &group),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSAutoScalingGroupConfigWithVPCIdent,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSAutoScalingGroupExists("aws_autoscaling_group.bar", &group),
+					testAccCheckAWSAutoScalingGroupAttributesVPCZoneIdentifer(&group),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSAutoScalingGroup_WithLoadBalancer(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -141,11 +168,11 @@ func testAccCheckAWSAutoScalingGroupDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidGroup.NotFound" {
+		if ec2err.Code() != "InvalidGroup.NotFound" {
 			return err
 		}
 	}
@@ -153,7 +180,7 @@ func testAccCheckAWSAutoScalingGroupDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if *group.AvailabilityZones[0] != "us-west-2a" {
 			return fmt.Errorf("Bad availability_zones: %#v", group.AvailabilityZones[0])
@@ -206,7 +233,7 @@ func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.AutoScalingGro
 	}
 }
 
-func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if *group.LoadBalancerNames[0] != "foobar-terraform-test" {
 			return fmt.Errorf("Bad load_balancers: %#v", group.LoadBalancerNames[0])
@@ -216,7 +243,7 @@ func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.Au
 	}
 }
 
-func testAccCheckAWSAutoScalingGroupExists(n string, group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupExists(n string, group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -265,7 +292,7 @@ func testLaunchConfigurationName(n string, lc *autoscaling.LaunchConfiguration)
 }
 
 func testAccCheckAWSAutoScalingGroupHealthyCapacity(
-	g *autoscaling.AutoScalingGroup, exp int) resource.TestCheckFunc {
+	g *autoscaling.Group, exp int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		healthy := 0
 		for _, i := range g.Instances {
@@ -283,6 +310,40 @@ func testAccCheckAWSAutoScalingGroupHealthyCapacity(
 	}
 }
 
+func testAccCheckAWSAutoScalingGroupAttributesVPCZoneIdentifer(group *autoscaling.Group) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		// Grab Subnet Ids
+		var subnets []string
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_subnet" {
+				continue
+			}
+			subnets = append(subnets, rs.Primary.Attributes["id"])
+		}
+
+		if group.VPCZoneIdentifier == nil {
+			return fmt.Errorf("Bad VPC Zone Identifier\nexpected: %s\ngot nil", subnets)
+		}
+
+		zones := strings.Split(*group.VPCZoneIdentifier, ",")
+
+		remaining := len(zones)
+		for _, z := range zones {
+			for _, s := range subnets {
+				if z == s {
+					remaining--
+				}
+			}
+		}
+
+		if remaining != 0 {
+			return fmt.Errorf("Bad VPC Zone Identifier match\nexpected: %s\ngot:%s", zones, subnets)
+		}
+
+		return nil
+	}
+}
+
 const testAccAWSAutoScalingGroupConfig = `
 resource "aws_launch_configuration" "foobar" {
   image_id = "ami-21f78e11"
@@ -342,34 +403,176 @@ resource "aws_autoscaling_group" "bar" {
 `
 
 const testAccAWSAutoScalingGroupConfigWithLoadBalancer = `
+resource "aws_vpc" "foo" {
+  cidr_block = "10.1.0.0/16"
+	tags { Name = "tf-asg-test" }
+}
+
+resource "aws_internet_gateway" "gw" {
+  vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_subnet" "foo" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_security_group" "foo" {
+  vpc_id="${aws_vpc.foo.id}"
+
+  ingress {
+    protocol = "-1"
+    from_port = 0
+    to_port = 0
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    protocol = "-1"
+    from_port = 0
+    to_port = 0
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
 resource "aws_elb" "bar" {
   name = "foobar-terraform-test"
-  availability_zones = ["us-west-2a"]
+  subnets = ["${aws_subnet.foo.id}"]
+	security_groups = ["${aws_security_group.foo.id}"]
 
   listener {
-    instance_port = 8000
+    instance_port = 80
     instance_protocol = "http"
     lb_port = 80
     lb_protocol = "http"
   }
+
+  health_check {
+    healthy_threshold = 2
+    unhealthy_threshold = 2
+    target = "HTTP:80/"
+    interval = 5
+    timeout = 2
+  }
+
+	depends_on = ["aws_internet_gateway.gw"]
 }
 
 resource "aws_launch_configuration" "foobar" {
-  image_id = "ami-21f78e11"
-  instance_type = "t1.micro"
+  // need an AMI that listens on :80 at boot, this is:
+  // bitnami-nginxstack-1.6.1-0-linux-ubuntu-14.04.1-x86_64-hvm-ebs-ami-99f5b1a9-3
+  image_id = "ami-b5b3fc85"
+  instance_type = "t2.micro"
+	security_groups = ["${aws_security_group.foo.id}"]
 }
 
 resource "aws_autoscaling_group" "bar" {
-  availability_zones = ["us-west-2a"]
+  availability_zones = ["${aws_subnet.foo.availability_zone}"]
+	vpc_zone_identifier = ["${aws_subnet.foo.id}"]
   name = "foobar3-terraform-test"
-  max_size = 5
+  max_size = 2
   min_size = 2
   health_check_grace_period = 300
   health_check_type = "ELB"
-  desired_capacity = 4
+  min_elb_capacity = 2
   force_delete = true
 
   launch_configuration = "${aws_launch_configuration.foobar.name}"
   load_balancers = ["${aws_elb.bar.name}"]
 }
 `
+
+const testAccAWSAutoScalingGroupConfigWithAZ = `
+resource "aws_vpc" "default" {
+  cidr_block = "10.0.0.0/16"
+  tags {
+     Name = "terraform-test"
+  }
+}
+
+resource "aws_subnet" "main" {
+  vpc_id = "${aws_vpc.default.id}"
+  cidr_block = "10.0.1.0/24"
+  availability_zone = "us-west-2a"
+  tags {
+     Name = "terraform-test"
+  }
+}
+
+resource "aws_subnet" "alt" {
+  vpc_id = "${aws_vpc.default.id}"
+  cidr_block = "10.0.2.0/24"
+  availability_zone = "us-west-2b"
+  tags {
+     Name = "asg-vpc-thing"
+  }
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "vpc-asg-test"
+  image_id = "ami-b5b3fc85"
+  instance_type = "t2.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-west-2a"]
+  name = "vpc-asg-test"
+  max_size = 2
+  min_size = 1
+  health_check_grace_period = 300
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+`
+
+const testAccAWSAutoScalingGroupConfigWithVPCIdent = `
+resource "aws_vpc" "default" {
+  cidr_block = "10.0.0.0/16"
+  tags {
+     Name = "terraform-test"
+  }
+}
+
+resource "aws_subnet" "main" {
+  vpc_id = "${aws_vpc.default.id}"
+  cidr_block = "10.0.1.0/24"
+  availability_zone = "us-west-2a"
+  tags {
+     Name = "terraform-test"
+  }
+}
+
+resource "aws_subnet" "alt" {
+  vpc_id = "${aws_vpc.default.id}"
+  cidr_block = "10.0.2.0/24"
+  availability_zone = "us-west-2b"
+  tags {
+     Name = "asg-vpc-thing"
+  }
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "vpc-asg-test"
+  image_id = "ami-b5b3fc85"
+  instance_type = "t2.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  vpc_zone_identifier = [
+    "${aws_subnet.main.id}",
+    "${aws_subnet.alt.id}",
+  ]
+  name = "vpc-asg-test"
+  max_size = 2
+  min_size = 1
+  health_check_grace_period = 300
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_autoscaling_notification.go b/builtin/providers/aws/resource_aws_autoscaling_notification.go
new file mode 100644
index 000000000..07adaa676
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_notification.go
@@ -0,0 +1,200 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsAutoscalingNotification() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsAutoscalingNotificationCreate,
+		Read:   resourceAwsAutoscalingNotificationRead,
+		Update: resourceAwsAutoscalingNotificationUpdate,
+		Delete: resourceAwsAutoscalingNotificationDelete,
+
+		Schema: map[string]*schema.Schema{
+			"topic_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"group_names": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+
+			"notifications": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+		},
+	}
+}
+
+func resourceAwsAutoscalingNotificationCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+	nl := convertSetToList(d.Get("notifications").(*schema.Set))
+
+	topic := d.Get("topic_arn").(string)
+	if err := addNotificationConfigToGroupsWithTopic(conn, gl, nl, topic); err != nil {
+		return err
+	}
+
+	// ARNs are unique, and these notifications are per ARN, so we re-use the ARN
+	// here as the ID
+	d.SetId(topic)
+	return resourceAwsAutoscalingNotificationRead(d, meta)
+}
+
+func resourceAwsAutoscalingNotificationRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+
+	opts := &autoscaling.DescribeNotificationConfigurationsInput{
+		AutoScalingGroupNames: gl,
+	}
+
+	resp, err := conn.DescribeNotificationConfigurations(opts)
+	if err != nil {
+		return fmt.Errorf("Error describing notifications")
+	}
+
+	topic := d.Get("topic_arn").(string)
+	// Grab all applicable notifcation configurations for this Topic.
+	// Each NotificationType will have a record, so 1 Group with 3 Types results
+	// in 3 records, all with the same Group name
+	gRaw := make(map[string]bool)
+	nRaw := make(map[string]bool)
+	for _, n := range resp.NotificationConfigurations {
+		if *n.TopicARN == topic {
+			gRaw[*n.AutoScalingGroupName] = true
+			nRaw[*n.NotificationType] = true
+		}
+	}
+
+	// Grab the keys here as the list of Groups
+	var gList []string
+	for k, _ := range gRaw {
+		gList = append(gList, k)
+	}
+
+	// Grab the keys here as the list of Types
+	var nList []string
+	for k, _ := range nRaw {
+		nList = append(nList, k)
+	}
+
+	if err := d.Set("group_names", gList); err != nil {
+		return err
+	}
+	if err := d.Set("notifications", nList); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceAwsAutoscalingNotificationUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+
+	// Notifications API call is a PUT, so we don't need to diff the list, just
+	// push whatever it is and AWS sorts it out
+	nl := convertSetToList(d.Get("notifications").(*schema.Set))
+
+	o, n := d.GetChange("group_names")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := convertSetToList(os.Difference(ns))
+	add := convertSetToList(ns.Difference(os))
+
+	topic := d.Get("topic_arn").(string)
+
+	if err := removeNotificationConfigToGroupsWithTopic(conn, remove, topic); err != nil {
+		return err
+	}
+
+	var update []*string
+	if d.HasChange("notifications") {
+		update = convertSetToList(d.Get("group_names").(*schema.Set))
+	} else {
+		update = add
+	}
+
+	if err := addNotificationConfigToGroupsWithTopic(conn, update, nl, topic); err != nil {
+		return err
+	}
+
+	return resourceAwsAutoscalingNotificationRead(d, meta)
+}
+
+func addNotificationConfigToGroupsWithTopic(conn *autoscaling.AutoScaling, groups []*string, nl []*string, topic string) error {
+	for _, a := range groups {
+		opts := &autoscaling.PutNotificationConfigurationInput{
+			AutoScalingGroupName: a,
+			NotificationTypes:    nl,
+			TopicARN:             aws.String(topic),
+		}
+
+		_, err := conn.PutNotificationConfiguration(opts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				return fmt.Errorf("[WARN] Error creating Autoscaling Group Notification for Group %s, error: \"%s\", code: \"%s\"", *a, awsErr.Message(), awsErr.Code())
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+func removeNotificationConfigToGroupsWithTopic(conn *autoscaling.AutoScaling, groups []*string, topic string) error {
+	for _, r := range groups {
+		opts := &autoscaling.DeleteNotificationConfigurationInput{
+			AutoScalingGroupName: r,
+			TopicARN:             aws.String(topic),
+		}
+
+		_, err := conn.DeleteNotificationConfiguration(opts)
+		if err != nil {
+			return fmt.Errorf("[WARN] Error deleting notification configuration for ASG \"%s\", Topic ARN \"%s\"", *r, topic)
+		}
+	}
+	return nil
+}
+
+func resourceAwsAutoscalingNotificationDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+
+	topic := d.Get("topic_arn").(string)
+	if err := removeNotificationConfigToGroupsWithTopic(conn, gl, topic); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func convertSetToList(s *schema.Set) (nl []*string) {
+	l := s.List()
+	for _, n := range l {
+		nl = append(nl, aws.String(n.(string)))
+	}
+
+	return nl
+}
diff --git a/builtin/providers/aws/resource_aws_autoscaling_notification_test.go b/builtin/providers/aws/resource_aws_autoscaling_notification_test.go
new file mode 100644
index 000000000..4198d2b07
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_notification_test.go
@@ -0,0 +1,252 @@
+package aws
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSASGNotification_basic(t *testing.T) {
+	var asgn autoscaling.DescribeNotificationConfigurationsOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckASGNDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSASGNotification_update(t *testing.T) {
+	var asgn autoscaling.DescribeNotificationConfigurationsOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckASGNDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test", "barfoo-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckASGNotificationExists(n string, groups []string, asgn *autoscaling.DescribeNotificationConfigurationsOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ASG Notification ID is set")
+		}
+
+		var gl []*string
+		for _, g := range groups {
+			gl = append(gl, aws.String(g))
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		opts := &autoscaling.DescribeNotificationConfigurationsInput{
+			AutoScalingGroupNames: gl,
+		}
+
+		resp, err := conn.DescribeNotificationConfigurations(opts)
+		if err != nil {
+			return fmt.Errorf("Error describing notifications")
+		}
+
+		*asgn = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckASGNDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_autoscaling_notification" {
+			continue
+		}
+
+		groups := []*string{aws.String("foobar1-terraform-test")}
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		opts := &autoscaling.DescribeNotificationConfigurationsInput{
+			AutoScalingGroupNames: groups,
+		}
+
+		resp, err := conn.DescribeNotificationConfigurations(opts)
+		if err != nil {
+			return fmt.Errorf("Error describing notifications")
+		}
+
+		if len(resp.NotificationConfigurations) != 0 {
+			fmt.Errorf("Error finding notification descriptions")
+		}
+
+	}
+	return nil
+}
+
+func testAccCheckAWSASGNotificationAttributes(n string, asgn *autoscaling.DescribeNotificationConfigurationsOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ASG Notification ID is set")
+		}
+
+		if len(asgn.NotificationConfigurations) == 0 {
+			return fmt.Errorf("Error: no ASG Notifications found")
+		}
+
+		// build a unique list of groups, notification types
+		gRaw := make(map[string]bool)
+		nRaw := make(map[string]bool)
+		for _, n := range asgn.NotificationConfigurations {
+			if *n.TopicARN == rs.Primary.Attributes["topic_arn"] {
+				gRaw[*n.AutoScalingGroupName] = true
+				nRaw[*n.NotificationType] = true
+			}
+		}
+
+		// Grab the keys here as the list of Groups
+		var gList []string
+		for k, _ := range gRaw {
+			gList = append(gList, k)
+		}
+
+		// Grab the keys here as the list of Types
+		var nList []string
+		for k, _ := range nRaw {
+			nList = append(nList, k)
+		}
+
+		typeCount, _ := strconv.Atoi(rs.Primary.Attributes["notifications.#"])
+
+		if len(nList) != typeCount {
+			return fmt.Errorf("Error: Bad ASG Notification count, expected (%d), got (%d)", typeCount, len(nList))
+		}
+
+		groupCount, _ := strconv.Atoi(rs.Primary.Attributes["group_names.#"])
+
+		if len(gList) != groupCount {
+			return fmt.Errorf("Error: Bad ASG Group count, expected (%d), got (%d)", typeCount, len(gList))
+		}
+
+		return nil
+	}
+}
+
+const testAccASGNotificationConfig_basic = `
+resource "aws_sns_topic" "topic_example" {
+  name = "user-updates-topic"
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "foobarautoscaling-terraform-test"
+  image_id = "ami-21f78e11"
+  instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-west-2a"]
+  name = "foobar1-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 100
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_notification" "example" {
+  group_names     = ["${aws_autoscaling_group.bar.name}"]
+  notifications  = [
+	"autoscaling:EC2_INSTANCE_LAUNCH", 
+	"autoscaling:EC2_INSTANCE_TERMINATE", 
+  ]
+  topic_arn = "${aws_sns_topic.topic_example.arn}"
+}
+`
+
+const testAccASGNotificationConfig_update = `
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "foobarautoscaling-terraform-test"
+  image_id = "ami-21f78e11"
+  instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-west-2a"]
+  name = "foobar1-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 100
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_group" "foo" {
+  availability_zones = ["us-west-2b"]
+  name = "barfoo-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 200
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_notification" "example" {
+	group_names     = [
+	"${aws_autoscaling_group.bar.name}",
+	"${aws_autoscaling_group.foo.name}",
+	]
+	notifications  = [
+		"autoscaling:EC2_INSTANCE_LAUNCH", 
+		"autoscaling:EC2_INSTANCE_TERMINATE",
+		"autoscaling:EC2_INSTANCE_LAUNCH_ERROR"
+	]
+	topic_arn = "${aws_sns_topic.user_updates.arn}"
+}`
diff --git a/builtin/providers/aws/resource_aws_autoscaling_policy.go b/builtin/providers/aws/resource_aws_autoscaling_policy.go
new file mode 100644
index 000000000..d2f6d2d47
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_policy.go
@@ -0,0 +1,181 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsAutoscalingPolicy() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsAutoscalingPolicyCreate,
+		Read:   resourceAwsAutoscalingPolicyRead,
+		Update: resourceAwsAutoscalingPolicyUpdate,
+		Delete: resourceAwsAutoscalingPolicyDelete,
+
+		Schema: map[string]*schema.Schema{
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"adjustment_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"autoscaling_group_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"cooldown": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"min_adjustment_step": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"scaling_adjustment": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAwsAutoscalingPolicyCreate(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := getAwsAutoscalingPutScalingPolicyInput(d)
+
+	log.Printf("[DEBUG] AutoScaling PutScalingPolicy: %#v", params)
+	resp, err := autoscalingconn.PutScalingPolicy(&params)
+	if err != nil {
+		return fmt.Errorf("Error putting scaling policy: %s", err)
+	}
+
+	d.Set("arn", resp.PolicyARN)
+	d.SetId(d.Get("name").(string))
+	log.Printf("[INFO] AutoScaling Scaling PolicyARN: %s", d.Get("arn").(string))
+
+	return resourceAwsAutoscalingPolicyRead(d, meta)
+}
+
+func resourceAwsAutoscalingPolicyRead(d *schema.ResourceData, meta interface{}) error {
+	p, err := getAwsAutoscalingPolicy(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		d.SetId("")
+		return nil
+	}
+
+	log.Printf("[DEBUG] Read Scaling Policy: ASG: %s, SP: %s, Obj: %#v", d.Get("autoscaling_group_name"), d.Get("name"), p)
+
+	d.Set("adjustment_type", p.AdjustmentType)
+	d.Set("autoscaling_group_name", p.AutoScalingGroupName)
+	d.Set("cooldown", p.Cooldown)
+	d.Set("min_adjustment_step", p.MinAdjustmentStep)
+	d.Set("arn", p.PolicyARN)
+	d.Set("name", p.PolicyName)
+	d.Set("scaling_adjustment", p.ScalingAdjustment)
+
+	return nil
+}
+
+func resourceAwsAutoscalingPolicyUpdate(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := getAwsAutoscalingPutScalingPolicyInput(d)
+
+	log.Printf("[DEBUG] Autoscaling Update Scaling Policy: %#v", params)
+	_, err := autoscalingconn.PutScalingPolicy(&params)
+	if err != nil {
+		return err
+	}
+
+	return resourceAwsAutoscalingPolicyRead(d, meta)
+}
+
+func resourceAwsAutoscalingPolicyDelete(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+	p, err := getAwsAutoscalingPolicy(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		return nil
+	}
+
+	params := autoscaling.DeletePolicyInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyName:           aws.String(d.Get("name").(string)),
+	}
+	if _, err := autoscalingconn.DeletePolicy(&params); err != nil {
+		return fmt.Errorf("Autoscaling Scaling Policy: %s ", err)
+	}
+
+	d.SetId("")
+	return nil
+}
+
+// PutScalingPolicy seems to require all params to be resent, so create and update can share this common function
+func getAwsAutoscalingPutScalingPolicyInput(d *schema.ResourceData) autoscaling.PutScalingPolicyInput {
+	var params = autoscaling.PutScalingPolicyInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyName:           aws.String(d.Get("name").(string)),
+	}
+
+	if v, ok := d.GetOk("adjustment_type"); ok {
+		params.AdjustmentType = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("cooldown"); ok {
+		params.Cooldown = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("scaling_adjustment"); ok {
+		params.ScalingAdjustment = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("min_adjustment_step"); ok {
+		params.MinAdjustmentStep = aws.Long(int64(v.(int)))
+	}
+
+	return params
+}
+
+func getAwsAutoscalingPolicy(d *schema.ResourceData, meta interface{}) (*autoscaling.ScalingPolicy, error) {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := autoscaling.DescribePoliciesInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyNames:          []*string{aws.String(d.Get("name").(string))},
+	}
+
+	log.Printf("[DEBUG] AutoScaling Scaling Policy Describe Params: %#v", params)
+	resp, err := autoscalingconn.DescribePolicies(&params)
+	if err != nil {
+		return nil, fmt.Errorf("Error retrieving scaling policies: %s", err)
+	}
+
+	// find scaling policy
+	name := d.Get("name")
+	for idx, sp := range resp.ScalingPolicies {
+		if *sp.PolicyName == name {
+			return resp.ScalingPolicies[idx], nil
+		}
+	}
+
+	// policy not found
+	return nil, nil
+}
diff --git a/builtin/providers/aws/resource_aws_autoscaling_policy_test.go b/builtin/providers/aws/resource_aws_autoscaling_policy_test.go
new file mode 100644
index 000000000..0a7aeff91
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_policy_test.go
@@ -0,0 +1,115 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSAutoscalingPolicy_basic(t *testing.T) {
+	var policy autoscaling.ScalingPolicy
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSAutoscalingPolicyDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSAutoscalingPolicyConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScalingPolicyExists("aws_autoscaling_policy.foobar", &policy),
+					resource.TestCheckResourceAttr("aws_autoscaling_policy.foobar", "adjustment_type", "ChangeInCapacity"),
+					resource.TestCheckResourceAttr("aws_autoscaling_policy.foobar", "cooldown", "300"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckScalingPolicyExists(n string, policy *autoscaling.ScalingPolicy) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			rs = rs
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		params := &autoscaling.DescribePoliciesInput{
+			AutoScalingGroupName: aws.String(rs.Primary.Attributes["autoscaling_group_name"]),
+			PolicyNames:          []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribePolicies(params)
+		if err != nil {
+			return err
+		}
+		if len(resp.ScalingPolicies) == 0 {
+			return fmt.Errorf("ScalingPolicy not found")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAWSAutoscalingPolicyDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_autoscaling_group" {
+			continue
+		}
+
+		params := autoscaling.DescribePoliciesInput{
+			AutoScalingGroupName: aws.String(rs.Primary.Attributes["autoscaling_group_name"]),
+			PolicyNames:          []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribePolicies(&params)
+
+		if err == nil {
+			if len(resp.ScalingPolicies) != 0 &&
+				*resp.ScalingPolicies[0].PolicyName == rs.Primary.ID {
+				return fmt.Errorf("Scaling Policy Still Exists: %s", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+var testAccAWSAutoscalingPolicyConfig = fmt.Sprintf(`
+resource "aws_launch_configuration" "foobar" {
+    name = "terraform-test-foobar5"
+    image_id = "ami-21f78e11"
+    instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "foobar" {
+    availability_zones = ["us-west-2a"]
+    name = "terraform-test-foobar5"
+    max_size = 5
+    min_size = 2
+    health_check_grace_period = 300
+    health_check_type = "ELB"
+    force_delete = true
+    termination_policies = ["OldestInstance"]
+    launch_configuration = "${aws_launch_configuration.foobar.name}"
+    tag {
+        key = "Foo"
+        value = "foo-bar"
+        propagate_at_launch = true
+    }
+}
+
+resource "aws_autoscaling_policy" "foobar" {
+    name = "foobar"
+    scaling_adjustment = 4
+    adjustment_type = "ChangeInCapacity"
+    cooldown = 300
+    autoscaling_group_name = "${aws_autoscaling_group.foobar.name}"
+}
+`)
diff --git a/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go
new file mode 100644
index 000000000..4c8b40140
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go
@@ -0,0 +1,288 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+)
+
+func resourceAwsCloudWatchMetricAlarm() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsCloudWatchMetricAlarmCreate,
+		Read:   resourceAwsCloudWatchMetricAlarmRead,
+		Update: resourceAwsCloudWatchMetricAlarmUpdate,
+		Delete: resourceAwsCloudWatchMetricAlarmDelete,
+
+		Schema: map[string]*schema.Schema{
+			"alarm_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"comparison_operator": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"evaluation_periods": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"metric_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"namespace": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"period": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"statistic": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"threshold": &schema.Schema{
+				Type:     schema.TypeFloat,
+				Required: true,
+			},
+			"actions_enabled": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+			},
+			"alarm_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"alarm_description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"dimensions": &schema.Schema{
+				Type:     schema.TypeMap,
+				Optional: true,
+			},
+			"insufficient_data_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"ok_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"unit": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+		},
+	}
+}
+
+func resourceAwsCloudWatchMetricAlarmCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudwatchconn
+
+	params := getAwsCloudWatchPutMetricAlarmInput(d)
+
+	log.Printf("[DEBUG] Creating CloudWatch Metric Alarm: %#v", params)
+	_, err := conn.PutMetricAlarm(&params)
+	if err != nil {
+		return fmt.Errorf("Creating metric alarm failed: %s", err)
+	}
+	d.SetId(d.Get("alarm_name").(string))
+	log.Println("[INFO] CloudWatch Metric Alarm created")
+
+	return resourceAwsCloudWatchMetricAlarmRead(d, meta)
+}
+
+func resourceAwsCloudWatchMetricAlarmRead(d *schema.ResourceData, meta interface{}) error {
+	a, err := getAwsCloudWatchMetricAlarm(d, meta)
+	if err != nil {
+		return err
+	}
+	if a == nil {
+		d.SetId("")
+		return nil
+	}
+
+	log.Printf("[DEBUG] Reading CloudWatch Metric Alarm: %s", d.Get("alarm_name"))
+
+	d.Set("actions_enabled", a.ActionsEnabled)
+
+	if err := d.Set("alarm_actions", _strArrPtrToList(a.AlarmActions)); err != nil {
+		log.Printf("[WARN] Error setting Alarm Actions: %s", err)
+	}
+	d.Set("alarm_description", a.AlarmDescription)
+	d.Set("alarm_name", a.AlarmName)
+	d.Set("comparison_operator", a.ComparisonOperator)
+	d.Set("dimensions", a.Dimensions)
+	d.Set("evaluation_periods", a.EvaluationPeriods)
+
+	if err := d.Set("insufficient_data_actions", _strArrPtrToList(a.InsufficientDataActions)); err != nil {
+		log.Printf("[WARN] Error setting Insufficient Data Actions: %s", err)
+	}
+	d.Set("metric_name", a.MetricName)
+	d.Set("namespace", a.Namespace)
+
+	if err := d.Set("ok_actions", _strArrPtrToList(a.OKActions)); err != nil {
+		log.Printf("[WARN] Error setting OK Actions: %s", err)
+	}
+	d.Set("period", a.Period)
+	d.Set("statistic", a.Statistic)
+	d.Set("threshold", a.Threshold)
+	d.Set("unit", a.Unit)
+
+	return nil
+}
+
+func resourceAwsCloudWatchMetricAlarmUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudwatchconn
+	params := getAwsCloudWatchPutMetricAlarmInput(d)
+
+	log.Printf("[DEBUG] Updating CloudWatch Metric Alarm: %#v", params)
+	_, err := conn.PutMetricAlarm(&params)
+	if err != nil {
+		return fmt.Errorf("Updating metric alarm failed: %s", err)
+	}
+	log.Println("[INFO] CloudWatch Metric Alarm updated")
+
+	return resourceAwsCloudWatchMetricAlarmRead(d, meta)
+}
+
+func resourceAwsCloudWatchMetricAlarmDelete(d *schema.ResourceData, meta interface{}) error {
+	p, err := getAwsCloudWatchMetricAlarm(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		log.Printf("[DEBUG] CloudWatch Metric Alarm %s is already gone", d.Id())
+		return nil
+	}
+
+	log.Printf("[INFO] Deleting CloudWatch Metric Alarm: %s", d.Id())
+
+	conn := meta.(*AWSClient).cloudwatchconn
+	params := cloudwatch.DeleteAlarmsInput{
+		AlarmNames: []*string{aws.String(d.Id())},
+	}
+
+	if _, err := conn.DeleteAlarms(&params); err != nil {
+		return fmt.Errorf("Error deleting CloudWatch Metric Alarm: %s", err)
+	}
+	log.Println("[INFO] CloudWatch Metric Alarm deleted")
+
+	d.SetId("")
+	return nil
+}
+
+func getAwsCloudWatchPutMetricAlarmInput(d *schema.ResourceData) cloudwatch.PutMetricAlarmInput {
+	params := cloudwatch.PutMetricAlarmInput{
+		AlarmName:          aws.String(d.Get("alarm_name").(string)),
+		ComparisonOperator: aws.String(d.Get("comparison_operator").(string)),
+		EvaluationPeriods:  aws.Long(int64(d.Get("evaluation_periods").(int))),
+		MetricName:         aws.String(d.Get("metric_name").(string)),
+		Namespace:          aws.String(d.Get("namespace").(string)),
+		Period:             aws.Long(int64(d.Get("period").(int))),
+		Statistic:          aws.String(d.Get("statistic").(string)),
+		Threshold:          aws.Double(d.Get("threshold").(float64)),
+	}
+
+	if v := d.Get("actions_enabled"); v != nil {
+		params.ActionsEnabled = aws.Boolean(v.(bool))
+	}
+
+	if v, ok := d.GetOk("alarm_description"); ok {
+		params.AlarmDescription = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("unit"); ok {
+		params.Unit = aws.String(v.(string))
+	}
+
+	var alarmActions []*string
+	if v := d.Get("alarm_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			alarmActions = append(alarmActions, aws.String(str))
+		}
+		params.AlarmActions = alarmActions
+	}
+
+	var insufficientDataActions []*string
+	if v := d.Get("insufficient_data_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			insufficientDataActions = append(insufficientDataActions, aws.String(str))
+		}
+		params.InsufficientDataActions = insufficientDataActions
+	}
+
+	var okActions []*string
+	if v := d.Get("ok_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			okActions = append(okActions, aws.String(str))
+		}
+		params.OKActions = okActions
+	}
+
+	a := d.Get("dimensions").(map[string]interface{})
+	dimensions := make([]*cloudwatch.Dimension, 0, len(a))
+	for k, v := range a {
+		dimensions = append(dimensions, &cloudwatch.Dimension{
+			Name:  aws.String(k),
+			Value: aws.String(v.(string)),
+		})
+	}
+	params.Dimensions = dimensions
+
+	return params
+}
+
+func getAwsCloudWatchMetricAlarm(d *schema.ResourceData, meta interface{}) (*cloudwatch.MetricAlarm, error) {
+	conn := meta.(*AWSClient).cloudwatchconn
+
+	params := cloudwatch.DescribeAlarmsInput{
+		AlarmNames: []*string{aws.String(d.Id())},
+	}
+
+	resp, err := conn.DescribeAlarms(&params)
+	if err != nil {
+		return nil, nil
+	}
+
+	// Find it and return it
+	for idx, ma := range resp.MetricAlarms {
+		if *ma.AlarmName == d.Id() {
+			return resp.MetricAlarms[idx], nil
+		}
+	}
+
+	return nil, nil
+}
+
+func _strArrPtrToList(strArrPtr []*string) []string {
+	var result []string
+	for _, elem := range strArrPtr {
+		result = append(result, *elem)
+	}
+	return result
+}
diff --git a/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go
new file mode 100644
index 000000000..8d9a53c36
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go
@@ -0,0 +1,95 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSCloudWatchMetricAlarm_basic(t *testing.T) {
+	var alarm cloudwatch.MetricAlarm
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSCloudWatchMetricAlarmDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSCloudWatchMetricAlarmConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudWatchMetricAlarmExists("aws_cloudwatch_metric_alarm.foobar", &alarm),
+					resource.TestCheckResourceAttr("aws_cloudwatch_metric_alarm.foobar", "metric_name", "CPUUtilization"),
+					resource.TestCheckResourceAttr("aws_cloudwatch_metric_alarm.foobar", "statistic", "Average"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudWatchMetricAlarmExists(n string, alarm *cloudwatch.MetricAlarm) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).cloudwatchconn
+		params := cloudwatch.DescribeAlarmsInput{
+			AlarmNames: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeAlarms(&params)
+		if err != nil {
+			return err
+		}
+		if len(resp.MetricAlarms) == 0 {
+			return fmt.Errorf("Alarm not found")
+		}
+		*alarm = *resp.MetricAlarms[0]
+
+		return nil
+	}
+}
+
+func testAccCheckAWSCloudWatchMetricAlarmDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).cloudwatchconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_cloudwatch_metric_alarm" {
+			continue
+		}
+
+		params := cloudwatch.DescribeAlarmsInput{
+			AlarmNames: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribeAlarms(&params)
+
+		if err == nil {
+			if len(resp.MetricAlarms) != 0 &&
+				*resp.MetricAlarms[0].AlarmName == rs.Primary.ID {
+				return fmt.Errorf("Alarm Still Exists: %s", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+var testAccAWSCloudWatchMetricAlarmConfig = fmt.Sprintf(`
+resource "aws_cloudwatch_metric_alarm" "foobar" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    insufficient_data_actions = []
+}
+`)
diff --git a/builtin/providers/aws/resource_aws_customer_gateway.go b/builtin/providers/aws/resource_aws_customer_gateway.go
index 9c18a53d9..fa4322304 100644
--- a/builtin/providers/aws/resource_aws_customer_gateway.go
+++ b/builtin/providers/aws/resource_aws_customer_gateway.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -82,7 +83,7 @@ func resourceAwsCustomerGatewayCreate(d *schema.ResourceData, meta interface{})
 	}
 
 	// Create tags.
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -100,7 +101,7 @@ func customerGatewayRefreshFunc(conn *ec2.EC2, gatewayId string) resource.StateR
 			Filters: []*ec2.Filter{gatewayFilter},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidCustomerGatewayID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidCustomerGatewayID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on CustomerGatewayRefresh: %s", err)
@@ -130,7 +131,7 @@ func resourceAwsCustomerGatewayRead(d *schema.ResourceData, meta interface{}) er
 		Filters: []*ec2.Filter{gatewayFilter},
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidCustomerGatewayID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidCustomerGatewayID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
@@ -147,7 +148,7 @@ func resourceAwsCustomerGatewayRead(d *schema.ResourceData, meta interface{}) er
 	d.Set("bgp_asn", customerGateway.BGPASN)
 	d.Set("ip_address", customerGateway.IPAddress)
 	d.Set("type", customerGateway.Type)
-	d.Set("tags", tagsToMapSDK(customerGateway.Tags))
+	d.Set("tags", tagsToMap(customerGateway.Tags))
 
 	return nil
 }
@@ -156,7 +157,7 @@ func resourceAwsCustomerGatewayUpdate(d *schema.ResourceData, meta interface{})
 	conn := meta.(*AWSClient).ec2conn
 
 	// Update tags if required.
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -172,7 +173,7 @@ func resourceAwsCustomerGatewayDelete(d *schema.ResourceData, meta interface{})
 		CustomerGatewayID: aws.String(d.Id()),
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidCustomerGatewayID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidCustomerGatewayID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
diff --git a/builtin/providers/aws/resource_aws_customer_gateway_test.go b/builtin/providers/aws/resource_aws_customer_gateway_test.go
index 2a51eb112..33e370946 100644
--- a/builtin/providers/aws/resource_aws_customer_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_customer_gateway_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccCustomerGateway(t *testing.T) {
+func TestAccCustomerGateway_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_db_instance.go b/builtin/providers/aws/resource_aws_db_instance.go
index 08334c448..47a98b73d 100644
--- a/builtin/providers/aws/resource_aws_db_instance.go
+++ b/builtin/providers/aws/resource_aws_db_instance.go
@@ -3,12 +3,14 @@ package aws
 import (
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/rds"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -25,6 +27,7 @@ func resourceAwsDbInstance() *schema.Resource {
 			"name": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
 			},
 
@@ -71,6 +74,26 @@ func resourceAwsDbInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only lowercase alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"first character of %q must be a letter", k))
+					}
+					if regexp.MustCompile(`--`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot contain two consecutive hyphens", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot end with a hyphen", k))
+					}
+					return
+				},
 			},
 
 			"instance_class": &schema.Schema{
@@ -88,7 +111,7 @@ func resourceAwsDbInstance() *schema.Resource {
 			"backup_retention_period": &schema.Schema{
 				Type:     schema.TypeInt,
 				Optional: true,
-				Default:  1,
+				Computed: true,
 			},
 
 			"backup_window": &schema.Schema{
@@ -102,6 +125,12 @@ func resourceAwsDbInstance() *schema.Resource {
 				Optional: true,
 			},
 
+			"license_model": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
 			"maintenance_window": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
@@ -145,6 +174,20 @@ func resourceAwsDbInstance() *schema.Resource {
 			"final_snapshot_identifier": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+						es = append(es, fmt.Errorf(
+							"only alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if regexp.MustCompile(`--`).MatchString(value) {
+						es = append(es, fmt.Errorf("%q cannot contain two consecutive hyphens", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						es = append(es, fmt.Errorf("%q cannot end in a hyphen", k))
+					}
+					return
+				},
 			},
 
 			"db_subnet_group_name": &schema.Schema{
@@ -184,6 +227,30 @@ func resourceAwsDbInstance() *schema.Resource {
 				Computed: true,
 			},
 
+			"replicate_source_db": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"replicas": &schema.Schema{
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+
+			"snapshot_identifier": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: false,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+
+			"auto_minor_version_upgrade": &schema.Schema{
+				Type:     schema.TypeBool,
+				Computed: false,
+				Optional: true,
+			},
+
 			"tags": tagsSchema(),
 		},
 	}
@@ -192,82 +259,173 @@ func resourceAwsDbInstance() *schema.Resource {
 func resourceAwsDbInstanceCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).rdsconn
 	tags := tagsFromMapRDS(d.Get("tags").(map[string]interface{}))
-	opts := rds.CreateDBInstanceInput{
-		AllocatedStorage:     aws.Long(int64(d.Get("allocated_storage").(int))),
-		DBInstanceClass:      aws.String(d.Get("instance_class").(string)),
-		DBInstanceIdentifier: aws.String(d.Get("identifier").(string)),
-		DBName:               aws.String(d.Get("name").(string)),
-		MasterUsername:       aws.String(d.Get("username").(string)),
-		MasterUserPassword:   aws.String(d.Get("password").(string)),
-		Engine:               aws.String(d.Get("engine").(string)),
-		EngineVersion:        aws.String(d.Get("engine_version").(string)),
-		StorageEncrypted:     aws.Boolean(d.Get("storage_encrypted").(bool)),
-		Tags:                 tags,
-	}
 
-	if attr, ok := d.GetOk("storage_type"); ok {
-		opts.StorageType = aws.String(attr.(string))
-	}
-
-	attr := d.Get("backup_retention_period")
-	opts.BackupRetentionPeriod = aws.Long(int64(attr.(int)))
-
-	if attr, ok := d.GetOk("iops"); ok {
-		opts.IOPS = aws.Long(int64(attr.(int)))
-	}
-
-	if attr, ok := d.GetOk("port"); ok {
-		opts.Port = aws.Long(int64(attr.(int)))
-	}
-
-	if attr, ok := d.GetOk("multi_az"); ok {
-		opts.MultiAZ = aws.Boolean(attr.(bool))
-	}
-
-	if attr, ok := d.GetOk("availability_zone"); ok {
-		opts.AvailabilityZone = aws.String(attr.(string))
-	}
-
-	if attr, ok := d.GetOk("maintenance_window"); ok {
-		opts.PreferredMaintenanceWindow = aws.String(attr.(string))
-	}
-
-	if attr, ok := d.GetOk("backup_window"); ok {
-		opts.PreferredBackupWindow = aws.String(attr.(string))
-	}
-
-	if attr, ok := d.GetOk("publicly_accessible"); ok {
-		opts.PubliclyAccessible = aws.Boolean(attr.(bool))
-	}
-
-	if attr, ok := d.GetOk("db_subnet_group_name"); ok {
-		opts.DBSubnetGroupName = aws.String(attr.(string))
-	}
-
-	if attr, ok := d.GetOk("parameter_group_name"); ok {
-		opts.DBParameterGroupName = aws.String(attr.(string))
-	}
-
-	if attr := d.Get("vpc_security_group_ids").(*schema.Set); attr.Len() > 0 {
-		var s []*string
-		for _, v := range attr.List() {
-			s = append(s, aws.String(v.(string)))
+	if v, ok := d.GetOk("replicate_source_db"); ok {
+		opts := rds.CreateDBInstanceReadReplicaInput{
+			SourceDBInstanceIdentifier: aws.String(v.(string)),
+			DBInstanceClass:            aws.String(d.Get("instance_class").(string)),
+			DBInstanceIdentifier:       aws.String(d.Get("identifier").(string)),
+			Tags:                       tags,
 		}
-		opts.VPCSecurityGroupIDs = s
-	}
-
-	if attr := d.Get("security_group_names").(*schema.Set); attr.Len() > 0 {
-		var s []*string
-		for _, v := range attr.List() {
-			s = append(s, aws.String(v.(string)))
+		if attr, ok := d.GetOk("iops"); ok {
+			opts.IOPS = aws.Long(int64(attr.(int)))
 		}
-		opts.DBSecurityGroups = s
-	}
 
-	log.Printf("[DEBUG] DB Instance create configuration: %#v", opts)
-	_, err := conn.CreateDBInstance(&opts)
-	if err != nil {
-		return fmt.Errorf("Error creating DB Instance: %s", err)
+		if attr, ok := d.GetOk("port"); ok {
+			opts.Port = aws.Long(int64(attr.(int)))
+		}
+
+		if attr, ok := d.GetOk("availability_zone"); ok {
+			opts.AvailabilityZone = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("publicly_accessible"); ok {
+			opts.PubliclyAccessible = aws.Boolean(attr.(bool))
+		}
+		_, err := conn.CreateDBInstanceReadReplica(&opts)
+		if err != nil {
+			return fmt.Errorf("Error creating DB Instance: %s", err)
+		}
+	} else if _, ok := d.GetOk("snapshot_identifier"); ok {
+		opts := rds.RestoreDBInstanceFromDBSnapshotInput{
+			DBInstanceClass:      aws.String(d.Get("instance_class").(string)),
+			DBInstanceIdentifier: aws.String(d.Get("identifier").(string)),
+			DBSnapshotIdentifier: aws.String(d.Get("snapshot_identifier").(string)),
+			Tags:                 tags,
+		}
+
+		if attr, ok := d.GetOk("auto_minor_version_upgrade"); ok {
+			opts.AutoMinorVersionUpgrade = aws.Boolean(attr.(bool))
+		}
+
+		if attr, ok := d.GetOk("availability_zone"); ok {
+			opts.AvailabilityZone = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("db_subnet_group_name"); ok {
+			opts.DBSubnetGroupName = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("engine"); ok {
+			opts.Engine = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("iops"); ok {
+			opts.IOPS = aws.Long(int64(attr.(int)))
+		}
+
+		if attr, ok := d.GetOk("license_model"); ok {
+			opts.LicenseModel = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("multi_az"); ok {
+			opts.MultiAZ = aws.Boolean(attr.(bool))
+		}
+
+		if attr, ok := d.GetOk("option_group_name"); ok {
+			opts.OptionGroupName = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("port"); ok {
+			opts.Port = aws.Long(int64(attr.(int)))
+		}
+
+		if attr, ok := d.GetOk("publicly_accessible"); ok {
+			opts.PubliclyAccessible = aws.Boolean(attr.(bool))
+		}
+
+		if attr, ok := d.GetOk("tde_credential_arn"); ok {
+			opts.TDECredentialARN = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("storage_type"); ok {
+			opts.StorageType = aws.String(attr.(string))
+		}
+
+		_, err := conn.RestoreDBInstanceFromDBSnapshot(&opts)
+		if err != nil {
+			return fmt.Errorf("Error creating DB Instance: %s", err)
+		}
+	} else {
+		opts := rds.CreateDBInstanceInput{
+			AllocatedStorage:     aws.Long(int64(d.Get("allocated_storage").(int))),
+			DBName:               aws.String(d.Get("name").(string)),
+			DBInstanceClass:      aws.String(d.Get("instance_class").(string)),
+			DBInstanceIdentifier: aws.String(d.Get("identifier").(string)),
+			MasterUsername:       aws.String(d.Get("username").(string)),
+			MasterUserPassword:   aws.String(d.Get("password").(string)),
+			Engine:               aws.String(d.Get("engine").(string)),
+			EngineVersion:        aws.String(d.Get("engine_version").(string)),
+			StorageEncrypted:     aws.Boolean(d.Get("storage_encrypted").(bool)),
+			Tags:                 tags,
+		}
+
+		attr := d.Get("backup_retention_period")
+		opts.BackupRetentionPeriod = aws.Long(int64(attr.(int)))
+		if attr, ok := d.GetOk("multi_az"); ok {
+			opts.MultiAZ = aws.Boolean(attr.(bool))
+		}
+
+		if attr, ok := d.GetOk("maintenance_window"); ok {
+			opts.PreferredMaintenanceWindow = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("backup_window"); ok {
+			opts.PreferredBackupWindow = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("license_model"); ok {
+			opts.LicenseModel = aws.String(attr.(string))
+		}
+		if attr, ok := d.GetOk("parameter_group_name"); ok {
+			opts.DBParameterGroupName = aws.String(attr.(string))
+		}
+
+		if attr := d.Get("vpc_security_group_ids").(*schema.Set); attr.Len() > 0 {
+			var s []*string
+			for _, v := range attr.List() {
+				s = append(s, aws.String(v.(string)))
+			}
+			opts.VPCSecurityGroupIDs = s
+		}
+
+		if attr := d.Get("security_group_names").(*schema.Set); attr.Len() > 0 {
+			var s []*string
+			for _, v := range attr.List() {
+				s = append(s, aws.String(v.(string)))
+			}
+			opts.DBSecurityGroups = s
+		}
+		if attr, ok := d.GetOk("storage_type"); ok {
+			opts.StorageType = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("db_subnet_group_name"); ok {
+			opts.DBSubnetGroupName = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("iops"); ok {
+			opts.IOPS = aws.Long(int64(attr.(int)))
+		}
+
+		if attr, ok := d.GetOk("port"); ok {
+			opts.Port = aws.Long(int64(attr.(int)))
+		}
+
+		if attr, ok := d.GetOk("availability_zone"); ok {
+			opts.AvailabilityZone = aws.String(attr.(string))
+		}
+
+		if attr, ok := d.GetOk("publicly_accessible"); ok {
+			opts.PubliclyAccessible = aws.Boolean(attr.(bool))
+		}
+
+		log.Printf("[DEBUG] DB Instance create configuration: %#v", opts)
+		var err error
+		_, err = conn.CreateDBInstance(&opts)
+		if err != nil {
+			return fmt.Errorf("Error creating DB Instance: %s", err)
+		}
 	}
 
 	d.SetId(d.Get("identifier").(string))
@@ -287,7 +445,7 @@ func resourceAwsDbInstanceCreate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	// Wait, catching any errors
-	_, err = stateConf.WaitForState()
+	_, err := stateConf.WaitForState()
 	if err != nil {
 		return err
 	}
@@ -316,6 +474,7 @@ func resourceAwsDbInstanceRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("availability_zone", v.AvailabilityZone)
 	d.Set("backup_retention_period", v.BackupRetentionPeriod)
 	d.Set("backup_window", v.PreferredBackupWindow)
+	d.Set("license_model", v.LicenseModel)
 	d.Set("maintenance_window", v.PreferredMaintenanceWindow)
 	d.Set("multi_az", v.MultiAZ)
 	if v.DBSubnetGroup != nil {
@@ -384,6 +543,18 @@ func resourceAwsDbInstanceRead(d *schema.ResourceData, meta interface{}) error {
 	}
 	d.Set("security_group_names", sgn)
 
+	// replica things
+
+	var replicas []string
+	for _, v := range v.ReadReplicaDBInstanceIdentifiers {
+		replicas = append(replicas, *v)
+	}
+	if err := d.Set("replicas", replicas); err != nil {
+		return fmt.Errorf("[DEBUG] Error setting replicas attribute: %#v, error: %#v", replicas, err)
+	}
+
+	d.Set("replicate_source_db", v.ReadReplicaSourceDBInstanceIdentifier)
+
 	return nil
 }
 
@@ -523,6 +694,28 @@ func resourceAwsDbInstanceUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
+	// seperate request to promote a database
+	if d.HasChange("replicate_source_db") {
+		if d.Get("replicate_source_db").(string) == "" {
+			// promote
+			opts := rds.PromoteReadReplicaInput{
+				DBInstanceIdentifier: aws.String(d.Id()),
+			}
+			attr := d.Get("backup_retention_period")
+			opts.BackupRetentionPeriod = aws.Long(int64(attr.(int)))
+			if attr, ok := d.GetOk("backup_window"); ok {
+				opts.PreferredBackupWindow = aws.String(attr.(string))
+			}
+			_, err := conn.PromoteReadReplica(&opts)
+			if err != nil {
+				return fmt.Errorf("Error promoting database: %#v", err)
+			}
+			d.Set("replicate_source_db", "")
+		} else {
+			return fmt.Errorf("cannot elect new source database for replication")
+		}
+	}
+
 	if arn, err := buildRDSARN(d, meta); err == nil {
 		if err := setTagsRDS(conn, d, arn); err != nil {
 			return err
@@ -547,8 +740,8 @@ func resourceAwsDbInstanceRetrieve(
 	resp, err := conn.DescribeDBInstances(&opts)
 
 	if err != nil {
-		dbinstanceerr, ok := err.(aws.APIError)
-		if ok && dbinstanceerr.Code == "DBInstanceNotFound" {
+		dbinstanceerr, ok := err.(awserr.Error)
+		if ok && dbinstanceerr.Code() == "DBInstanceNotFound" {
 			return nil, nil
 		}
 		return nil, fmt.Errorf("Error retrieving DB Instances: %s", err)
@@ -578,6 +771,10 @@ func resourceAwsDbInstanceStateRefreshFunc(
 			return nil, "", nil
 		}
 
+		if v.DBInstanceStatus != nil {
+			log.Printf("[DEBUG] DB Instance status for instance %s: %s", d.Id(), *v.DBInstanceStatus)
+		}
+
 		return v, *v.DBInstanceStatus, nil
 	}
 }
diff --git a/builtin/providers/aws/resource_aws_db_instance_test.go b/builtin/providers/aws/resource_aws_db_instance_test.go
index 8ec645697..ef1931b03 100644
--- a/builtin/providers/aws/resource_aws_db_instance_test.go
+++ b/builtin/providers/aws/resource_aws_db_instance_test.go
@@ -9,11 +9,12 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
-func TestAccAWSDBInstance(t *testing.T) {
+func TestAccAWSDBInstance_basic(t *testing.T) {
 	var v rds.DBInstance
 
 	resource.Test(t, resource.TestCase{
@@ -32,6 +33,8 @@ func TestAccAWSDBInstance(t *testing.T) {
 						"aws_db_instance.bar", "engine", "mysql"),
 					resource.TestCheckResourceAttr(
 						"aws_db_instance.bar", "engine_version", "5.6.21"),
+					resource.TestCheckResourceAttr(
+						"aws_db_instance.bar", "license_model", "general-public-license"),
 					resource.TestCheckResourceAttr(
 						"aws_db_instance.bar", "instance_class", "db.t1.micro"),
 					resource.TestCheckResourceAttr(
@@ -46,6 +49,26 @@ func TestAccAWSDBInstance(t *testing.T) {
 	})
 }
 
+func TestAccAWSDBInstanceReplica(t *testing.T) {
+	var s, r rds.DBInstance
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSDBInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccReplicaInstanceConfig(rand.New(rand.NewSource(time.Now().UnixNano())).Int()),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSDBInstanceExists("aws_db_instance.bar", &s),
+					testAccCheckAWSDBInstanceExists("aws_db_instance.replica", &r),
+					testAccCheckAWSDBInstanceReplicaAttributes(&s, &r),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSDBInstanceDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).rdsconn
 
@@ -55,6 +78,7 @@ func testAccCheckAWSDBInstanceDestroy(s *terraform.State) error {
 		}
 
 		// Try to find the Group
+		var err error
 		resp, err := conn.DescribeDBInstances(
 			&rds.DescribeDBInstancesInput{
 				DBInstanceIdentifier: aws.String(rs.Primary.ID),
@@ -68,11 +92,11 @@ func testAccCheckAWSDBInstanceDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		newerr, ok := err.(*aws.APIError)
+		newerr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if newerr.Code != "InvalidDBInstance.NotFound" {
+		if newerr.Code() != "InvalidDBInstance.NotFound" {
 			return err
 		}
 	}
@@ -99,6 +123,17 @@ func testAccCheckAWSDBInstanceAttributes(v *rds.DBInstance) resource.TestCheckFu
 	}
 }
 
+func testAccCheckAWSDBInstanceReplicaAttributes(source, replica *rds.DBInstance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if replica.ReadReplicaSourceDBInstanceIdentifier != nil && *replica.ReadReplicaSourceDBInstanceIdentifier != *source.DBInstanceIdentifier {
+			return fmt.Errorf("bad source identifier for replica, expected: '%s', got: '%s'", *source.DBInstanceIdentifier, *replica.ReadReplicaSourceDBInstanceIdentifier)
+		}
+
+		return nil
+	}
+}
+
 func testAccCheckAWSDBInstanceExists(n string, v *rds.DBInstance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -152,3 +187,38 @@ resource "aws_db_instance" "bar" {
 
 	parameter_group_name = "default.mysql5.6"
 }`, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
+
+func testAccReplicaInstanceConfig(val int) string {
+	return fmt.Sprintf(`
+	resource "aws_db_instance" "bar" {
+		identifier = "foobarbaz-test-terraform-%d"
+
+		allocated_storage = 5
+		engine = "mysql"
+		engine_version = "5.6.21"
+		instance_class = "db.t1.micro"
+		name = "baz"
+		password = "barbarbarbar"
+		username = "foo"
+
+		backup_retention_period = 1
+
+		parameter_group_name = "default.mysql5.6"
+	}
+	
+	resource "aws_db_instance" "replica" {
+	  identifier = "tf-replica-db-%d"
+		backup_retention_period = 0
+		replicate_source_db = "${aws_db_instance.bar.identifier}"
+		allocated_storage = "${aws_db_instance.bar.allocated_storage}"
+		engine = "${aws_db_instance.bar.engine}"
+		engine_version = "${aws_db_instance.bar.engine_version}"
+		instance_class = "${aws_db_instance.bar.instance_class}"
+		password = "${aws_db_instance.bar.password}"
+		username = "${aws_db_instance.bar.username}"
+		tags {
+			Name = "tf-replica-db"
+		}
+	}
+	`, val, val)
+}
diff --git a/builtin/providers/aws/resource_aws_db_parameter_group.go b/builtin/providers/aws/resource_aws_db_parameter_group.go
index 0757a9681..9489394dc 100644
--- a/builtin/providers/aws/resource_aws_db_parameter_group.go
+++ b/builtin/providers/aws/resource_aws_db_parameter_group.go
@@ -11,8 +11,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
 func resourceAwsDbParameterGroup() *schema.Resource {
@@ -203,12 +204,12 @@ func resourceAwsDbParameterGroupDeleteRefreshFunc(
 		}
 
 		if _, err := rdsconn.DeleteDBParameterGroup(&deleteOpts); err != nil {
-			rdserr, ok := err.(aws.APIError)
+			rdserr, ok := err.(awserr.Error)
 			if !ok {
 				return d, "error", err
 			}
 
-			if rdserr.Code != "DBParameterGroupNotFoundFault" {
+			if rdserr.Code() != "DBParameterGroupNotFoundFault" {
 				return d, "error", err
 			}
 		}
diff --git a/builtin/providers/aws/resource_aws_db_parameter_group_test.go b/builtin/providers/aws/resource_aws_db_parameter_group_test.go
index 593b38957..93e74bb74 100644
--- a/builtin/providers/aws/resource_aws_db_parameter_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_parameter_group_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDBParameterGroup(t *testing.T) {
+func TestAccAWSDBParameterGroup_basic(t *testing.T) {
 	var v rds.DBParameterGroup
 
 	resource.Test(t, resource.TestCase{
@@ -127,11 +128,11 @@ func testAccCheckAWSDBParameterGroupDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		newerr, ok := err.(aws.APIError)
+		newerr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if newerr.Code != "InvalidDBParameterGroup.NotFound" {
+		if newerr.Code() != "InvalidDBParameterGroup.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_db_security_group.go b/builtin/providers/aws/resource_aws_db_security_group.go
index 818999ce0..be535713d 100644
--- a/builtin/providers/aws/resource_aws_db_security_group.go
+++ b/builtin/providers/aws/resource_aws_db_security_group.go
@@ -6,8 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/multierror"
 	"github.com/hashicorp/terraform/helper/resource"
@@ -170,8 +171,8 @@ func resourceAwsDbSecurityGroupDelete(d *schema.ResourceData, meta interface{})
 	_, err := conn.DeleteDBSecurityGroup(&opts)
 
 	if err != nil {
-		newerr, ok := err.(aws.APIError)
-		if ok && newerr.Code == "InvalidDBSecurityGroup.NotFound" {
+		newerr, ok := err.(awserr.Error)
+		if ok && newerr.Code() == "InvalidDBSecurityGroup.NotFound" {
 			return nil
 		}
 		return err
diff --git a/builtin/providers/aws/resource_aws_db_security_group_test.go b/builtin/providers/aws/resource_aws_db_security_group_test.go
index c7b8d2d1e..bf1db6e37 100644
--- a/builtin/providers/aws/resource_aws_db_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_security_group_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDBSecurityGroup(t *testing.T) {
+func TestAccAWSDBSecurityGroup_basic(t *testing.T) {
 	var v rds.DBSecurityGroup
 
 	resource.Test(t, resource.TestCase{
@@ -59,11 +60,11 @@ func testAccCheckAWSDBSecurityGroupDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		newerr, ok := err.(aws.APIError)
+		newerr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if newerr.Code != "InvalidDBSecurityGroup.NotFound" {
+		if newerr.Code() != "InvalidDBSecurityGroup.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_db_subnet_group.go b/builtin/providers/aws/resource_aws_db_subnet_group.go
index 286099ac6..bde90aba7 100644
--- a/builtin/providers/aws/resource_aws_db_subnet_group.go
+++ b/builtin/providers/aws/resource_aws_db_subnet_group.go
@@ -3,11 +3,13 @@ package aws
 import (
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -23,6 +25,22 @@ func resourceAwsDbSubnetGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				ForceNew: true,
 				Required: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[.0-9A-Za-z-_]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only alphanumeric characters, hyphens, underscores, and periods allowed in %q", k))
+					}
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					if regexp.MustCompile(`(?i)^default$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q is not allowed as %q", "Default", k))
+					}
+					return
+				},
 			},
 
 			"description": &schema.Schema{
@@ -77,7 +95,7 @@ func resourceAwsDbSubnetGroupRead(d *schema.ResourceData, meta interface{}) erro
 
 	describeResp, err := rdsconn.DescribeDBSubnetGroups(&describeOpts)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "DBSubnetGroupNotFoundFault" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "DBSubnetGroupNotFoundFault" {
 			// Update state to indicate the db subnet no longer exists.
 			d.SetId("")
 			return nil
@@ -139,12 +157,12 @@ func resourceAwsDbSubnetGroupDeleteRefreshFunc(
 		}
 
 		if _, err := rdsconn.DeleteDBSubnetGroup(&deleteOpts); err != nil {
-			rdserr, ok := err.(aws.APIError)
+			rdserr, ok := err.(awserr.Error)
 			if !ok {
 				return d, "error", err
 			}
 
-			if rdserr.Code != "DBSubnetGroupNotFoundFault" {
+			if rdserr.Code() != "DBSubnetGroupNotFoundFault" {
 				return d, "error", err
 			}
 		}
diff --git a/builtin/providers/aws/resource_aws_db_subnet_group_test.go b/builtin/providers/aws/resource_aws_db_subnet_group_test.go
index 89bf27c77..cbf1f8497 100644
--- a/builtin/providers/aws/resource_aws_db_subnet_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_subnet_group_test.go
@@ -7,11 +7,12 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
-func TestAccAWSDBSubnetGroup(t *testing.T) {
+func TestAccAWSDBSubnetGroup_basic(t *testing.T) {
 	var v rds.DBSubnetGroup
 
 	testCheck := func(*terraform.State) error {
@@ -35,6 +36,34 @@ func TestAccAWSDBSubnetGroup(t *testing.T) {
 	})
 }
 
+// Regression test for https://github.com/hashicorp/terraform/issues/2603 and
+// https://github.com/hashicorp/terraform/issues/2664
+func TestAccAWSDBSubnetGroup_withUndocumentedCharacters(t *testing.T) {
+	var v rds.DBSubnetGroup
+
+	testCheck := func(*terraform.State) error {
+		return nil
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckDBSubnetGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccDBSubnetGroupConfig_withUnderscoresAndPeriods,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDBSubnetGroupExists(
+						"aws_db_subnet_group.underscores", &v),
+					testAccCheckDBSubnetGroupExists(
+						"aws_db_subnet_group.periods", &v),
+					testCheck,
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckDBSubnetGroupDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).rdsconn
 
@@ -55,11 +84,11 @@ func testAccCheckDBSubnetGroupDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		rdserr, ok := err.(aws.APIError)
+		rdserr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if rdserr.Code != "DBSubnetGroupNotFoundFault" {
+		if rdserr.Code() != "DBSubnetGroupNotFoundFault" {
 			return err
 		}
 	}
@@ -123,3 +152,33 @@ resource "aws_db_subnet_group" "foo" {
 	subnet_ids = ["${aws_subnet.foo.id}", "${aws_subnet.bar.id}"]
 }
 `
+
+const testAccDBSubnetGroupConfig_withUnderscoresAndPeriods = `
+resource "aws_vpc" "main" {
+    cidr_block = "192.168.0.0/16"
+}
+
+resource "aws_subnet" "frontend" {
+    vpc_id = "${aws_vpc.main.id}"
+    availability_zone = "us-west-2b"
+    cidr_block = "192.168.1.0/24"
+}
+
+resource "aws_subnet" "backend" {
+    vpc_id = "${aws_vpc.main.id}"
+    availability_zone = "us-west-2c"
+    cidr_block = "192.168.2.0/24"
+}
+
+resource "aws_db_subnet_group" "underscores" {
+    name = "with_underscores"
+    description = "Our main group of subnets"
+    subnet_ids = ["${aws_subnet.frontend.id}", "${aws_subnet.backend.id}"]
+}
+
+resource "aws_db_subnet_group" "periods" {
+    name = "with.periods"
+    description = "Our main group of subnets"
+    subnet_ids = ["${aws_subnet.frontend.id}", "${aws_subnet.backend.id}"]
+}
+`
diff --git a/builtin/providers/aws/resource_aws_dynamodb_table.go b/builtin/providers/aws/resource_aws_dynamodb_table.go
new file mode 100644
index 000000000..9a860768e
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_dynamodb_table.go
@@ -0,0 +1,735 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/hashicorp/terraform/helper/hashcode"
+)
+
+// Number of times to retry if a throttling-related exception occurs
+const DYNAMODB_MAX_THROTTLE_RETRIES = 5
+
+// How long to sleep when a throttle-event happens
+const DYNAMODB_THROTTLE_SLEEP = 5 * time.Second
+
+// How long to sleep if a limit-exceeded event happens
+const DYNAMODB_LIMIT_EXCEEDED_SLEEP = 10 * time.Second
+
+// A number of these are marked as computed because if you don't
+// provide a value, DynamoDB will provide you with defaults (which are the
+// default values specified below)
+func resourceAwsDynamoDbTable() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsDynamoDbTableCreate,
+		Read:   resourceAwsDynamoDbTableRead,
+		Update: resourceAwsDynamoDbTableUpdate,
+		Delete: resourceAwsDynamoDbTableDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"hash_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"range_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"write_capacity": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"read_capacity": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"attribute": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					return hashcode.String(buf.String())
+				},
+			},
+			"local_secondary_index": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"range_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"projection_type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"non_key_attributes": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					return hashcode.String(buf.String())
+				},
+			},
+			"global_secondary_index": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"write_capacity": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"read_capacity": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"hash_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"range_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"projection_type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"non_key_attributes": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+				// GSI names are the uniqueness constraint
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					buf.WriteString(fmt.Sprintf("%d-", m["write_capacity"].(int)))
+					buf.WriteString(fmt.Sprintf("%d-", m["read_capacity"].(int)))
+					return hashcode.String(buf.String())
+				},
+			},
+		},
+	}
+}
+
+func resourceAwsDynamoDbTableCreate(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	name := d.Get("name").(string)
+
+	log.Printf("[DEBUG] DynamoDB table create: %s", name)
+
+	throughput := &dynamodb.ProvisionedThroughput{
+		ReadCapacityUnits:  aws.Long(int64(d.Get("read_capacity").(int))),
+		WriteCapacityUnits: aws.Long(int64(d.Get("write_capacity").(int))),
+	}
+
+	hash_key_name := d.Get("hash_key").(string)
+	keyschema := []*dynamodb.KeySchemaElement{
+		&dynamodb.KeySchemaElement{
+			AttributeName: aws.String(hash_key_name),
+			KeyType:       aws.String("HASH"),
+		},
+	}
+
+	if range_key, ok := d.GetOk("range_key"); ok {
+		range_schema_element := &dynamodb.KeySchemaElement{
+			AttributeName: aws.String(range_key.(string)),
+			KeyType:       aws.String("RANGE"),
+		}
+		keyschema = append(keyschema, range_schema_element)
+	}
+
+	req := &dynamodb.CreateTableInput{
+		TableName:             aws.String(name),
+		ProvisionedThroughput: throughput,
+		KeySchema:             keyschema,
+	}
+
+	if attributedata, ok := d.GetOk("attribute"); ok {
+		attributes := []*dynamodb.AttributeDefinition{}
+		attributeSet := attributedata.(*schema.Set)
+		for _, attribute := range attributeSet.List() {
+			attr := attribute.(map[string]interface{})
+			attributes = append(attributes, &dynamodb.AttributeDefinition{
+				AttributeName: aws.String(attr["name"].(string)),
+				AttributeType: aws.String(attr["type"].(string)),
+			})
+		}
+
+		req.AttributeDefinitions = attributes
+	}
+
+	if lsidata, ok := d.GetOk("local_secondary_index"); ok {
+		fmt.Printf("[DEBUG] Adding LSI data to the table")
+
+		lsiSet := lsidata.(*schema.Set)
+		localSecondaryIndexes := []*dynamodb.LocalSecondaryIndex{}
+		for _, lsiObject := range lsiSet.List() {
+			lsi := lsiObject.(map[string]interface{})
+
+			projection := &dynamodb.Projection{
+				ProjectionType: aws.String(lsi["projection_type"].(string)),
+			}
+
+			if lsi["projection_type"] == "INCLUDE" {
+				non_key_attributes := []*string{}
+				for _, attr := range lsi["non_key_attributes"].([]interface{}) {
+					non_key_attributes = append(non_key_attributes, aws.String(attr.(string)))
+				}
+				projection.NonKeyAttributes = non_key_attributes
+			}
+
+			localSecondaryIndexes = append(localSecondaryIndexes, &dynamodb.LocalSecondaryIndex{
+				IndexName: aws.String(lsi["name"].(string)),
+				KeySchema: []*dynamodb.KeySchemaElement{
+					&dynamodb.KeySchemaElement{
+						AttributeName: aws.String(hash_key_name),
+						KeyType:       aws.String("HASH"),
+					},
+					&dynamodb.KeySchemaElement{
+						AttributeName: aws.String(lsi["range_key"].(string)),
+						KeyType:       aws.String("RANGE"),
+					},
+				},
+				Projection: projection,
+			})
+		}
+
+		req.LocalSecondaryIndexes = localSecondaryIndexes
+
+		fmt.Printf("[DEBUG] Added %d LSI definitions", len(localSecondaryIndexes))
+	}
+
+	if gsidata, ok := d.GetOk("global_secondary_index"); ok {
+		globalSecondaryIndexes := []*dynamodb.GlobalSecondaryIndex{}
+
+		gsiSet := gsidata.(*schema.Set)
+		for _, gsiObject := range gsiSet.List() {
+			gsi := gsiObject.(map[string]interface{})
+			gsiObject := createGSIFromData(&gsi)
+			globalSecondaryIndexes = append(globalSecondaryIndexes, &gsiObject)
+		}
+		req.GlobalSecondaryIndexes = globalSecondaryIndexes
+	}
+
+	attemptCount := 1
+	for attemptCount <= DYNAMODB_MAX_THROTTLE_RETRIES {
+		output, err := dynamodbconn.CreateTable(req)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Code() == "ThrottlingException" {
+					log.Printf("[DEBUG] Attempt %d/%d: Sleeping for a bit to throttle back create request", attemptCount, DYNAMODB_MAX_THROTTLE_RETRIES)
+					time.Sleep(DYNAMODB_THROTTLE_SLEEP)
+					attemptCount += 1
+				} else if awsErr.Code() == "LimitExceededException" {
+					log.Printf("[DEBUG] Limit on concurrent table creations hit, sleeping for a bit")
+					time.Sleep(DYNAMODB_LIMIT_EXCEEDED_SLEEP)
+					attemptCount += 1
+				} else {
+					// Some other non-retryable exception occurred
+					return fmt.Errorf("AWS Error creating DynamoDB table: %s", err)
+				}
+			} else {
+				// Non-AWS exception occurred, give up
+				return fmt.Errorf("Error creating DynamoDB table: %s", err)
+			}
+		} else {
+			// No error, set ID and return
+			d.SetId(*output.TableDescription.TableName)
+			return nil
+		}
+	}
+
+	// Too many throttling events occurred, give up
+	return fmt.Errorf("Unable to create DynamoDB table '%s' after %d attempts", name, attemptCount)
+}
+
+func resourceAwsDynamoDbTableUpdate(d *schema.ResourceData, meta interface{}) error {
+
+	log.Printf("[DEBUG] Updating DynamoDB table %s", d.Id())
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	// Ensure table is active before trying to update
+	waitForTableToBeActive(d.Id(), meta)
+
+	// LSI can only be done at create-time, abort if it's been changed
+	if d.HasChange("local_secondary_index") {
+		return fmt.Errorf("Local secondary indexes can only be built at creation, you cannot update them!")
+	}
+
+	if d.HasChange("hash_key") {
+		return fmt.Errorf("Hash key can only be specified at creation, you cannot modify it.")
+	}
+
+	if d.HasChange("range_key") {
+		return fmt.Errorf("Range key can only be specified at creation, you cannot modify it.")
+	}
+
+	if d.HasChange("read_capacity") || d.HasChange("write_capacity") {
+		req := &dynamodb.UpdateTableInput{
+			TableName: aws.String(d.Id()),
+		}
+
+		throughput := &dynamodb.ProvisionedThroughput{
+			ReadCapacityUnits:  aws.Long(int64(d.Get("read_capacity").(int))),
+			WriteCapacityUnits: aws.Long(int64(d.Get("write_capacity").(int))),
+		}
+		req.ProvisionedThroughput = throughput
+
+		_, err := dynamodbconn.UpdateTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		waitForTableToBeActive(d.Id(), meta)
+	}
+
+	if d.HasChange("global_secondary_index") {
+		log.Printf("[DEBUG] Changed GSI data")
+		req := &dynamodb.UpdateTableInput{
+			TableName: aws.String(d.Id()),
+		}
+
+		o, n := d.GetChange("global_secondary_index")
+
+		oldSet := o.(*schema.Set)
+		newSet := n.(*schema.Set)
+
+		// Track old names so we can know which ones we need to just update based on
+		// capacity changes, terraform appears to only diff on the set hash, not the
+		// contents so we need to make sure we don't delete any indexes that we
+		// just want to update the capacity for
+		oldGsiNameSet := make(map[string]bool)
+		newGsiNameSet := make(map[string]bool)
+
+		for _, gsidata := range oldSet.List() {
+			gsiName := gsidata.(map[string]interface{})["name"].(string)
+			oldGsiNameSet[gsiName] = true
+		}
+
+		for _, gsidata := range newSet.List() {
+			gsiName := gsidata.(map[string]interface{})["name"].(string)
+			newGsiNameSet[gsiName] = true
+		}
+
+		// First determine what's new
+		for _, newgsidata := range newSet.List() {
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+			newGsiName := newgsidata.(map[string]interface{})["name"].(string)
+			if _, exists := oldGsiNameSet[newGsiName]; !exists {
+				attributes := []*dynamodb.AttributeDefinition{}
+				gsidata := newgsidata.(map[string]interface{})
+				gsi := createGSIFromData(&gsidata)
+				log.Printf("[DEBUG] Adding GSI %s", *gsi.IndexName)
+				update := &dynamodb.GlobalSecondaryIndexUpdate{
+					Create: &dynamodb.CreateGlobalSecondaryIndexAction{
+						IndexName:             gsi.IndexName,
+						KeySchema:             gsi.KeySchema,
+						ProvisionedThroughput: gsi.ProvisionedThroughput,
+						Projection:            gsi.Projection,
+					},
+				}
+				updates = append(updates, update)
+
+				// Hash key is required, range key isn't
+				hashkey_type, err := getAttributeType(d, *(gsi.KeySchema[0].AttributeName))
+				if err != nil {
+					return err
+				}
+
+				attributes = append(attributes, &dynamodb.AttributeDefinition{
+					AttributeName: gsi.KeySchema[0].AttributeName,
+					AttributeType: aws.String(hashkey_type),
+				})
+
+				// If there's a range key, there will be 2 elements in KeySchema
+				if len(gsi.KeySchema) == 2 {
+					rangekey_type, err := getAttributeType(d, *(gsi.KeySchema[1].AttributeName))
+					if err != nil {
+						return err
+					}
+
+					attributes = append(attributes, &dynamodb.AttributeDefinition{
+						AttributeName: gsi.KeySchema[1].AttributeName,
+						AttributeType: aws.String(rangekey_type),
+					})
+				}
+
+				req.AttributeDefinitions = attributes
+				req.GlobalSecondaryIndexUpdates = updates
+				_, err = dynamodbconn.UpdateTable(req)
+
+				if err != nil {
+					return err
+				}
+
+				waitForTableToBeActive(d.Id(), meta)
+				waitForGSIToBeActive(d.Id(), *gsi.IndexName, meta)
+
+			}
+		}
+
+		for _, oldgsidata := range oldSet.List() {
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+			oldGsiName := oldgsidata.(map[string]interface{})["name"].(string)
+			if _, exists := newGsiNameSet[oldGsiName]; !exists {
+				gsidata := oldgsidata.(map[string]interface{})
+				log.Printf("[DEBUG] Deleting GSI %s", gsidata["name"].(string))
+				update := &dynamodb.GlobalSecondaryIndexUpdate{
+					Delete: &dynamodb.DeleteGlobalSecondaryIndexAction{
+						IndexName: aws.String(gsidata["name"].(string)),
+					},
+				}
+				updates = append(updates, update)
+
+				req.GlobalSecondaryIndexUpdates = updates
+				_, err := dynamodbconn.UpdateTable(req)
+
+				if err != nil {
+					return err
+				}
+
+				waitForTableToBeActive(d.Id(), meta)
+			}
+		}
+	}
+
+	// Update any out-of-date read / write capacity
+	if gsiObjects, ok := d.GetOk("global_secondary_index"); ok {
+		gsiSet := gsiObjects.(*schema.Set)
+		if len(gsiSet.List()) > 0 {
+			log.Printf("Updating capacity as needed!")
+
+			// We can only change throughput, but we need to make sure it's actually changed
+			tableDescription, err := dynamodbconn.DescribeTable(&dynamodb.DescribeTableInput{
+				TableName: aws.String(d.Id()),
+			})
+
+			if err != nil {
+				return err
+			}
+
+			table := tableDescription.Table
+
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+
+			for _, updatedgsidata := range gsiSet.List() {
+				gsidata := updatedgsidata.(map[string]interface{})
+				gsiName := gsidata["name"].(string)
+				gsiWriteCapacity := gsidata["write_capacity"].(int)
+				gsiReadCapacity := gsidata["read_capacity"].(int)
+
+				log.Printf("[DEBUG] Updating GSI %s", gsiName)
+				gsi, err := getGlobalSecondaryIndex(gsiName, table.GlobalSecondaryIndexes)
+
+				if err != nil {
+					return err
+				}
+
+				capacityUpdated := false
+
+				if int64(gsiReadCapacity) != *(gsi.ProvisionedThroughput.ReadCapacityUnits) ||
+					int64(gsiWriteCapacity) != *(gsi.ProvisionedThroughput.WriteCapacityUnits) {
+					capacityUpdated = true
+				}
+
+				if capacityUpdated {
+					update := &dynamodb.GlobalSecondaryIndexUpdate{
+						Update: &dynamodb.UpdateGlobalSecondaryIndexAction{
+							IndexName: aws.String(gsidata["name"].(string)),
+							ProvisionedThroughput: &dynamodb.ProvisionedThroughput{
+								WriteCapacityUnits: aws.Long(int64(gsiWriteCapacity)),
+								ReadCapacityUnits:  aws.Long(int64(gsiReadCapacity)),
+							},
+						},
+					}
+					updates = append(updates, update)
+
+				}
+
+				if len(updates) > 0 {
+
+					req := &dynamodb.UpdateTableInput{
+						TableName: aws.String(d.Id()),
+					}
+
+					req.GlobalSecondaryIndexUpdates = updates
+
+					log.Printf("[DEBUG] Updating GSI read / write capacity on %s", d.Id())
+					_, err := dynamodbconn.UpdateTable(req)
+
+					if err != nil {
+						log.Printf("[DEBUG] Error updating table: %s", err)
+						return err
+					}
+				}
+			}
+		}
+
+	}
+
+	return resourceAwsDynamoDbTableRead(d, meta)
+}
+
+func resourceAwsDynamoDbTableRead(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	log.Printf("[DEBUG] Loading data for DynamoDB table '%s'", d.Id())
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(d.Id()),
+	}
+
+	result, err := dynamodbconn.DescribeTable(req)
+
+	if err != nil {
+		return err
+	}
+
+	table := result.Table
+
+	d.Set("write_capacity", table.ProvisionedThroughput.WriteCapacityUnits)
+	d.Set("read_capacity", table.ProvisionedThroughput.ReadCapacityUnits)
+
+	attributes := []interface{}{}
+	for _, attrdef := range table.AttributeDefinitions {
+		attribute := map[string]string{
+			"name": *(attrdef.AttributeName),
+			"type": *(attrdef.AttributeType),
+		}
+		attributes = append(attributes, attribute)
+		log.Printf("[DEBUG] Added Attribute: %s", attribute["name"])
+	}
+
+	d.Set("attribute", attributes)
+
+	gsiList := make([]map[string]interface{}, 0, len(table.GlobalSecondaryIndexes))
+	for _, gsiObject := range table.GlobalSecondaryIndexes {
+		gsi := map[string]interface{}{
+			"write_capacity": *(gsiObject.ProvisionedThroughput.WriteCapacityUnits),
+			"read_capacity":  *(gsiObject.ProvisionedThroughput.ReadCapacityUnits),
+			"name":           *(gsiObject.IndexName),
+		}
+
+		for _, attribute := range gsiObject.KeySchema {
+			if *attribute.KeyType == "HASH" {
+				gsi["hash_key"] = *attribute.AttributeName
+			}
+
+			if *attribute.KeyType == "RANGE" {
+				gsi["range_key"] = *attribute.AttributeName
+			}
+		}
+
+		gsi["projection_type"] = *(gsiObject.Projection.ProjectionType)
+		gsi["non_key_attributes"] = gsiObject.Projection.NonKeyAttributes
+
+		gsiList = append(gsiList, gsi)
+		log.Printf("[DEBUG] Added GSI: %s - Read: %d / Write: %d", gsi["name"], gsi["read_capacity"], gsi["write_capacity"])
+	}
+
+	d.Set("global_secondary_index", gsiList)
+
+	return nil
+}
+
+func resourceAwsDynamoDbTableDelete(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	waitForTableToBeActive(d.Id(), meta)
+
+	log.Printf("[DEBUG] DynamoDB delete table: %s", d.Id())
+
+	_, err := dynamodbconn.DeleteTable(&dynamodb.DeleteTableInput{
+		TableName: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func createGSIFromData(data *map[string]interface{}) dynamodb.GlobalSecondaryIndex {
+
+	projection := &dynamodb.Projection{
+		ProjectionType: aws.String((*data)["projection_type"].(string)),
+	}
+
+	if (*data)["projection_type"] == "INCLUDE" {
+		non_key_attributes := []*string{}
+		for _, attr := range (*data)["non_key_attributes"].([]interface{}) {
+			non_key_attributes = append(non_key_attributes, aws.String(attr.(string)))
+		}
+		projection.NonKeyAttributes = non_key_attributes
+	}
+
+	writeCapacity := (*data)["write_capacity"].(int)
+	readCapacity := (*data)["read_capacity"].(int)
+
+	key_schema := []*dynamodb.KeySchemaElement{
+		&dynamodb.KeySchemaElement{
+			AttributeName: aws.String((*data)["hash_key"].(string)),
+			KeyType:       aws.String("HASH"),
+		},
+	}
+
+	range_key_name := (*data)["range_key"]
+	if range_key_name != "" {
+		range_key_element := &dynamodb.KeySchemaElement{
+			AttributeName: aws.String(range_key_name.(string)),
+			KeyType:       aws.String("RANGE"),
+		}
+
+		key_schema = append(key_schema, range_key_element)
+	}
+
+	return dynamodb.GlobalSecondaryIndex{
+		IndexName:  aws.String((*data)["name"].(string)),
+		KeySchema:  key_schema,
+		Projection: projection,
+		ProvisionedThroughput: &dynamodb.ProvisionedThroughput{
+			WriteCapacityUnits: aws.Long(int64(writeCapacity)),
+			ReadCapacityUnits:  aws.Long(int64(readCapacity)),
+		},
+	}
+}
+
+func getGlobalSecondaryIndex(indexName string, indexList []*dynamodb.GlobalSecondaryIndexDescription) (*dynamodb.GlobalSecondaryIndexDescription, error) {
+	for _, gsi := range indexList {
+		if *(gsi.IndexName) == indexName {
+			return gsi, nil
+		}
+	}
+
+	return &dynamodb.GlobalSecondaryIndexDescription{}, fmt.Errorf("Can't find a GSI by that name...")
+}
+
+func getAttributeType(d *schema.ResourceData, attributeName string) (string, error) {
+	if attributedata, ok := d.GetOk("attribute"); ok {
+		attributeSet := attributedata.(*schema.Set)
+		for _, attribute := range attributeSet.List() {
+			attr := attribute.(map[string]interface{})
+			if attr["name"] == attributeName {
+				return attr["type"].(string), nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf("Unable to find an attribute named %s", attributeName)
+}
+
+func waitForGSIToBeActive(tableName string, gsiName string, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(tableName),
+	}
+
+	activeIndex := false
+
+	for activeIndex == false {
+
+		result, err := dynamodbconn.DescribeTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		table := result.Table
+		var targetGSI *dynamodb.GlobalSecondaryIndexDescription = nil
+
+		for _, gsi := range table.GlobalSecondaryIndexes {
+			if *gsi.IndexName == gsiName {
+				targetGSI = gsi
+			}
+		}
+
+		if targetGSI != nil {
+			activeIndex = *targetGSI.IndexStatus == "ACTIVE"
+
+			if !activeIndex {
+				log.Printf("[DEBUG] Sleeping for 5 seconds for %s GSI to become active", gsiName)
+				time.Sleep(5 * time.Second)
+			}
+		} else {
+			log.Printf("[DEBUG] GSI %s did not exist, giving up", gsiName)
+			break
+		}
+	}
+
+	return nil
+
+}
+
+func waitForTableToBeActive(tableName string, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(tableName),
+	}
+
+	activeState := false
+
+	for activeState == false {
+		result, err := dynamodbconn.DescribeTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		activeState = *(result.Table.TableStatus) == "ACTIVE"
+
+		// Wait for a few seconds
+		if !activeState {
+			log.Printf("[DEBUG] Sleeping for 5 seconds for table to become active")
+			time.Sleep(5 * time.Second)
+		}
+	}
+
+	return nil
+
+}
diff --git a/builtin/providers/aws/resource_aws_dynamodb_table_test.go b/builtin/providers/aws/resource_aws_dynamodb_table_test.go
new file mode 100644
index 000000000..6c26efc73
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_dynamodb_table_test.go
@@ -0,0 +1,297 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSDynamoDbTable(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSDynamoDbTableDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSDynamoDbConfigInitialState,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInitialAWSDynamoDbTableExists("aws_dynamodb_table.basic-dynamodb-table"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSDynamoDbConfigAddSecondaryGSI,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDynamoDbTableWasUpdated("aws_dynamodb_table.basic-dynamodb-table"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSDynamoDbTableDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_dynamodb_table" {
+			continue
+		}
+
+		fmt.Printf("[DEBUG] Checking if DynamoDB table %s exists", rs.Primary.ID)
+		// Check if queue exists by checking for its attributes
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.DescribeTable(params)
+		if err == nil {
+			return fmt.Errorf("DynamoDB table %s still exists. Failing!", rs.Primary.ID)
+		}
+
+		// Verify the error is what we want
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckInitialAWSDynamoDbTableExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		fmt.Printf("[DEBUG] Trying to create initial table state!")
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No DynamoDB table name specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+
+		resp, err := conn.DescribeTable(params)
+
+		if err != nil {
+			fmt.Printf("[ERROR] Problem describing table '%s': %s", rs.Primary.ID, err)
+			return err
+		}
+
+		table := resp.Table
+
+		fmt.Printf("[DEBUG] Checking on table %s", rs.Primary.ID)
+
+		if *table.ProvisionedThroughput.WriteCapacityUnits != 20 {
+			return fmt.Errorf("Provisioned write capacity was %d, not 20!", table.ProvisionedThroughput.WriteCapacityUnits)
+		}
+
+		if *table.ProvisionedThroughput.ReadCapacityUnits != 10 {
+			return fmt.Errorf("Provisioned read capacity was %d, not 10!", table.ProvisionedThroughput.ReadCapacityUnits)
+		}
+
+		attrCount := len(table.AttributeDefinitions)
+		gsiCount := len(table.GlobalSecondaryIndexes)
+		lsiCount := len(table.LocalSecondaryIndexes)
+
+		if attrCount != 4 {
+			return fmt.Errorf("There were %d attributes, not 4 like there should have been!", attrCount)
+		}
+
+		if gsiCount != 1 {
+			return fmt.Errorf("There were %d GSIs, not 1 like there should have been!", gsiCount)
+		}
+
+		if lsiCount != 1 {
+			return fmt.Errorf("There were %d LSIs, not 1 like there should have been!", lsiCount)
+		}
+
+		attrmap := dynamoDbAttributesToMap(&table.AttributeDefinitions)
+		if attrmap["TestTableHashKey"] != "S" {
+			return fmt.Errorf("Test table hash key was of type %s instead of S!", attrmap["TestTableHashKey"])
+		}
+		if attrmap["TestTableRangeKey"] != "S" {
+			return fmt.Errorf("Test table range key was of type %s instead of S!", attrmap["TestTableRangeKey"])
+		}
+		if attrmap["TestLSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table LSI range key was of type %s instead of N!", attrmap["TestLSIRangeKey"])
+		}
+		if attrmap["TestGSIRangeKey"] != "S" {
+			return fmt.Errorf("Test table GSI range key was of type %s instead of S!", attrmap["TestGSIRangeKey"])
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckDynamoDbTableWasUpdated(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No DynamoDB table name specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+		resp, err := conn.DescribeTable(params)
+		table := resp.Table
+
+		if err != nil {
+			return err
+		}
+
+		attrCount := len(table.AttributeDefinitions)
+		gsiCount := len(table.GlobalSecondaryIndexes)
+		lsiCount := len(table.LocalSecondaryIndexes)
+
+		if attrCount != 4 {
+			return fmt.Errorf("There were %d attributes, not 4 like there should have been!", attrCount)
+		}
+
+		if gsiCount != 1 {
+			return fmt.Errorf("There were %d GSIs, not 1 like there should have been!", gsiCount)
+		}
+
+		if lsiCount != 1 {
+			return fmt.Errorf("There were %d LSIs, not 1 like there should have been!", lsiCount)
+		}
+
+		if dynamoDbGetGSIIndex(&table.GlobalSecondaryIndexes, "ReplacementTestTableGSI") == -1 {
+			return fmt.Errorf("Could not find GSI named 'ReplacementTestTableGSI' in the table!")
+		}
+
+		if dynamoDbGetGSIIndex(&table.GlobalSecondaryIndexes, "InitialTestTableGSI") != -1 {
+			return fmt.Errorf("Should have removed 'InitialTestTableGSI' but it still exists!")
+		}
+
+		attrmap := dynamoDbAttributesToMap(&table.AttributeDefinitions)
+		if attrmap["TestTableHashKey"] != "S" {
+			return fmt.Errorf("Test table hash key was of type %s instead of S!", attrmap["TestTableHashKey"])
+		}
+		if attrmap["TestTableRangeKey"] != "S" {
+			return fmt.Errorf("Test table range key was of type %s instead of S!", attrmap["TestTableRangeKey"])
+		}
+		if attrmap["TestLSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table LSI range key was of type %s instead of N!", attrmap["TestLSIRangeKey"])
+		}
+		if attrmap["ReplacementGSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table replacement GSI range key was of type %s instead of N!", attrmap["ReplacementGSIRangeKey"])
+		}
+
+		return nil
+	}
+}
+
+func dynamoDbGetGSIIndex(gsiList *[]*dynamodb.GlobalSecondaryIndexDescription, target string) int {
+	for idx, gsiObject := range *gsiList {
+		if *gsiObject.IndexName == target {
+			return idx
+		}
+	}
+
+	return -1
+}
+
+func dynamoDbAttributesToMap(attributes *[]*dynamodb.AttributeDefinition) map[string]string {
+	attrmap := make(map[string]string)
+
+	for _, attrdef := range *attributes {
+		attrmap[*(attrdef.AttributeName)] = *(attrdef.AttributeType)
+	}
+
+	return attrmap
+}
+
+const testAccAWSDynamoDbConfigInitialState = `
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "TerraformTestTable"
+		read_capacity = 10
+		write_capacity = 20
+		hash_key = "TestTableHashKey"
+		range_key = "TestTableRangeKey"
+		attribute {
+			name = "TestTableHashKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestTableRangeKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestLSIRangeKey"
+			type = "N"
+		}
+		attribute {
+			name = "TestGSIRangeKey"
+			type = "S"
+		}
+		local_secondary_index {
+			name = "TestTableLSI"
+			range_key = "TestLSIRangeKey"
+			projection_type = "ALL"
+		}
+		global_secondary_index {
+			name = "InitialTestTableGSI"
+			hash_key = "TestTableHashKey"
+			range_key = "TestGSIRangeKey"
+			write_capacity = 10
+			read_capacity = 10
+			projection_type = "KEYS_ONLY"
+		}
+}
+`
+
+const testAccAWSDynamoDbConfigAddSecondaryGSI = `
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "TerraformTestTable"
+		read_capacity = 20
+		write_capacity = 20
+		hash_key = "TestTableHashKey"
+		range_key = "TestTableRangeKey"
+		attribute {
+			name = "TestTableHashKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestTableRangeKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestLSIRangeKey"
+			type = "N"
+		}
+		attribute {
+			name = "ReplacementGSIRangeKey"
+			type = "N"
+		}
+		local_secondary_index {
+			name = "TestTableLSI"
+			range_key = "TestLSIRangeKey"
+			projection_type = "ALL"
+		}
+		global_secondary_index {
+			name = "ReplacementTestTableGSI"
+			hash_key = "TestTableHashKey"
+			range_key = "ReplacementGSIRangeKey"
+			write_capacity = 5
+			read_capacity = 5
+			projection_type = "INCLUDE"
+			non_key_attributes = ["TestNonKeyAttribute"]
+		}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ebs_volume.go b/builtin/providers/aws/resource_aws_ebs_volume.go
index ccf4ca009..d225f26ce 100644
--- a/builtin/providers/aws/resource_aws_ebs_volume.go
+++ b/builtin/providers/aws/resource_aws_ebs_volume.go
@@ -2,10 +2,14 @@ package aws
 
 import (
 	"fmt"
+	"log"
+	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
+	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -13,6 +17,7 @@ func resourceAwsEbsVolume() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceAwsEbsVolumeCreate,
 		Read:   resourceAwsEbsVolumeRead,
+		Update: resourceAWSEbsVolumeUpdate,
 		Delete: resourceAwsEbsVolumeDelete,
 
 		Schema: map[string]*schema.Schema{
@@ -57,6 +62,7 @@ func resourceAwsEbsVolume() *schema.Resource {
 				Computed: true,
 				ForceNew: true,
 			},
+			"tags": tagsSchema(),
 		},
 	}
 }
@@ -90,9 +96,69 @@ func resourceAwsEbsVolumeCreate(d *schema.ResourceData, meta interface{}) error
 	if err != nil {
 		return fmt.Errorf("Error creating EC2 volume: %s", err)
 	}
+
+	log.Printf(
+		"[DEBUG] Waiting for Volume (%s) to become available",
+		d.Id())
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"creating"},
+		Target:     "available",
+		Refresh:    volumeStateRefreshFunc(conn, *result.VolumeID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to become available: %s",
+			*result.VolumeID, err)
+	}
+
+	d.SetId(*result.VolumeID)
+
+	if _, ok := d.GetOk("tags"); ok {
+		setTags(conn, d)
+	}
+
 	return readVolume(d, result)
 }
 
+func resourceAWSEbsVolumeUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	if _, ok := d.GetOk("tags"); ok {
+		setTags(conn, d)
+	}
+	return resourceAwsEbsVolumeRead(d, meta)
+}
+
+// volumeStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
+// a the state of a Volume. Returns successfully when volume is available
+func volumeStateRefreshFunc(conn *ec2.EC2, volumeID string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		resp, err := conn.DescribeVolumes(&ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(volumeID)},
+		})
+
+		if err != nil {
+			if ec2err, ok := err.(awserr.Error); ok {
+				// Set this to nil as if we didn't find anything.
+				log.Printf("Error on Volume State Refresh: message: \"%s\", code:\"%s\"", ec2err.Message(), ec2err.Code())
+				resp = nil
+				return nil, "", err
+			} else {
+				log.Printf("Error on Volume State Refresh: %s", err)
+				return nil, "", err
+			}
+		}
+
+		v := resp.Volumes[0]
+		return v, *v.State, nil
+	}
+}
+
 func resourceAwsEbsVolumeRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
@@ -102,7 +168,7 @@ func resourceAwsEbsVolumeRead(d *schema.ResourceData, meta interface{}) error {
 
 	response, err := conn.DescribeVolumes(request)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVolume.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVolume.NotFound" {
 			d.SetId("")
 			return nil
 		}
@@ -148,6 +214,9 @@ func readVolume(d *schema.ResourceData, volume *ec2.Volume) error {
 	if volume.VolumeType != nil {
 		d.Set("type", *volume.VolumeType)
 	}
+	if volume.Tags != nil {
+		d.Set("tags", tagsToMap(volume.Tags))
+	}
 
 	return nil
 }
diff --git a/builtin/providers/aws/resource_aws_ebs_volume_test.go b/builtin/providers/aws/resource_aws_ebs_volume_test.go
index 8a555183f..729fbc151 100644
--- a/builtin/providers/aws/resource_aws_ebs_volume_test.go
+++ b/builtin/providers/aws/resource_aws_ebs_volume_test.go
@@ -1,26 +1,88 @@
 package aws
 
 import (
+	"fmt"
 	"testing"
 
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSEBSVolume(t *testing.T) {
+func TestAccAWSEBSVolume_basic(t *testing.T) {
+	var v ec2.Volume
 	resource.Test(t, resource.TestCase{
 		PreCheck:  func() { testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccAwsEbsVolumeConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVolumeExists("aws_ebs_volume.test", &v),
+				),
 			},
 		},
 	})
 }
 
+func TestAccAWSEBSVolume_withTags(t *testing.T) {
+	var v ec2.Volume
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAwsEbsVolumeConfigWithTags,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVolumeExists("aws_ebs_volume.tags_test", &v),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVolumeExists(n string, v *ec2.Volume) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+		request := &ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		response, err := conn.DescribeVolumes(request)
+		if err == nil {
+			if response.Volumes != nil && len(response.Volumes) > 0 {
+				*v = *response.Volumes[0]
+				return nil
+			}
+		}
+		return fmt.Errorf("Error finding EC2 volume %s", rs.Primary.ID)
+	}
+}
+
 const testAccAwsEbsVolumeConfig = `
 resource "aws_ebs_volume" "test" {
 	availability_zone = "us-west-2a"
 	size = 1
 }
 `
+
+const testAccAwsEbsVolumeConfigWithTags = `
+resource "aws_ebs_volume" "tags_test" {
+	availability_zone = "us-west-2a"
+	size = 1
+	tags {
+		Name = "TerraformTest"
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_cluster.go b/builtin/providers/aws/resource_aws_ecs_cluster.go
new file mode 100644
index 000000000..f9ad036a2
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_cluster.go
@@ -0,0 +1,101 @@
+package aws
+
+import (
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsEcsCluster() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsClusterCreate,
+		Read:   resourceAwsEcsClusterRead,
+		Delete: resourceAwsEcsClusterDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsClusterCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	clusterName := d.Get("name").(string)
+	log.Printf("[DEBUG] Creating ECS cluster %s", clusterName)
+
+	out, err := conn.CreateCluster(&ecs.CreateClusterInput{
+		ClusterName: aws.String(clusterName),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] ECS cluster %s created", *out.Cluster.ClusterARN)
+
+	d.SetId(*out.Cluster.ClusterARN)
+	d.Set("name", *out.Cluster.ClusterName)
+	return nil
+}
+
+func resourceAwsEcsClusterRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	clusterName := d.Get("name").(string)
+	log.Printf("[DEBUG] Reading ECS cluster %s", clusterName)
+	out, err := conn.DescribeClusters(&ecs.DescribeClustersInput{
+		Clusters: []*string{aws.String(clusterName)},
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Received ECS clusters: %s", awsutil.StringValue(out.Clusters))
+
+	d.SetId(*out.Clusters[0].ClusterARN)
+	d.Set("name", *out.Clusters[0].ClusterName)
+
+	return nil
+}
+
+func resourceAwsEcsClusterDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Deleting ECS cluster %s", d.Id())
+
+	return resource.Retry(10*time.Minute, func() error {
+		out, err := conn.DeleteCluster(&ecs.DeleteClusterInput{
+			Cluster: aws.String(d.Id()),
+		})
+
+		if err == nil {
+			log.Printf("[DEBUG] ECS cluster %s deleted: %s", d.Id(), awsutil.StringValue(out))
+			return nil
+		}
+
+		awsErr, ok := err.(awserr.Error)
+		if !ok {
+			return resource.RetryError{Err: err}
+		}
+
+		if awsErr.Code() == "ClusterContainsContainerInstancesException" {
+			log.Printf("[TRACE] Retrying ECS cluster %q deletion after %q", d.Id(), awsErr.Code())
+			return err
+		}
+
+		if awsErr.Code() == "ClusterContainsServicesException" {
+			log.Printf("[TRACE] Retrying ECS cluster %q deletion after %q", d.Id(), awsErr.Code())
+			return err
+		}
+
+		return resource.RetryError{Err: err}
+	})
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_cluster_test.go b/builtin/providers/aws/resource_aws_ecs_cluster_test.go
new file mode 100644
index 000000000..308085d1d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_cluster_test.go
@@ -0,0 +1,68 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSEcsCluster_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsClusterDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsCluster,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsClusterExists("aws_ecs_cluster.foo"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsClusterDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_cluster" {
+			continue
+		}
+
+		out, err := conn.DescribeClusters(&ecs.DescribeClustersInput{
+			Clusters: []*string{aws.String(rs.Primary.ID)},
+		})
+
+		if err == nil {
+			if len(out.Clusters) != 0 {
+				return fmt.Errorf("ECS cluster still exists:\n%#v", out.Clusters)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsClusterExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsCluster = `
+resource "aws_ecs_cluster" "foo" {
+	name = "red-grapes"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_service.go b/builtin/providers/aws/resource_aws_ecs_service.go
new file mode 100644
index 000000000..a92a761f9
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_service.go
@@ -0,0 +1,323 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+var taskDefinitionRE = regexp.MustCompile("^([a-zA-Z0-9_-]+):([0-9]+)$")
+
+func resourceAwsEcsService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsServiceCreate,
+		Read:   resourceAwsEcsServiceRead,
+		Update: resourceAwsEcsServiceUpdate,
+		Delete: resourceAwsEcsServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"cluster": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"task_definition": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"desired_count": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"iam_role": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"load_balancer": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"elb_name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"container_name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"container_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsEcsLoadBalancerHash,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	input := ecs.CreateServiceInput{
+		ServiceName:    aws.String(d.Get("name").(string)),
+		TaskDefinition: aws.String(d.Get("task_definition").(string)),
+		DesiredCount:   aws.Long(int64(d.Get("desired_count").(int))),
+		ClientToken:    aws.String(resource.UniqueId()),
+	}
+
+	if v, ok := d.GetOk("cluster"); ok {
+		input.Cluster = aws.String(v.(string))
+	}
+
+	loadBalancers := expandEcsLoadBalancers(d.Get("load_balancer").(*schema.Set).List())
+	if len(loadBalancers) > 0 {
+		log.Printf("[DEBUG] Adding ECS load balancers: %s", awsutil.StringValue(loadBalancers))
+		input.LoadBalancers = loadBalancers
+	}
+	if v, ok := d.GetOk("iam_role"); ok {
+		input.Role = aws.String(v.(string))
+	}
+
+	log.Printf("[DEBUG] Creating ECS service: %s", awsutil.StringValue(input))
+	out, err := conn.CreateService(&input)
+	if err != nil {
+		return err
+	}
+
+	service := *out.Service
+
+	log.Printf("[DEBUG] ECS service created: %s", *service.ServiceARN)
+	d.SetId(*service.ServiceARN)
+	d.Set("cluster", *service.ClusterARN)
+
+	return resourceAwsEcsServiceUpdate(d, meta)
+}
+
+func resourceAwsEcsServiceRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Reading ECS service %s", d.Id())
+	input := ecs.DescribeServicesInput{
+		Services: []*string{aws.String(d.Id())},
+		Cluster:  aws.String(d.Get("cluster").(string)),
+	}
+
+	out, err := conn.DescribeServices(&input)
+	if err != nil {
+		return err
+	}
+
+	if len(out.Services) < 1 {
+		return nil
+	}
+
+	service := out.Services[0]
+	log.Printf("[DEBUG] Received ECS service %s", awsutil.StringValue(service))
+
+	d.SetId(*service.ServiceARN)
+	d.Set("name", *service.ServiceName)
+
+	// Save task definition in the same format
+	if strings.HasPrefix(d.Get("task_definition").(string), "arn:aws:ecs:") {
+		d.Set("task_definition", *service.TaskDefinition)
+	} else {
+		taskDefinition := buildFamilyAndRevisionFromARN(*service.TaskDefinition)
+		d.Set("task_definition", taskDefinition)
+	}
+
+	d.Set("desired_count", *service.DesiredCount)
+	d.Set("cluster", *service.ClusterARN)
+
+	if service.RoleARN != nil {
+		d.Set("iam_role", *service.RoleARN)
+	}
+
+	if service.LoadBalancers != nil {
+		d.Set("load_balancers", flattenEcsLoadBalancers(service.LoadBalancers))
+	}
+
+	return nil
+}
+
+func resourceAwsEcsServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Updating ECS service %s", d.Id())
+	input := ecs.UpdateServiceInput{
+		Service: aws.String(d.Id()),
+		Cluster: aws.String(d.Get("cluster").(string)),
+	}
+
+	if d.HasChange("desired_count") {
+		_, n := d.GetChange("desired_count")
+		input.DesiredCount = aws.Long(int64(n.(int)))
+	}
+	if d.HasChange("task_definition") {
+		_, n := d.GetChange("task_definition")
+		input.TaskDefinition = aws.String(n.(string))
+	}
+
+	out, err := conn.UpdateService(&input)
+	if err != nil {
+		return err
+	}
+	service := out.Service
+	log.Printf("[DEBUG] Updated ECS service %s", awsutil.StringValue(service))
+
+	return resourceAwsEcsServiceRead(d, meta)
+}
+
+func resourceAwsEcsServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	// Check if it's not already gone
+	resp, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+		Services: []*string{aws.String(d.Id())},
+		Cluster:  aws.String(d.Get("cluster").(string)),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] ECS service %s is currently %s", d.Id(), *resp.Services[0].Status)
+
+	if *resp.Services[0].Status == "INACTIVE" {
+		return nil
+	}
+
+	// Drain the ECS service
+	if *resp.Services[0].Status != "DRAINING" {
+		log.Printf("[DEBUG] Draining ECS service %s", d.Id())
+		_, err = conn.UpdateService(&ecs.UpdateServiceInput{
+			Service:      aws.String(d.Id()),
+			Cluster:      aws.String(d.Get("cluster").(string)),
+			DesiredCount: aws.Long(int64(0)),
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	input := ecs.DeleteServiceInput{
+		Service: aws.String(d.Id()),
+		Cluster: aws.String(d.Get("cluster").(string)),
+	}
+
+	log.Printf("[DEBUG] Deleting ECS service %s", awsutil.StringValue(input))
+	out, err := conn.DeleteService(&input)
+	if err != nil {
+		return err
+	}
+
+	// Wait until it's deleted
+	wait := resource.StateChangeConf{
+		Pending:    []string{"DRAINING"},
+		Target:     "INACTIVE",
+		Timeout:    5 * time.Minute,
+		MinTimeout: 1 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			log.Printf("[DEBUG] Checking if ECS service %s is INACTIVE", d.Id())
+			resp, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+				Services: []*string{aws.String(d.Id())},
+				Cluster:  aws.String(d.Get("cluster").(string)),
+			})
+			if err != nil {
+				return resp, "FAILED", err
+			}
+
+			return resp, *resp.Services[0].Status, nil
+		},
+	}
+
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[DEBUG] ECS service %s deleted.", *out.Service.ServiceARN)
+	return nil
+}
+
+func resourceAwsEcsLoadBalancerHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["elb_name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["container_name"].(string)))
+	buf.WriteString(fmt.Sprintf("%d-", m["container_port"].(int)))
+
+	return hashcode.String(buf.String())
+}
+
+func buildFamilyAndRevisionFromARN(arn string) string {
+	return strings.Split(arn, "/")[1]
+}
+
+func buildTaskDefinitionARN(taskDefinition string, meta interface{}) (string, error) {
+	// If it's already an ARN, just return it
+	if strings.HasPrefix(taskDefinition, "arn:aws:ecs:") {
+		return taskDefinition, nil
+	}
+
+	// Parse out family & revision
+	family, revision, err := parseTaskDefinition(taskDefinition)
+	if err != nil {
+		return "", err
+	}
+
+	iamconn := meta.(*AWSClient).iamconn
+	region := meta.(*AWSClient).region
+
+	// An zero value GetUserInput{} defers to the currently logged in user
+	resp, err := iamconn.GetUser(&iam.GetUserInput{})
+	if err != nil {
+		return "", fmt.Errorf("GetUser ERROR: %#v", err)
+	}
+
+	// arn:aws:iam::0123456789:user/username
+	userARN := *resp.User.ARN
+	accountID := strings.Split(userARN, ":")[4]
+
+	// arn:aws:ecs:us-west-2:01234567890:task-definition/mongodb:3
+	arn := fmt.Sprintf("arn:aws:ecs:%s:%s:task-definition/%s:%s",
+		region, accountID, family, revision)
+	log.Printf("[DEBUG] Built task definition ARN: %s", arn)
+	return arn, nil
+}
+
+func parseTaskDefinition(taskDefinition string) (string, string, error) {
+	matches := taskDefinitionRE.FindAllStringSubmatch(taskDefinition, 2)
+
+	if len(matches) == 0 || len(matches[0]) != 3 {
+		return "", "", fmt.Errorf(
+			"Invalid task definition format, family:rev or ARN expected (%#v)",
+			taskDefinition)
+	}
+
+	return matches[0][1], matches[0][2], nil
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_service_test.go b/builtin/providers/aws/resource_aws_ecs_service_test.go
new file mode 100644
index 000000000..f7776b210
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_service_test.go
@@ -0,0 +1,362 @@
+package aws
+
+import (
+	"fmt"
+	"regexp"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestParseTaskDefinition(t *testing.T) {
+	cases := map[string]map[string]interface{}{
+		"invalid": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalidWithColon:": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"1234": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid:aaa": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid=family:1": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid:name:1": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"valid:1": map[string]interface{}{
+			"family":   "valid",
+			"revision": "1",
+			"isValid":  true,
+		},
+		"abc12-def:54": map[string]interface{}{
+			"family":   "abc12-def",
+			"revision": "54",
+			"isValid":  true,
+		},
+		"lorem_ip-sum:123": map[string]interface{}{
+			"family":   "lorem_ip-sum",
+			"revision": "123",
+			"isValid":  true,
+		},
+		"lorem-ipsum:1": map[string]interface{}{
+			"family":   "lorem-ipsum",
+			"revision": "1",
+			"isValid":  true,
+		},
+	}
+
+	for input, expectedOutput := range cases {
+		family, revision, err := parseTaskDefinition(input)
+		isValid := expectedOutput["isValid"].(bool)
+		if !isValid && err == nil {
+			t.Fatalf("Task definition %s should fail", input)
+		}
+
+		expectedFamily := expectedOutput["family"].(string)
+		if family != expectedFamily {
+			t.Fatalf("Unexpected family (%#v) for task definition %s\n%#v", family, input, err)
+		}
+		expectedRevision := expectedOutput["revision"].(string)
+		if revision != expectedRevision {
+			t.Fatalf("Unexpected revision (%#v) for task definition %s\n%#v", revision, input, err)
+		}
+	}
+}
+
+func TestAccAWSEcsServiceWithARN(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsService,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.mongo"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSEcsServiceModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.mongo"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSEcsServiceWithFamilyAndRevision(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithFamilyAndRevision,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.jenkins"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithFamilyAndRevisionModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.jenkins"),
+				),
+			},
+		},
+	})
+}
+
+// Regression for https://github.com/hashicorp/terraform/issues/2427
+func TestAccAWSEcsServiceWithRenamedCluster(t *testing.T) {
+	originalRegexp := regexp.MustCompile(
+		"^arn:aws:ecs:[^:]+:[0-9]+:cluster/terraformecstest3$")
+	modifiedRegexp := regexp.MustCompile(
+		"^arn:aws:ecs:[^:]+:[0-9]+:cluster/terraformecstest3modified$")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithRenamedCluster,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.ghost"),
+					resource.TestMatchResourceAttr(
+						"aws_ecs_service.ghost", "cluster", originalRegexp),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithRenamedClusterModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.ghost"),
+					resource.TestMatchResourceAttr(
+						"aws_ecs_service.ghost", "cluster", modifiedRegexp),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsServiceDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_service" {
+			continue
+		}
+
+		out, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+			Services: []*string{aws.String(rs.Primary.ID)},
+		})
+
+		if err == nil {
+			if len(out.Services) > 0 {
+				return fmt.Errorf("ECS service still exists:\n%#v", out.Services)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsService = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest1"
+}
+
+resource "aws_ecs_task_definition" "mongo" {
+  family = "mongodb"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "mongo:latest",
+    "memory": 128,
+    "name": "mongodb"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceModified = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest1"
+}
+
+resource "aws_ecs_task_definition" "mongo" {
+  family = "mongodb"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "mongo:latest",
+    "memory": 128,
+    "name": "mongodb"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 2
+}
+`
+
+var testAccAWSEcsServiceWithFamilyAndRevision = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest2"
+}
+
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "jenkins:latest",
+    "memory": 128,
+    "name": "jenkins"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "jenkins" {
+  name = "jenkins"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.jenkins.family}:${aws_ecs_task_definition.jenkins.revision}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceWithFamilyAndRevisionModified = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest2"
+}
+
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "jenkins:latest",
+    "memory": 128,
+    "name": "jenkins"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "jenkins" {
+  name = "jenkins"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.jenkins.family}:${aws_ecs_task_definition.jenkins.revision}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceWithRenamedCluster = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest3"
+}
+resource "aws_ecs_task_definition" "ghost" {
+  family = "ghost"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "ghost:latest",
+    "memory": 128,
+    "name": "ghost"
+  }
+]
+DEFINITION
+}
+resource "aws_ecs_service" "ghost" {
+  name = "ghost"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.ghost.family}:${aws_ecs_task_definition.ghost.revision}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceWithRenamedClusterModified = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest3modified"
+}
+resource "aws_ecs_task_definition" "ghost" {
+  family = "ghost"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "ghost:latest",
+    "memory": 128,
+    "name": "ghost"
+  }
+]
+DEFINITION
+}
+resource "aws_ecs_service" "ghost" {
+  name = "ghost"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.ghost.family}:${aws_ecs_task_definition.ghost.revision}"
+  desired_count = 1
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition.go b/builtin/providers/aws/resource_aws_ecs_task_definition.go
new file mode 100644
index 000000000..bcfe8f398
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition.go
@@ -0,0 +1,180 @@
+package aws
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsEcsTaskDefinition() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsTaskDefinitionCreate,
+		Read:   resourceAwsEcsTaskDefinitionRead,
+		Update: resourceAwsEcsTaskDefinitionUpdate,
+		Delete: resourceAwsEcsTaskDefinitionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"family": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"revision": &schema.Schema{
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+
+			"container_definitions": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				StateFunc: func(v interface{}) string {
+					hash := sha1.Sum([]byte(v.(string)))
+					return hex.EncodeToString(hash[:])
+				},
+			},
+
+			"volume": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"host_path": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsEcsTaskDefinitionVolumeHash,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsTaskDefinitionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	rawDefinitions := d.Get("container_definitions").(string)
+	definitions, err := expandEcsContainerDefinitions(rawDefinitions)
+	if err != nil {
+		return err
+	}
+
+	input := ecs.RegisterTaskDefinitionInput{
+		ContainerDefinitions: definitions,
+		Family:               aws.String(d.Get("family").(string)),
+	}
+
+	if v, ok := d.GetOk("volume"); ok {
+		volumes, err := expandEcsVolumes(v.(*schema.Set).List())
+		if err != nil {
+			return err
+		}
+		input.Volumes = volumes
+	}
+
+	log.Printf("[DEBUG] Registering ECS task definition: %s", awsutil.StringValue(input))
+	out, err := conn.RegisterTaskDefinition(&input)
+	if err != nil {
+		return err
+	}
+
+	taskDefinition := *out.TaskDefinition
+
+	log.Printf("[DEBUG] ECS task definition registered: %q (rev. %d)",
+		*taskDefinition.TaskDefinitionARN, *taskDefinition.Revision)
+
+	d.SetId(*taskDefinition.Family)
+	d.Set("arn", *taskDefinition.TaskDefinitionARN)
+
+	return resourceAwsEcsTaskDefinitionRead(d, meta)
+}
+
+func resourceAwsEcsTaskDefinitionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Reading task definition %s", d.Id())
+	out, err := conn.DescribeTaskDefinition(&ecs.DescribeTaskDefinitionInput{
+		TaskDefinition: aws.String(d.Get("arn").(string)),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Received task definition %s", awsutil.StringValue(out))
+
+	taskDefinition := out.TaskDefinition
+
+	d.SetId(*taskDefinition.Family)
+	d.Set("arn", *taskDefinition.TaskDefinitionARN)
+	d.Set("family", *taskDefinition.Family)
+	d.Set("revision", *taskDefinition.Revision)
+	d.Set("container_definitions", taskDefinition.ContainerDefinitions)
+	d.Set("volumes", flattenEcsVolumes(taskDefinition.Volumes))
+
+	return nil
+}
+
+func resourceAwsEcsTaskDefinitionUpdate(d *schema.ResourceData, meta interface{}) error {
+	oldArn := d.Get("arn").(string)
+
+	log.Printf("[DEBUG] Creating new revision of task definition %q", d.Id())
+	err := resourceAwsEcsTaskDefinitionCreate(d, meta)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] New revision of %q created: %q", d.Id(), d.Get("arn").(string))
+
+	log.Printf("[DEBUG] Deregistering old revision of task definition %q: %q", d.Id(), oldArn)
+	conn := meta.(*AWSClient).ecsconn
+	_, err = conn.DeregisterTaskDefinition(&ecs.DeregisterTaskDefinitionInput{
+		TaskDefinition: aws.String(oldArn),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Old revision of task definition deregistered: %q", oldArn)
+
+	return resourceAwsEcsTaskDefinitionRead(d, meta)
+}
+
+func resourceAwsEcsTaskDefinitionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	_, err := conn.DeregisterTaskDefinition(&ecs.DeregisterTaskDefinitionInput{
+		TaskDefinition: aws.String(d.Get("arn").(string)),
+	})
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[DEBUG] Task definition %q deregistered.", d.Get("arn").(string))
+
+	return nil
+}
+
+func resourceAwsEcsTaskDefinitionVolumeHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["host_path"].(string)))
+
+	return hashcode.String(buf.String())
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition_test.go b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
new file mode 100644
index 000000000..2cff051c5
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
@@ -0,0 +1,166 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSEcsTaskDefinition_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsTaskDefinitionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsTaskDefinition,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsTaskDefinitionExists("aws_ecs_task_definition.jenkins"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSEcsTaskDefinitionModifier,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsTaskDefinitionExists("aws_ecs_task_definition.jenkins"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsTaskDefinitionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_task_definition" {
+			continue
+		}
+
+		out, err := conn.DescribeTaskDefinition(&ecs.DescribeTaskDefinitionInput{
+			TaskDefinition: aws.String(rs.Primary.ID),
+		})
+
+		if err == nil {
+			if out.TaskDefinition != nil {
+				return fmt.Errorf("ECS task definition still exists:\n%#v", *out.TaskDefinition)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsTaskDefinitionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsTaskDefinition = `
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "terraform-acc-test"
+  container_definitions = <<TASK_DEFINITION
+[
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"environment": [
+			{"name": "VARNAME", "value": "VARVAL"}
+		],
+		"essential": true,
+		"image": "jenkins",
+		"links": ["mongodb"],
+		"memory": 128,
+		"name": "jenkins",
+		"portMappings": [
+			{
+				"containerPort": 80,
+				"hostPort": 8080
+			}
+		]
+	},
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"essential": true,
+		"image": "mongodb",
+		"memory": 128,
+		"name": "mongodb",
+		"portMappings": [
+			{
+				"containerPort": 28017,
+				"hostPort": 28017
+			}
+		]
+	}
+]
+TASK_DEFINITION
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+`
+
+var testAccAWSEcsTaskDefinitionModifier = `
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "terraform-acc-test"
+  container_definitions = <<TASK_DEFINITION
+[
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"environment": [
+			{"name": "VARNAME", "value": "VARVAL"}
+		],
+		"essential": true,
+		"image": "jenkins",
+		"links": ["mongodb"],
+		"memory": 128,
+		"name": "jenkins",
+		"portMappings": [
+			{
+				"containerPort": 80,
+				"hostPort": 8080
+			}
+		]
+	},
+	{
+		"cpu": 20,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"essential": true,
+		"image": "mongodb",
+		"memory": 128,
+		"name": "mongodb",
+		"portMappings": [
+			{
+				"containerPort": 28017,
+				"hostPort": 28017
+			}
+		]
+	}
+]
+TASK_DEFINITION
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+`
diff --git a/builtin/providers/aws/resource_aws_eip.go b/builtin/providers/aws/resource_aws_eip.go
index cb3ea6bbe..f4b335a1e 100644
--- a/builtin/providers/aws/resource_aws_eip.go
+++ b/builtin/providers/aws/resource_aws_eip.go
@@ -6,8 +6,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -123,7 +124,7 @@ func resourceAwsEipRead(d *schema.ResourceData, meta interface{}) error {
 
 	describeAddresses, err := ec2conn.DescribeAddresses(req)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidAllocationID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidAllocationID.NotFound" {
 			d.SetId("")
 			return nil
 		}
@@ -221,6 +222,17 @@ func resourceAwsEipDelete(d *schema.ResourceData, meta interface{}) error {
 				PublicIP: aws.String(d.Get("public_ip").(string)),
 			})
 		}
+
+		if err != nil {
+			// First check if the association ID is not found. If this
+			// is the case, then it was already disassociated somehow,
+			// and that is okay. The most commmon reason for this is that
+			// the instance or ENI it was attached it was destroyed.
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidAssociationID.NotFound" {
+				err = nil
+			}
+		}
+
 		if err != nil {
 			return err
 		}
@@ -247,7 +259,7 @@ func resourceAwsEipDelete(d *schema.ResourceData, meta interface{}) error {
 		if err == nil {
 			return nil
 		}
-		if _, ok := err.(aws.APIError); !ok {
+		if _, ok := err.(awserr.Error); !ok {
 			return resource.RetryError{Err: err}
 		}
 
diff --git a/builtin/providers/aws/resource_aws_eip_test.go b/builtin/providers/aws/resource_aws_eip_test.go
index b87794131..0fe42667a 100644
--- a/builtin/providers/aws/resource_aws_eip_test.go
+++ b/builtin/providers/aws/resource_aws_eip_test.go
@@ -5,13 +5,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSEIP_normal(t *testing.T) {
+func TestAccAWSEIP_basic(t *testing.T) {
 	var conf ec2.Address
 
 	resource.Test(t, resource.TestCase{
@@ -98,12 +99,12 @@ func testAccCheckAWSEIPDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		providerErr, ok := err.(aws.APIError)
+		providerErr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 
-		if providerErr.Code != "InvalidAllocationID.NotFound" {
+		if providerErr.Code() != "InvalidAllocationID.NotFound" {
 			return fmt.Errorf("Unexpected error: %s", err)
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_elasticache_cluster.go b/builtin/providers/aws/resource_aws_elasticache_cluster.go
index 5037fd01f..fa0d6b746 100644
--- a/builtin/providers/aws/resource_aws_elasticache_cluster.go
+++ b/builtin/providers/aws/resource_aws_elasticache_cluster.go
@@ -3,10 +3,15 @@ package aws
 import (
 	"fmt"
 	"log"
+	"sort"
+	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -16,6 +21,7 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceAwsElasticacheClusterCreate,
 		Read:   resourceAwsElasticacheClusterRead,
+		Update: resourceAwsElasticacheClusterUpdate,
 		Delete: resourceAwsElasticacheClusterDelete,
 
 		Schema: map[string]*schema.Schema{
@@ -27,7 +33,6 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 			"engine": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"node_type": &schema.Schema{
 				Type:     schema.TypeString,
@@ -37,24 +42,26 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 			"num_cache_nodes": &schema.Schema{
 				Type:     schema.TypeInt,
 				Required: true,
-				ForceNew: true,
 			},
 			"parameter_group_name": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
+				Computed: true,
 			},
 			"port": &schema.Schema{
 				Type:     schema.TypeInt,
-				Default:  11211,
-				Optional: true,
+				Required: true,
 				ForceNew: true,
 			},
 			"engine_version": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
+			},
+			"maintenance_window": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
 			},
 			"subnet_group_name": &schema.Schema{
 				Type:     schema.TypeString,
@@ -76,12 +83,59 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			// Exported Attributes
+			"cache_nodes": &schema.Schema{
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"id": &schema.Schema{
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"address": &schema.Schema{
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+					},
+				},
+			},
+
+			// A single-element string list containing an Amazon Resource Name (ARN) that
+			// uniquely identifies a Redis RDB snapshot file stored in Amazon S3. The snapshot
+			// file will be used to populate the node group.
+			//
+			// See also:
+			// https://github.com/aws/aws-sdk-go/blob/4862a174f7fc92fb523fc39e68f00b87d91d2c3d/service/elasticache/api.go#L2079
+			"snapshot_arns": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
 				ForceNew: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set: func(v interface{}) int {
 					return hashcode.String(v.(string))
 				},
 			},
+
+			"tags": tagsSchema(),
+
+			// apply_immediately is used to determine when the update modifications
+			// take place.
+			// See http://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html
+			"apply_immediately": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -94,15 +148,15 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 	numNodes := int64(d.Get("num_cache_nodes").(int)) // 2
 	engine := d.Get("engine").(string)                // memcached
 	engineVersion := d.Get("engine_version").(string) // 1.4.14
-	port := int64(d.Get("port").(int))                // 11211
+	port := int64(d.Get("port").(int))                // e.g) 11211
 	subnetGroupName := d.Get("subnet_group_name").(string)
 	securityNameSet := d.Get("security_group_names").(*schema.Set)
 	securityIdSet := d.Get("security_group_ids").(*schema.Set)
-	paramGroupName := d.Get("parameter_group_name").(string) // default.memcached1.4
 
 	securityNames := expandStringList(securityNameSet.List())
 	securityIds := expandStringList(securityIdSet.List())
 
+	tags := tagsFromMapEC(d.Get("tags").(map[string]interface{}))
 	req := &elasticache.CreateCacheClusterInput{
 		CacheClusterID:          aws.String(clusterId),
 		CacheNodeType:           aws.String(nodeType),
@@ -113,7 +167,23 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 		CacheSubnetGroupName:    aws.String(subnetGroupName),
 		CacheSecurityGroupNames: securityNames,
 		SecurityGroupIDs:        securityIds,
-		CacheParameterGroupName: aws.String(paramGroupName),
+		Tags:                    tags,
+	}
+
+	// parameter groups are optional and can be defaulted by AWS
+	if v, ok := d.GetOk("parameter_group_name"); ok {
+		req.CacheParameterGroupName = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("maintenance_window"); ok {
+		req.PreferredMaintenanceWindow = aws.String(v.(string))
+	}
+
+	snaps := d.Get("snapshot_arns").(*schema.Set).List()
+	if len(snaps) > 0 {
+		s := expandStringList(snaps)
+		req.SnapshotARNs = s
+		log.Printf("[DEBUG] Restoring Redis cluster from S3 snapshot: %#v", s)
 	}
 
 	_, err := conn.CreateCacheCluster(req)
@@ -125,7 +195,7 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 	stateConf := &resource.StateChangeConf{
 		Pending:    pending,
 		Target:     "available",
-		Refresh:    CacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
+		Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
 		Timeout:    10 * time.Minute,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
@@ -139,13 +209,14 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 
 	d.SetId(clusterId)
 
-	return nil
+	return resourceAwsElasticacheClusterRead(d, meta)
 }
 
 func resourceAwsElasticacheClusterRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).elasticacheconn
 	req := &elasticache.DescribeCacheClustersInput{
-		CacheClusterID: aws.String(d.Id()),
+		CacheClusterID:    aws.String(d.Id()),
+		ShowCacheNodeInfo: aws.Boolean(true),
 	}
 
 	res, err := conn.DescribeCacheClusters(req)
@@ -167,11 +238,137 @@ func resourceAwsElasticacheClusterRead(d *schema.ResourceData, meta interface{})
 		d.Set("security_group_names", c.CacheSecurityGroups)
 		d.Set("security_group_ids", c.SecurityGroups)
 		d.Set("parameter_group_name", c.CacheParameterGroup)
+		d.Set("maintenance_window", c.PreferredMaintenanceWindow)
+
+		if err := setCacheNodeData(d, c); err != nil {
+			return err
+		}
+		// list tags for resource
+		// set tags
+		arn, err := buildECARN(d, meta)
+		if err != nil {
+			log.Printf("[DEBUG] Error building ARN for ElastiCache Cluster, not setting Tags for cluster %s", *c.CacheClusterID)
+		} else {
+			resp, err := conn.ListTagsForResource(&elasticache.ListTagsForResourceInput{
+				ResourceName: aws.String(arn),
+			})
+
+			if err != nil {
+				log.Printf("[DEBUG] Error retreiving tags for ARN: %s", arn)
+			}
+
+			var et []*elasticache.Tag
+			if len(resp.TagList) > 0 {
+				et = resp.TagList
+			}
+			d.Set("tags", tagsToMapEC(et))
+		}
 	}
 
 	return nil
 }
 
+func resourceAwsElasticacheClusterUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+	arn, err := buildECARN(d, meta)
+	if err != nil {
+		log.Printf("[DEBUG] Error building ARN for ElastiCache Cluster, not updating Tags for cluster %s", d.Id())
+	} else {
+		if err := setTagsEC(conn, d, arn); err != nil {
+			return err
+		}
+	}
+
+	req := &elasticache.ModifyCacheClusterInput{
+		CacheClusterID:   aws.String(d.Id()),
+		ApplyImmediately: aws.Boolean(d.Get("apply_immediately").(bool)),
+	}
+
+	requestUpdate := false
+	if d.HasChange("security_group_ids") {
+		if attr := d.Get("security_group_ids").(*schema.Set); attr.Len() > 0 {
+			req.SecurityGroupIDs = expandStringList(attr.List())
+			requestUpdate = true
+		}
+	}
+
+	if d.HasChange("parameter_group_name") {
+		req.CacheParameterGroupName = aws.String(d.Get("parameter_group_name").(string))
+		requestUpdate = true
+	}
+
+	if d.HasChange("maintenance_window") {
+		req.PreferredMaintenanceWindow = aws.String(d.Get("maintenance_window").(string))
+		requestUpdate = true
+	}
+
+	if d.HasChange("engine_version") {
+		req.EngineVersion = aws.String(d.Get("engine_version").(string))
+		requestUpdate = true
+	}
+
+	if d.HasChange("num_cache_nodes") {
+		req.NumCacheNodes = aws.Long(int64(d.Get("num_cache_nodes").(int)))
+		requestUpdate = true
+	}
+
+	if requestUpdate {
+		log.Printf("[DEBUG] Modifying ElastiCache Cluster (%s), opts:\n%s", d.Id(), awsutil.StringValue(req))
+		_, err := conn.ModifyCacheCluster(req)
+		if err != nil {
+			return fmt.Errorf("[WARN] Error updating ElastiCache cluster (%s), error: %s", d.Id(), err)
+		}
+
+		log.Printf("[DEBUG] Waiting for update: %s", d.Id())
+		pending := []string{"modifying", "rebooting cache cluster nodes", "snapshotting"}
+		stateConf := &resource.StateChangeConf{
+			Pending:    pending,
+			Target:     "available",
+			Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
+			Timeout:    5 * time.Minute,
+			Delay:      5 * time.Second,
+			MinTimeout: 3 * time.Second,
+		}
+
+		_, sterr := stateConf.WaitForState()
+		if sterr != nil {
+			return fmt.Errorf("Error waiting for elasticache (%s) to update: %s", d.Id(), sterr)
+		}
+	}
+
+	return resourceAwsElasticacheClusterRead(d, meta)
+}
+
+func setCacheNodeData(d *schema.ResourceData, c *elasticache.CacheCluster) error {
+	sortedCacheNodes := make([]*elasticache.CacheNode, len(c.CacheNodes))
+	copy(sortedCacheNodes, c.CacheNodes)
+	sort.Sort(byCacheNodeId(sortedCacheNodes))
+
+	cacheNodeData := make([]map[string]interface{}, 0, len(sortedCacheNodes))
+
+	for _, node := range sortedCacheNodes {
+		if node.CacheNodeID == nil || node.Endpoint == nil || node.Endpoint.Address == nil || node.Endpoint.Port == nil {
+			return fmt.Errorf("Unexpected nil pointer in: %s", awsutil.StringValue(node))
+		}
+		cacheNodeData = append(cacheNodeData, map[string]interface{}{
+			"id":      *node.CacheNodeID,
+			"address": *node.Endpoint.Address,
+			"port":    int(*node.Endpoint.Port),
+		})
+	}
+
+	return d.Set("cache_nodes", cacheNodeData)
+}
+
+type byCacheNodeId []*elasticache.CacheNode
+
+func (b byCacheNodeId) Len() int      { return len(b) }
+func (b byCacheNodeId) Swap(i, j int) { b[i], b[j] = b[j], b[i] }
+func (b byCacheNodeId) Less(i, j int) bool {
+	return b[i].CacheNodeID != nil && b[j].CacheNodeID != nil &&
+		*b[i].CacheNodeID < *b[j].CacheNodeID
+}
+
 func resourceAwsElasticacheClusterDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).elasticacheconn
 
@@ -187,7 +384,7 @@ func resourceAwsElasticacheClusterDelete(d *schema.ResourceData, meta interface{
 	stateConf := &resource.StateChangeConf{
 		Pending:    []string{"creating", "available", "deleting", "incompatible-parameters", "incompatible-network", "restore-failed"},
 		Target:     "",
-		Refresh:    CacheClusterStateRefreshFunc(conn, d.Id(), "", []string{}),
+		Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "", []string{}),
 		Timeout:    10 * time.Minute,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
@@ -203,15 +400,16 @@ func resourceAwsElasticacheClusterDelete(d *schema.ResourceData, meta interface{
 	return nil
 }
 
-func CacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, givenState string, pending []string) resource.StateRefreshFunc {
+func cacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, givenState string, pending []string) resource.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		resp, err := conn.DescribeCacheClusters(&elasticache.DescribeCacheClustersInput{
-			CacheClusterID: aws.String(clusterID),
+			CacheClusterID:    aws.String(clusterID),
+			ShowCacheNodeInfo: aws.Boolean(true),
 		})
 		if err != nil {
-			apierr := err.(aws.APIError)
-			log.Printf("[DEBUG] message: %v, code: %v", apierr.Message, apierr.Code)
-			if apierr.Message == fmt.Sprintf("CacheCluster not found: %v", clusterID) {
+			apierr := err.(awserr.Error)
+			log.Printf("[DEBUG] message: %v, code: %v", apierr.Message(), apierr.Code())
+			if apierr.Message() == fmt.Sprintf("CacheCluster not found: %v", clusterID) {
 				log.Printf("[DEBUG] Detect deletion")
 				return nil, "", nil
 			}
@@ -234,9 +432,35 @@ func CacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, give
 
 		// return given state if it's not in pending
 		if givenState != "" {
+			// check to make sure we have the node count we're expecting
+			if int64(len(c.CacheNodes)) != *c.NumCacheNodes {
+				log.Printf("[DEBUG] Node count is not what is expected: %d found, %d expected", len(c.CacheNodes), *c.NumCacheNodes)
+				return nil, "creating", nil
+			}
+			// loop the nodes and check their status as well
+			for _, n := range c.CacheNodes {
+				if n.CacheNodeStatus != nil && *n.CacheNodeStatus != "available" {
+					log.Printf("[DEBUG] Node (%s) is not yet available, status: %s", *n.CacheNodeID, *n.CacheNodeStatus)
+					return nil, "creating", nil
+				}
+			}
 			return c, givenState, nil
 		}
 		log.Printf("[DEBUG] current status: %v", *c.CacheClusterStatus)
 		return c, *c.CacheClusterStatus, nil
 	}
 }
+
+func buildECARN(d *schema.ResourceData, meta interface{}) (string, error) {
+	iamconn := meta.(*AWSClient).iamconn
+	region := meta.(*AWSClient).region
+	// An zero value GetUserInput{} defers to the currently logged in user
+	resp, err := iamconn.GetUser(&iam.GetUserInput{})
+	if err != nil {
+		return "", err
+	}
+	userARN := *resp.User.ARN
+	accountID := strings.Split(userARN, ":")[4]
+	arn := fmt.Sprintf("arn:aws:elasticache:%s:%s:cluster:%s", region, accountID, d.Id())
+	return arn, nil
+}
diff --git a/builtin/providers/aws/resource_aws_elasticache_cluster_test.go b/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
index 1899e0f24..c5e12ebd8 100644
--- a/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
@@ -6,13 +6,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSElasticacheCluster(t *testing.T) {
+func TestAccAWSElasticacheCluster_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
@@ -23,6 +23,8 @@ func TestAccAWSElasticacheCluster(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSElasticacheSecurityGroupExists("aws_elasticache_security_group.bar"),
 					testAccCheckAWSElasticacheClusterExists("aws_elasticache_cluster.bar"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_cluster.bar", "cache_nodes.0.id", "0001"),
 				),
 			},
 		},
@@ -30,6 +32,7 @@ func TestAccAWSElasticacheCluster(t *testing.T) {
 }
 
 func TestAccAWSElasticacheCluster_vpc(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
@@ -38,7 +41,7 @@ func TestAccAWSElasticacheCluster_vpc(t *testing.T) {
 			resource.TestStep{
 				Config: testAccAWSElasticacheClusterInVPCConfig,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar"),
+					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar", &csg),
 					testAccCheckAWSElasticacheClusterExists("aws_elasticache_cluster.bar"),
 				),
 			},
@@ -93,6 +96,9 @@ func genRandInt() int {
 }
 
 var testAccAWSElasticacheClusterConfig = fmt.Sprintf(`
+provider "aws" {
+	region = "us-east-1"
+}
 resource "aws_security_group" "bar" {
     name = "tf-test-security-group-%03d"
     description = "tf-test-security-group-descr"
@@ -115,6 +121,7 @@ resource "aws_elasticache_cluster" "bar" {
     engine = "memcached"
     node_type = "cache.m1.small"
     num_cache_nodes = 1
+    port = 11211
     parameter_group_name = "default.memcached1.4"
     security_group_names = ["${aws_elasticache_security_group.bar.name}"]
 }
diff --git a/builtin/providers/aws/resource_aws_elasticache_parameter_group.go b/builtin/providers/aws/resource_aws_elasticache_parameter_group.go
new file mode 100644
index 000000000..3574d5dcf
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_elasticache_parameter_group.go
@@ -0,0 +1,211 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+)
+
+func resourceAwsElasticacheParameterGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsElasticacheParameterGroupCreate,
+		Read:   resourceAwsElasticacheParameterGroupRead,
+		Update: resourceAwsElasticacheParameterGroupUpdate,
+		Delete: resourceAwsElasticacheParameterGroupDelete,
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"family": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"parameter": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: false,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"value": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsElasticacheParameterHash,
+			},
+		},
+	}
+}
+
+func resourceAwsElasticacheParameterGroupCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	createOpts := elasticache.CreateCacheParameterGroupInput{
+		CacheParameterGroupName:   aws.String(d.Get("name").(string)),
+		CacheParameterGroupFamily: aws.String(d.Get("family").(string)),
+		Description:            aws.String(d.Get("description").(string)),
+	}
+
+	log.Printf("[DEBUG] Create Cache Parameter Group: %#v", createOpts)
+	_, err := conn.CreateCacheParameterGroup(&createOpts)
+	if err != nil {
+		return fmt.Errorf("Error creating DB Parameter Group: %s", err)
+	}
+
+	d.Partial(true)
+	d.SetPartial("name")
+	d.SetPartial("family")
+	d.SetPartial("description")
+	d.Partial(false)
+
+	d.SetId(*createOpts.CacheParameterGroupName)
+	log.Printf("[INFO] Cache Parameter Group ID: %s", d.Id())
+
+	return resourceAwsElasticacheParameterGroupUpdate(d, meta)
+}
+
+func resourceAwsElasticacheParameterGroupRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	describeOpts := elasticache.DescribeCacheParameterGroupsInput{
+		CacheParameterGroupName: aws.String(d.Id()),
+	}
+
+	describeResp, err := conn.DescribeCacheParameterGroups(&describeOpts)
+	if err != nil {
+		return err
+	}
+
+	if len(describeResp.CacheParameterGroups) != 1 ||
+		*describeResp.CacheParameterGroups[0].CacheParameterGroupName != d.Id() {
+		return fmt.Errorf("Unable to find Parameter Group: %#v", describeResp.CacheParameterGroups)
+	}
+
+	d.Set("name", describeResp.CacheParameterGroups[0].CacheParameterGroupName)
+	d.Set("family", describeResp.CacheParameterGroups[0].CacheParameterGroupFamily)
+	d.Set("description", describeResp.CacheParameterGroups[0].Description)
+
+	// Only include user customized parameters as there's hundreds of system/default ones
+	describeParametersOpts := elasticache.DescribeCacheParametersInput{
+		CacheParameterGroupName: aws.String(d.Id()),
+		Source:               aws.String("user"),
+	}
+
+	describeParametersResp, err := conn.DescribeCacheParameters(&describeParametersOpts)
+	if err != nil {
+		return err
+	}
+
+	d.Set("parameter", flattenElastiCacheParameters(describeParametersResp.Parameters))
+
+	return nil
+}
+
+func resourceAwsElasticacheParameterGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	d.Partial(true)
+
+	if d.HasChange("parameter") {
+		o, n := d.GetChange("parameter")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+
+		// Expand the "parameter" set to aws-sdk-go compat []elasticacheconn.Parameter
+		parameters, err := expandElastiCacheParameters(ns.Difference(os).List())
+		if err != nil {
+			return err
+		}
+
+		if len(parameters) > 0 {
+			modifyOpts := elasticache.ModifyCacheParameterGroupInput{
+				CacheParameterGroupName: aws.String(d.Get("name").(string)),
+				ParameterNameValues:     parameters,
+			}
+
+			log.Printf("[DEBUG] Modify Cache Parameter Group: %#v", modifyOpts)
+			_, err = conn.ModifyCacheParameterGroup(&modifyOpts)
+			if err != nil {
+				return fmt.Errorf("Error modifying Cache Parameter Group: %s", err)
+			}
+		}
+		d.SetPartial("parameter")
+	}
+
+	d.Partial(false)
+
+	return resourceAwsElasticacheParameterGroupRead(d, meta)
+}
+
+func resourceAwsElasticacheParameterGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"pending"},
+		Target:     "destroyed",
+		Refresh:    resourceAwsElasticacheParameterGroupDeleteRefreshFunc(d, meta),
+		Timeout:    3 * time.Minute,
+		MinTimeout: 1 * time.Second,
+	}
+	_, err := stateConf.WaitForState()
+	return err
+}
+
+func resourceAwsElasticacheParameterGroupDeleteRefreshFunc(
+	d *schema.ResourceData,
+	meta interface{}) resource.StateRefreshFunc {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	return func() (interface{}, string, error) {
+
+		deleteOpts := elasticache.DeleteCacheParameterGroupInput{
+			CacheParameterGroupName: aws.String(d.Id()),
+		}
+
+		if _, err := conn.DeleteCacheParameterGroup(&deleteOpts); err != nil {
+			elasticahceerr, ok := err.(awserr.Error)
+			if ok && elasticahceerr.Code() == "CacheParameterGroupNotFoundFault" {
+				d.SetId("")
+				return d, "error", err
+			}
+			return d, "error", err
+		}
+		return d, "destroyed", nil
+	}
+}
+
+func resourceAwsElasticacheParameterHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["value"].(string)))
+
+	return hashcode.String(buf.String())
+}
diff --git a/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go b/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go
new file mode 100644
index 000000000..e61e64b3c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go
@@ -0,0 +1,210 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSElasticacheParameterGroup_basic(t *testing.T) {
+	var v elasticache.CacheParameterGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheParameterGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.name", "appendonly"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.value", "yes"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupAddParametersConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.name", "appendonly"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.value", "yes"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.2196914567.name", "appendfsync"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.2196914567.value", "always"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSElasticacheParameterGroupOnly(t *testing.T) {
+	var v elasticache.CacheParameterGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheParameterGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupOnlyConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSElasticacheParameterGroupDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_elasticache_parameter_group" {
+			continue
+		}
+
+		// Try to find the Group
+		resp, err := conn.DescribeCacheParameterGroups(
+			&elasticache.DescribeCacheParameterGroupsInput{
+				CacheParameterGroupName: aws.String(rs.Primary.ID),
+			})
+
+		if err == nil {
+			if len(resp.CacheParameterGroups) != 0 &&
+				*resp.CacheParameterGroups[0].CacheParameterGroupName == rs.Primary.ID {
+				return fmt.Errorf("Cache Parameter Group still exists")
+			}
+		}
+
+		// Verify the error
+		newerr, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if newerr.Code() != "InvalidCacheParameterGroup.NotFound" {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSElasticacheParameterGroupAttributes(v *elasticache.CacheParameterGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if *v.CacheParameterGroupName != "parameter-group-test-terraform" {
+			return fmt.Errorf("bad name: %#v", v.CacheParameterGroupName)
+		}
+
+		if *v.CacheParameterGroupFamily != "redis2.8" {
+			return fmt.Errorf("bad family: %#v", v.CacheParameterGroupFamily)
+		}
+
+		if *v.Description != "Test parameter group for terraform" {
+			return fmt.Errorf("bad description: %#v", v.Description)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAWSElasticacheParameterGroupExists(n string, v *elasticache.CacheParameterGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Cache Parameter Group ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
+
+		opts := elasticache.DescribeCacheParameterGroupsInput{
+			CacheParameterGroupName: aws.String(rs.Primary.ID),
+		}
+
+		resp, err := conn.DescribeCacheParameterGroups(&opts)
+
+		if err != nil {
+			return err
+		}
+
+		if len(resp.CacheParameterGroups) != 1 ||
+			*resp.CacheParameterGroups[0].CacheParameterGroupName != rs.Primary.ID {
+			return fmt.Errorf("Cache Parameter Group not found")
+		}
+
+		*v = *resp.CacheParameterGroups[0]
+
+		return nil
+	}
+}
+
+const testAccAWSElasticacheParameterGroupConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+	parameter {
+	  name = "appendonly"
+	  value = "yes"
+	}
+}
+`
+
+const testAccAWSElasticacheParameterGroupAddParametersConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+	parameter {
+	  name = "appendonly"
+	  value = "yes"
+	}
+	parameter {
+	  name = "appendfsync"
+	  value = "always"
+	}
+}
+`
+
+const testAccAWSElasticacheParameterGroupOnlyConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_elasticache_security_group.go b/builtin/providers/aws/resource_aws_elasticache_security_group.go
index d9ce60198..293747031 100644
--- a/builtin/providers/aws/resource_aws_elasticache_security_group.go
+++ b/builtin/providers/aws/resource_aws_elasticache_security_group.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -125,12 +126,12 @@ func resourceAwsElasticacheSecurityGroupDelete(d *schema.ResourceData, meta inte
 			CacheSecurityGroupName: aws.String(d.Id()),
 		})
 		if err != nil {
-			apierr, ok := err.(aws.APIError)
+			apierr, ok := err.(awserr.Error)
 			if !ok {
 				return err
 			}
 			log.Printf("[DEBUG] APIError.Code: %v", apierr.Code)
-			switch apierr.Code {
+			switch apierr.Code() {
 			case "InvalidCacheSecurityGroupState":
 				return err
 			case "DependencyViolation":
diff --git a/builtin/providers/aws/resource_aws_elasticache_security_group_test.go b/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
index 61464936a..87644242f 100644
--- a/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSElasticacheSecurityGroup(t *testing.T) {
+func TestAccAWSElasticacheSecurityGroup_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_elasticache_subnet_group.go b/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
index eb74de283..3a8533164 100644
--- a/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
+++ b/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
-	"github.com/hashicorp/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -16,13 +17,13 @@ func resourceAwsElasticacheSubnetGroup() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceAwsElasticacheSubnetGroupCreate,
 		Read:   resourceAwsElasticacheSubnetGroupRead,
+		Update: resourceAwsElasticacheSubnetGroupUpdate,
 		Delete: resourceAwsElasticacheSubnetGroupDelete,
 
 		Schema: map[string]*schema.Schema{
 			"description": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"name": &schema.Schema{
 				Type:     schema.TypeString,
@@ -31,9 +32,7 @@ func resourceAwsElasticacheSubnetGroup() *schema.Resource {
 			},
 			"subnet_ids": &schema.Schema{
 				Type:     schema.TypeSet,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
+				Required: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set: func(v interface{}) int {
 					return hashcode.String(v.(string))
@@ -109,6 +108,29 @@ func resourceAwsElasticacheSubnetGroupRead(d *schema.ResourceData, meta interfac
 	return nil
 }
 
+func resourceAwsElasticacheSubnetGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+	if d.HasChange("subnet_ids") || d.HasChange("description") {
+		var subnets []*string
+		if v := d.Get("subnet_ids"); v != nil {
+			for _, v := range v.(*schema.Set).List() {
+				subnets = append(subnets, aws.String(v.(string)))
+			}
+		}
+		log.Printf("[DEBUG] Updating ElastiCache Subnet Group")
+
+		_, err := conn.ModifyCacheSubnetGroup(&elasticache.ModifyCacheSubnetGroupInput{
+			CacheSubnetGroupName:        aws.String(d.Get("name").(string)),
+			CacheSubnetGroupDescription: aws.String(d.Get("description").(string)),
+			SubnetIDs:                   subnets,
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	return resourceAwsElasticacheSubnetGroupRead(d, meta)
+}
 func resourceAwsElasticacheSubnetGroupDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).elasticacheconn
 
@@ -119,12 +141,12 @@ func resourceAwsElasticacheSubnetGroupDelete(d *schema.ResourceData, meta interf
 			CacheSubnetGroupName: aws.String(d.Id()),
 		})
 		if err != nil {
-			apierr, ok := err.(aws.APIError)
+			apierr, ok := err.(awserr.Error)
 			if !ok {
 				return err
 			}
 			log.Printf("[DEBUG] APIError.Code: %v", apierr.Code)
-			switch apierr.Code {
+			switch apierr.Code() {
 			case "DependencyViolation":
 				// If it is a dependency violation, we want to retry
 				return err
diff --git a/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go b/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
index 0a16ebf84..d54a4d610 100644
--- a/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
@@ -4,22 +4,56 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSElasticacheSubnetGroup(t *testing.T) {
+func TestAccAWSElasticacheSubnetGroup_basic(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
+	config := fmt.Sprintf(testAccAWSElasticacheSubnetGroupConfig, genRandInt())
+
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
 		CheckDestroy: testAccCheckAWSElasticacheSubnetGroupDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccAWSElasticacheSubnetGroupConfig,
+				Config: config,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar"),
+					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar", &csg),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSElasticacheSubnetGroup_update(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
+	rn := "aws_elasticache_subnet_group.bar"
+	ri := genRandInt()
+	preConfig := fmt.Sprintf(testAccAWSElasticacheSubnetGroupUpdateConfigPre, ri)
+	postConfig := fmt.Sprintf(testAccAWSElasticacheSubnetGroupUpdateConfigPost, ri)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheSubnetGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: preConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheSubnetGroupExists(rn, &csg),
+					testAccCheckAWSElastiCacheSubnetGroupAttrs(&csg, rn, 1),
+				),
+			},
+
+			resource.TestStep{
+				Config: postConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheSubnetGroupExists(rn, &csg),
+					testAccCheckAWSElastiCacheSubnetGroupAttrs(&csg, rn, 2),
 				),
 			},
 		},
@@ -46,7 +80,7 @@ func testAccCheckAWSElasticacheSubnetGroupDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccCheckAWSElasticacheSubnetGroupExists(n string) resource.TestCheckFunc {
+func testAccCheckAWSElasticacheSubnetGroupExists(n string, csg *elasticache.CacheSubnetGroup) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -58,17 +92,47 @@ func testAccCheckAWSElasticacheSubnetGroupExists(n string) resource.TestCheckFun
 		}
 
 		conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
-		_, err := conn.DescribeCacheSubnetGroups(&elasticache.DescribeCacheSubnetGroupsInput{
+		resp, err := conn.DescribeCacheSubnetGroups(&elasticache.DescribeCacheSubnetGroupsInput{
 			CacheSubnetGroupName: aws.String(rs.Primary.ID),
 		})
 		if err != nil {
 			return fmt.Errorf("CacheSubnetGroup error: %v", err)
 		}
+
+		for _, c := range resp.CacheSubnetGroups {
+			if rs.Primary.ID == *c.CacheSubnetGroupName {
+				*csg = *c
+			}
+		}
+
+		if csg == nil {
+			return fmt.Errorf("cache subnet group not found")
+		}
 		return nil
 	}
 }
 
-var testAccAWSElasticacheSubnetGroupConfig = fmt.Sprintf(`
+func testAccCheckAWSElastiCacheSubnetGroupAttrs(csg *elasticache.CacheSubnetGroup, n string, count int) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if len(csg.Subnets) != count {
+			return fmt.Errorf("Bad cache subnet count, expected: %d, got: %d", count, len(csg.Subnets))
+		}
+
+		if rs.Primary.Attributes["description"] != *csg.CacheSubnetGroupDescription {
+			return fmt.Errorf("Bad cache subnet description, expected: %s, got: %s", rs.Primary.Attributes["description"], *csg.CacheSubnetGroupDescription)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSElasticacheSubnetGroupConfig = `
 resource "aws_vpc" "foo" {
     cidr_block = "192.168.0.0/16"
     tags {
@@ -90,4 +154,63 @@ resource "aws_elasticache_subnet_group" "bar" {
     description = "tf-test-cache-subnet-group-descr"
     subnet_ids = ["${aws_subnet.foo.id}"]
 }
-`, genRandInt())
+`
+var testAccAWSElasticacheSubnetGroupUpdateConfigPre = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+    tags {
+            Name = "tf-elc-sub-test"
+    }
+}
+
+resource "aws_subnet" "foo" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test"
+    }
+}
+
+resource "aws_elasticache_subnet_group" "bar" {
+    name = "tf-test-cache-subnet-%03d"
+    description = "tf-test-cache-subnet-group-descr"
+    subnet_ids = ["${aws_subnet.foo.id}"]
+}
+`
+
+var testAccAWSElasticacheSubnetGroupUpdateConfigPost = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+    tags {
+            Name = "tf-elc-sub-test"
+    }
+}
+
+resource "aws_subnet" "foo" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test"
+    }
+}
+
+resource "aws_subnet" "bar" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.2.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test-foo-update"
+    }
+}
+
+resource "aws_elasticache_subnet_group" "bar" {
+    name = "tf-test-cache-subnet-%03d"
+    description = "tf-test-cache-subnet-group-descr-edited"
+    subnet_ids = [
+			"${aws_subnet.foo.id}",
+			"${aws_subnet.bar.id}",
+		]
+}
+`
diff --git a/builtin/providers/aws/resource_aws_elb.go b/builtin/providers/aws/resource_aws_elb.go
index 58108fca6..07e7423a5 100644
--- a/builtin/providers/aws/resource_aws_elb.go
+++ b/builtin/providers/aws/resource_aws_elb.go
@@ -4,9 +4,12 @@ import (
 	"bytes"
 	"fmt"
 	"log"
+	"regexp"
+	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -23,6 +26,26 @@ func resourceAwsElb() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if len(value) > 32 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 32 characters", k))
+					}
+					if regexp.MustCompile(`^-`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot begin with a hyphen", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot end with a hyphen", k))
+					}
+					return
+				},
 			},
 
 			"internal": &schema.Schema{
@@ -336,7 +359,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 			_, err := elbconn.DeleteLoadBalancerListeners(deleteListenersOpts)
 			if err != nil {
-				return fmt.Errorf("Failure removing outdated listeners: %s", err)
+				return fmt.Errorf("Failure removing outdated ELB listeners: %s", err)
 			}
 		}
 
@@ -348,7 +371,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 			_, err := elbconn.CreateLoadBalancerListeners(createListenersOpts)
 			if err != nil {
-				return fmt.Errorf("Failure adding new or updated listeners: %s", err)
+				return fmt.Errorf("Failure adding new or updated ELB listeners: %s", err)
 			}
 		}
 
@@ -373,7 +396,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 			_, err := elbconn.RegisterInstancesWithLoadBalancer(&registerInstancesOpts)
 			if err != nil {
-				return fmt.Errorf("Failure registering instances: %s", err)
+				return fmt.Errorf("Failure registering instances with ELB: %s", err)
 			}
 		}
 		if len(remove) > 0 {
@@ -384,7 +407,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 			_, err := elbconn.DeregisterInstancesFromLoadBalancer(&deRegisterInstancesOpts)
 			if err != nil {
-				return fmt.Errorf("Failure deregistering instances: %s", err)
+				return fmt.Errorf("Failure deregistering instances from ELB: %s", err)
 			}
 		}
 
@@ -406,7 +429,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 		_, err := elbconn.ModifyLoadBalancerAttributes(&attrs)
 		if err != nil {
-			return fmt.Errorf("Failure configuring elb attributes: %s", err)
+			return fmt.Errorf("Failure configuring ELB attributes: %s", err)
 		}
 
 		d.SetPartial("cross_zone_load_balancing")
@@ -434,7 +457,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 			_, err := elbconn.ModifyLoadBalancerAttributes(&attrs)
 			if err != nil {
-				return fmt.Errorf("Failure configuring elb attributes: %s", err)
+				return fmt.Errorf("Failure configuring ELB attributes: %s", err)
 			}
 
 			d.SetPartial("connection_draining_timeout")
@@ -454,7 +477,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 		_, err := elbconn.ModifyLoadBalancerAttributes(&attrs)
 		if err != nil {
-			return fmt.Errorf("Failure configuring elb attributes: %s", err)
+			return fmt.Errorf("Failure configuring ELB attributes: %s", err)
 		}
 
 		d.SetPartial("connection_draining")
@@ -476,7 +499,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 			}
 			_, err := elbconn.ConfigureHealthCheck(&configureHealthCheckOpts)
 			if err != nil {
-				return fmt.Errorf("Failure configuring health check: %s", err)
+				return fmt.Errorf("Failure configuring health check for ELB: %s", err)
 			}
 			d.SetPartial("health_check")
 		}
@@ -492,7 +515,7 @@ func resourceAwsElbUpdate(d *schema.ResourceData, meta interface{}) error {
 
 		_, err := elbconn.ApplySecurityGroupsToLoadBalancer(&applySecurityGroupsOpts)
 		if err != nil {
-			return fmt.Errorf("Failure applying security groups: %s", err)
+			return fmt.Errorf("Failure applying security groups to ELB: %s", err)
 		}
 
 		d.SetPartial("security_groups")
@@ -540,9 +563,11 @@ func resourceAwsElbListenerHash(v interface{}) int {
 	var buf bytes.Buffer
 	m := v.(map[string]interface{})
 	buf.WriteString(fmt.Sprintf("%d-", m["instance_port"].(int)))
-	buf.WriteString(fmt.Sprintf("%s-", m["instance_protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-",
+		strings.ToLower(m["instance_protocol"].(string))))
 	buf.WriteString(fmt.Sprintf("%d-", m["lb_port"].(int)))
-	buf.WriteString(fmt.Sprintf("%s-", m["lb_protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-",
+		strings.ToLower(m["lb_protocol"].(string))))
 
 	if v, ok := m["ssl_certificate_id"]; ok {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
@@ -552,6 +577,6 @@ func resourceAwsElbListenerHash(v interface{}) int {
 }
 
 func isLoadBalancerNotFound(err error) bool {
-	elberr, ok := err.(aws.APIError)
-	return ok && elberr.Code == "LoadBalancerNotFound"
+	elberr, ok := err.(awserr.Error)
+	return ok && elberr.Code() == "LoadBalancerNotFound"
 }
diff --git a/builtin/providers/aws/resource_aws_elb_test.go b/builtin/providers/aws/resource_aws_elb_test.go
index 17cda3899..ea56bf1da 100644
--- a/builtin/providers/aws/resource_aws_elb_test.go
+++ b/builtin/providers/aws/resource_aws_elb_test.go
@@ -7,8 +7,9 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -53,6 +54,26 @@ func TestAccAWSELB_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSELB_fullCharacterRange(t *testing.T) {
+	var conf elb.LoadBalancerDescription
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSELBDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSELBFullRangeOfCharacters,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSELBExists("aws_elb.foo", &conf),
+					resource.TestCheckResourceAttr(
+						"aws_elb.foo", "name", "FoobarTerraform-test123"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSELB_tags(t *testing.T) {
 	var conf elb.LoadBalancerDescription
 	var td elb.TagDescription
@@ -361,6 +382,39 @@ func TestAccAWSELB_SecurityGroups(t *testing.T) {
 	})
 }
 
+// Unit test for listeners hash
+func TestResourceAwsElbListenerHash(t *testing.T) {
+	cases := map[string]struct {
+		Left  map[string]interface{}
+		Right map[string]interface{}
+		Match bool
+	}{
+		"protocols are case insensitive": {
+			map[string]interface{}{
+				"instance_port":     80,
+				"instance_protocol": "TCP",
+				"lb_port":           80,
+				"lb_protocol":       "TCP",
+			},
+			map[string]interface{}{
+				"instance_port":     80,
+				"instance_protocol": "Tcp",
+				"lb_port":           80,
+				"lb_protocol":       "tcP",
+			},
+			true,
+		},
+	}
+
+	for tn, tc := range cases {
+		leftHash := resourceAwsElbListenerHash(tc.Left)
+		rightHash := resourceAwsElbListenerHash(tc.Right)
+		if (leftHash == rightHash) != tc.Match {
+			t.Fatalf("%s: expected match: %t, but did not get it", tn, tc.Match)
+		}
+	}
+}
+
 func testAccCheckAWSELBDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).elbconn
 
@@ -381,12 +435,12 @@ func testAccCheckAWSELBDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		providerErr, ok := err.(aws.APIError)
+		providerErr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 
-		if providerErr.Code != "InvalidLoadBalancerName.NotFound" {
+		if providerErr.Code() != "InvalidLoadBalancerName.NotFound" {
 			return fmt.Errorf("Unexpected error: %s", err)
 		}
 	}
@@ -512,7 +566,8 @@ resource "aws_elb" "bar" {
     instance_port = 8000
     instance_protocol = "http"
     lb_port = 80
-    lb_protocol = "http"
+    // Protocol should be case insensitive
+    lb_protocol = "HttP"
   }
 
 	tags {
@@ -523,6 +578,20 @@ resource "aws_elb" "bar" {
 }
 `
 
+const testAccAWSELBFullRangeOfCharacters = `
+resource "aws_elb" "foo" {
+  name = "FoobarTerraform-test123"
+  availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
+
+  listener {
+    instance_port = 8000
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+}
+`
+
 const testAccAWSELBConfig_TagUpdate = `
 resource "aws_elb" "bar" {
   name = "foobar-terraform-test"
diff --git a/builtin/providers/aws/resource_aws_flow_log.go b/builtin/providers/aws/resource_aws_flow_log.go
new file mode 100644
index 000000000..39b3c7566
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_flow_log.go
@@ -0,0 +1,155 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsFlowLog() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsLogFlowCreate,
+		Read:   resourceAwsLogFlowRead,
+		Delete: resourceAwsLogFlowDelete,
+
+		Schema: map[string]*schema.Schema{
+			"iam_role_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"log_group_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"vpc_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"subnet_id", "eni_id"},
+			},
+
+			"subnet_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"eni_id", "vpc_id"},
+			},
+
+			"eni_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"subnet_id", "vpc_id"},
+			},
+
+			"traffic_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsLogFlowCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	types := []struct {
+		ID   string
+		Type string
+	}{
+		{ID: d.Get("vpc_id").(string), Type: "VPC"},
+		{ID: d.Get("subnet_id").(string), Type: "Subnet"},
+		{ID: d.Get("eni_id").(string), Type: "NetworkInterface"},
+	}
+
+	var resourceId string
+	var resourceType string
+	for _, t := range types {
+		if t.ID != "" {
+			resourceId = t.ID
+			resourceType = t.Type
+			break
+		}
+	}
+
+	if resourceId == "" || resourceType == "" {
+		return fmt.Errorf("Error: Flow Logs require either a VPC, Subnet, or ENI ID")
+	}
+
+	opts := &ec2.CreateFlowLogsInput{
+		DeliverLogsPermissionARN: aws.String(d.Get("iam_role_arn").(string)),
+		LogGroupName:             aws.String(d.Get("log_group_name").(string)),
+		ResourceIDs:              []*string{aws.String(resourceId)},
+		ResourceType:             aws.String(resourceType),
+		TrafficType:              aws.String(d.Get("traffic_type").(string)),
+	}
+
+	log.Printf(
+		"[DEBUG] Flow Log Create configuration: %s", awsutil.StringValue(opts))
+	resp, err := conn.CreateFlowLogs(opts)
+	if err != nil {
+		return fmt.Errorf("Error creating Flow Log for (%s), error: %s", resourceId, err)
+	}
+
+	if len(resp.FlowLogIDs) > 1 {
+		return fmt.Errorf("Error: multiple Flow Logs created for (%s)", resourceId)
+	}
+
+	d.SetId(*resp.FlowLogIDs[0])
+
+	return resourceAwsLogFlowRead(d, meta)
+}
+
+func resourceAwsLogFlowRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	opts := &ec2.DescribeFlowLogsInput{
+		FlowLogIDs: []*string{aws.String(d.Id())},
+	}
+
+	resp, err := conn.DescribeFlowLogs(opts)
+	if err != nil {
+		log.Printf("[WARN] Error describing Flow Logs for id (%s)", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if len(resp.FlowLogs) == 0 {
+		log.Printf("[WARN] No Flow Logs found for id (%s)", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	fl := resp.FlowLogs[0]
+
+	d.Set("traffic_type", fl.TrafficType)
+	d.Set("log_group_name", fl.LogGroupName)
+	d.Set("iam_role_arn", fl.DeliverLogsPermissionARN)
+
+	return nil
+}
+
+func resourceAwsLogFlowDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	log.Printf(
+		"[DEBUG] Flow Log Destroy: %s", d.Id())
+	_, err := conn.DeleteFlowLogs(&ec2.DeleteFlowLogsInput{
+		FlowLogIDs: []*string{aws.String(d.Id())},
+	})
+
+	if err != nil {
+		return fmt.Errorf("[WARN] Error deleting Flow Log with ID (%s), error: %s", d.Id(), err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_flow_log_test.go b/builtin/providers/aws/resource_aws_flow_log_test.go
new file mode 100644
index 000000000..b938a6fea
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_flow_log_test.go
@@ -0,0 +1,212 @@
+package aws
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccFlowLog_basic(t *testing.T) {
+	var flowLog ec2.FlowLog
+	lgn := os.Getenv("LOG_GROUP_NAME")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckFlowLogDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: fmt.Sprintf(testAccFlowLogConfig_basic, lgn),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFlowLogExists("aws_flow_log.test_flow_log", &flowLog),
+					testAccCheckAWSFlowLogAttributes(&flowLog),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFlowLog_subnet(t *testing.T) {
+	var flowLog ec2.FlowLog
+	lgn := os.Getenv("LOG_GROUP_NAME")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckFlowLogDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: fmt.Sprintf(testAccFlowLogConfig_subnet, lgn),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFlowLogExists("aws_flow_log.test_flow_log_subnet", &flowLog),
+					testAccCheckAWSFlowLogAttributes(&flowLog),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckFlowLogExists(n string, flowLog *ec2.FlowLog) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Flow Log ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+		describeOpts := &ec2.DescribeFlowLogsInput{
+			FlowLogIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeFlowLogs(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		if len(resp.FlowLogs) > 0 {
+			*flowLog = *resp.FlowLogs[0]
+			return nil
+		}
+		return fmt.Errorf("No Flow Logs found for id (%s)", rs.Primary.ID)
+	}
+}
+
+func testAccCheckAWSFlowLogAttributes(flowLog *ec2.FlowLog) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if flowLog.FlowLogStatus != nil && *flowLog.FlowLogStatus == "ACTIVE" {
+			return nil
+		}
+		if flowLog.FlowLogStatus == nil {
+			return fmt.Errorf("Flow Log status is not ACTIVE, is nil")
+		} else {
+			return fmt.Errorf("Flow Log status is not ACTIVE, got: %s", *flowLog.FlowLogStatus)
+		}
+	}
+}
+
+func testAccCheckFlowLogDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_flow_log" {
+			continue
+		}
+
+		return nil
+	}
+
+	return nil
+}
+
+var testAccFlowLogConfig_basic = `
+resource "aws_vpc" "default" {
+        cidr_block = "10.0.0.0/16"
+        tags {
+                Name = "tf-flow-log-test"
+        }
+}
+
+resource "aws_subnet" "test_subnet" {
+        vpc_id = "${aws_vpc.default.id}"
+        cidr_block = "10.0.1.0/24"
+
+        tags {
+                Name = "tf-flow-test"
+        }
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "ec2.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_flow_log" "test_flow_log" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "tf-test-log-group"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        vpc_id = "${aws_vpc.default.id}"
+        traffic_type = "ALL"
+}
+
+resource "aws_flow_log" "test_flow_log_subnet" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "%s"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        subnet_id = "${aws_subnet.test_subnet.id}"
+        traffic_type = "ALL"
+}
+`
+
+var testAccFlowLogConfig_subnet = `
+resource "aws_vpc" "default" {
+        cidr_block = "10.0.0.0/16"
+        tags {
+                Name = "tf-flow-log-test"
+        }
+}
+
+resource "aws_subnet" "test_subnet" {
+        vpc_id = "${aws_vpc.default.id}"
+        cidr_block = "10.0.1.0/24"
+
+        tags {
+                Name = "tf-flow-test"
+        }
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "ec2.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_flow_log" "test_flow_log_subnet" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "%s"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        subnet_id = "${aws_subnet.test_subnet.id}"
+        traffic_type = "ALL"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_access_key.go b/builtin/providers/aws/resource_aws_iam_access_key.go
index efeec62f7..943a22edb 100644
--- a/builtin/providers/aws/resource_aws_iam_access_key.go
+++ b/builtin/providers/aws/resource_aws_iam_access_key.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -71,7 +72,7 @@ func resourceAwsIamAccessKeyRead(d *schema.ResourceData, meta interface{}) error
 
 	getResp, err := iamconn.ListAccessKeys(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX TEST ME
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX TEST ME
 			// the user does not exist, so the key can't exist.
 			d.SetId("")
 			return nil
diff --git a/builtin/providers/aws/resource_aws_iam_access_key_test.go b/builtin/providers/aws/resource_aws_iam_access_key_test.go
index 0aacc058d..1d62b93b9 100644
--- a/builtin/providers/aws/resource_aws_iam_access_key_test.go
+++ b/builtin/providers/aws/resource_aws_iam_access_key_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSAccessKey_normal(t *testing.T) {
+func TestAccAWSAccessKey_basic(t *testing.T) {
 	var conf iam.AccessKeyMetadata
 
 	resource.Test(t, resource.TestCase{
@@ -49,11 +50,11 @@ func testAccCheckAWSAccessKeyDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "NoSuchEntity" {
+		if ec2err.Code() != "NoSuchEntity" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_iam_group.go b/builtin/providers/aws/resource_aws_iam_group.go
index 1d0bc6cf4..6909ee259 100644
--- a/builtin/providers/aws/resource_aws_iam_group.go
+++ b/builtin/providers/aws/resource_aws_iam_group.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -66,7 +67,7 @@ func resourceAwsIamGroupRead(d *schema.ResourceData, meta interface{}) error {
 
 	getResp, err := iamconn.GetGroup(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" {
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_group_membership.go b/builtin/providers/aws/resource_aws_iam_group_membership.go
new file mode 100644
index 000000000..c90511cd6
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_group_membership.go
@@ -0,0 +1,156 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamGroupMembership() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIamGroupMembershipCreate,
+		Read:   resourceAwsIamGroupMembershipRead,
+		Update: resourceAwsIamGroupMembershipUpdate,
+		Delete: resourceAwsIamGroupMembershipDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"users": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+
+			"group": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIamGroupMembershipCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	group := d.Get("group").(string)
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
+
+	if err := addUsersToGroup(conn, userList, group); err != nil {
+		return err
+	}
+
+	d.SetId(d.Get("name").(string))
+	return resourceAwsIamGroupMembershipRead(d, meta)
+}
+
+func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	group := d.Get("group").(string)
+	resp, err := conn.GetGroup(&iam.GetGroupInput{
+		GroupName: aws.String(group),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			// aws specific error
+			if awsErr.Code() == "NoSuchEntity" {
+				// group not found
+				d.SetId("")
+				return nil
+			}
+		}
+		return err
+	}
+
+	ul := make([]string, 0, len(resp.Users))
+	for _, u := range resp.Users {
+		ul = append(ul, *u.UserName)
+	}
+
+	if err := d.Set("users", ul); err != nil {
+		return fmt.Errorf("[WARN] Error setting user list from IAM Group Membership (%s), error: %s", group, err)
+	}
+
+	return nil
+}
+
+func resourceAwsIamGroupMembershipUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	if d.HasChange("users") {
+		group := d.Get("group").(string)
+
+		o, n := d.GetChange("users")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+		remove := expandStringList(os.Difference(ns).List())
+		add := expandStringList(ns.Difference(os).List())
+
+		if err := removeUsersFromGroup(conn, remove, group); err != nil {
+			return err
+		}
+
+		if err := addUsersToGroup(conn, add, group); err != nil {
+			return err
+		}
+	}
+
+	return resourceAwsIamGroupMembershipRead(d, meta)
+}
+
+func resourceAwsIamGroupMembershipDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
+	group := d.Get("group").(string)
+
+	if err := removeUsersFromGroup(conn, userList, group); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func removeUsersFromGroup(conn *iam.IAM, users []*string, group string) error {
+	for _, u := range users {
+		_, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func addUsersToGroup(conn *iam.IAM, users []*string, group string) error {
+	for _, u := range users {
+		_, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_iam_group_membership_test.go b/builtin/providers/aws/resource_aws_iam_group_membership_test.go
new file mode 100644
index 000000000..fc868cb7c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_group_membership_test.go
@@ -0,0 +1,169 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSGroupMembership_basic(t *testing.T) {
+	var group iam.GetGroupOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSGroupMembershipDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSGroupMemberConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSGroupMembershipExists("aws_iam_group_membership.team", &group),
+					testAccCheckAWSGroupMembershipAttributes(&group, []string{"test-user"}),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSGroupMemberConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSGroupMembershipExists("aws_iam_group_membership.team", &group),
+					testAccCheckAWSGroupMembershipAttributes(&group, []string{"test-user-two", "test-user-three"}),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iamconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iam_group_membership" {
+			continue
+		}
+
+		group := rs.Primary.Attributes["group"]
+
+		resp, err := conn.GetGroup(&iam.GetGroupInput{
+			GroupName: aws.String(group),
+		})
+		if err != nil {
+			// might error here
+			return err
+		}
+
+		users := []string{"test-user", "test-user-two", "test-user-three"}
+		for _, u := range resp.Users {
+			for _, i := range users {
+				if i == *u.UserName {
+					return fmt.Errorf("Error: User (%s) still a member of Group (%s)", i, *resp.Group.GroupName)
+				}
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func testAccCheckAWSGroupMembershipExists(n string, g *iam.GetGroupOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No User name is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		gn := rs.Primary.Attributes["group"]
+
+		resp, err := conn.GetGroup(&iam.GetGroupInput{
+			GroupName: aws.String(gn),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error: Group (%s) not found", gn)
+		}
+
+		*g = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckAWSGroupMembershipAttributes(group *iam.GetGroupOutput, users []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if *group.Group.GroupName != "test-group" {
+			return fmt.Errorf("Bad group membership: expected %s, got %s", "test-group", *group.Group.GroupName)
+		}
+
+		uc := len(users)
+		for _, u := range users {
+			for _, gu := range group.Users {
+				if u == *gu.UserName {
+					uc--
+				}
+			}
+		}
+
+		if uc > 0 {
+			return fmt.Errorf("Bad group membership count, expected (%d), but only (%d) found", len(users), uc)
+		}
+		return nil
+	}
+}
+
+const testAccAWSGroupMemberConfig = `
+resource "aws_iam_group" "group" {
+	name = "test-group"
+	path = "/"
+}
+
+resource "aws_iam_user" "user" {
+	name = "test-user"
+	path = "/"
+}
+
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = ["${aws_iam_user.user.name}"]
+	group = "${aws_iam_group.group.name}"
+}
+`
+
+const testAccAWSGroupMemberConfigUpdate = `
+resource "aws_iam_group" "group" {
+	name = "test-group"
+	path = "/"
+}
+
+resource "aws_iam_user" "user" {
+	name = "test-user"
+	path = "/"
+}
+
+resource "aws_iam_user" "user_two" {
+	name = "test-user-two"
+	path = "/"
+}
+
+resource "aws_iam_user" "user_three" {
+	name = "test-user-three"
+	path = "/"
+}
+
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = [
+		"${aws_iam_user.user_two.name}",
+		"${aws_iam_user.user_three.name}",
+	]
+	group = "${aws_iam_group.group.name}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_group_policy.go b/builtin/providers/aws/resource_aws_iam_group_policy.go
index 51190aa5f..2c16fe1c6 100644
--- a/builtin/providers/aws/resource_aws_iam_group_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_group_policy.go
@@ -5,8 +5,9 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -66,9 +67,10 @@ func resourceAwsIamGroupPolicyRead(d *schema.ResourceData, meta interface{}) err
 		GroupName:  aws.String(group),
 	}
 
+	var err error
 	getResp, err := iamconn.GetGroupPolicy(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX test me
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_group_policy_test.go b/builtin/providers/aws/resource_aws_iam_group_policy_test.go
index 1778d5216..ac7a3baaa 100644
--- a/builtin/providers/aws/resource_aws_iam_group_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_group_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMGroupPolicy(t *testing.T) {
+func TestAccAWSIAMGroupPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_group_test.go b/builtin/providers/aws/resource_aws_iam_group_test.go
index 389161017..67a72733a 100644
--- a/builtin/providers/aws/resource_aws_iam_group_test.go
+++ b/builtin/providers/aws/resource_aws_iam_group_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMGroup_normal(t *testing.T) {
+func TestAccAWSIAMGroup_basic(t *testing.T) {
 	var conf iam.GetGroupOutput
 
 	resource.Test(t, resource.TestCase{
@@ -46,11 +47,11 @@ func testAccCheckAWSGroupDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "NoSuchEntity" {
+		if ec2err.Code() != "NoSuchEntity" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_iam_instance_profile.go b/builtin/providers/aws/resource_aws_iam_instance_profile.go
index 7a69ae2da..04e9c6dcc 100644
--- a/builtin/providers/aws/resource_aws_iam_instance_profile.go
+++ b/builtin/providers/aws/resource_aws_iam_instance_profile.go
@@ -2,9 +2,11 @@ package aws
 
 import (
 	"fmt"
+	"regexp"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -33,6 +35,19 @@ func resourceAwsIamInstanceProfile() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8196-L8201
+					value := v.(string)
+					if len(value) > 128 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 128 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"path": &schema.Schema{
 				Type:     schema.TypeString,
@@ -59,6 +74,7 @@ func resourceAwsIamInstanceProfileCreate(d *schema.ResourceData, meta interface{
 		Path:                aws.String(d.Get("path").(string)),
 	}
 
+	var err error
 	response, err := iamconn.CreateInstanceProfile(request)
 	if err == nil {
 		err = instanceProfileReadResult(d, response.InstanceProfile)
@@ -87,7 +103,7 @@ func instanceProfileRemoveRole(iamconn *iam.IAM, profileName, roleName string) e
 	}
 
 	_, err := iamconn.RemoveRoleFromInstanceProfile(request)
-	if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" {
+	if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
 		return nil
 	}
 	return err
@@ -156,7 +172,7 @@ func resourceAwsIamInstanceProfileRead(d *schema.ResourceData, meta interface{})
 
 	result, err := iamconn.GetInstanceProfile(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" {
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_instance_profile_test.go b/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
index ae1d66c90..985729aad 100644
--- a/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
+++ b/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
@@ -6,7 +6,7 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 )
 
-func TestAccAWSIAMInstanceProfile(t *testing.T) {
+func TestAccAWSIAMInstanceProfile_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:  func() { testAccPreCheck(t) },
 		Providers: testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_policy.go b/builtin/providers/aws/resource_aws_iam_policy.go
index 9d4e3d6dd..9ace92b21 100644
--- a/builtin/providers/aws/resource_aws_iam_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_policy.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -58,7 +59,7 @@ func resourceAwsIamPolicyCreate(d *schema.ResourceData, meta interface{}) error
 
 	response, err := iamconn.CreatePolicy(request)
 	if err != nil {
-		return fmt.Errorf("Error creating IAM policy %s: %#v", name, err)
+		return fmt.Errorf("Error creating IAM policy %s: %s", name, err)
 	}
 
 	return readIamPolicy(d, response.Policy)
@@ -73,11 +74,11 @@ func resourceAwsIamPolicyRead(d *schema.ResourceData, meta interface{}) error {
 
 	response, err := iamconn.GetPolicy(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" {
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
 			d.SetId("")
 			return nil
 		}
-		return fmt.Errorf("Error reading IAM policy %s: %#v", d.Id(), err)
+		return fmt.Errorf("Error reading IAM policy %s: %s", d.Id(), err)
 	}
 
 	return readIamPolicy(d, response.Policy)
@@ -100,7 +101,7 @@ func resourceAwsIamPolicyUpdate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	if _, err := iamconn.CreatePolicyVersion(request); err != nil {
-		return fmt.Errorf("Error updating IAM policy %s: %#v", d.Id(), err)
+		return fmt.Errorf("Error updating IAM policy %s: %s", d.Id(), err)
 	}
 	return nil
 }
@@ -118,7 +119,7 @@ func resourceAwsIamPolicyDelete(d *schema.ResourceData, meta interface{}) error
 
 	_, err := iamconn.DeletePolicy(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" {
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
 			return nil
 		}
 		return fmt.Errorf("Error reading IAM policy %s: %#v", d.Id(), err)
@@ -186,7 +187,7 @@ func iamPolicyDeleteVersion(arn, versionID string, iamconn *iam.IAM) error {
 
 	_, err := iamconn.DeletePolicyVersion(request)
 	if err != nil {
-		return fmt.Errorf("Error deleting version %s from IAM policy %s: %#v", versionID, arn, err)
+		return fmt.Errorf("Error deleting version %s from IAM policy %s: %s", versionID, arn, err)
 	}
 	return nil
 }
@@ -198,7 +199,7 @@ func iamPolicyListVersions(arn string, iamconn *iam.IAM) ([]*iam.PolicyVersion,
 
 	response, err := iamconn.ListPolicyVersions(request)
 	if err != nil {
-		return nil, fmt.Errorf("Error listing versions for IAM policy %s: %#v", arn, err)
+		return nil, fmt.Errorf("Error listing versions for IAM policy %s: %s", arn, err)
 	}
 	return response.Versions, nil
 }
diff --git a/builtin/providers/aws/resource_aws_iam_policy_attachment.go b/builtin/providers/aws/resource_aws_iam_policy_attachment.go
new file mode 100644
index 000000000..a9028c57c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_policy_attachment.go
@@ -0,0 +1,328 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamPolicyAttachment() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIamPolicyAttachmentCreate,
+		Read:   resourceAwsIamPolicyAttachmentRead,
+		Update: resourceAwsIamPolicyAttachmentUpdate,
+		Delete: resourceAwsIamPolicyAttachmentDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"users": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"roles": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"groups": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"policy_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIamPolicyAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	name := d.Get("name").(string)
+	arn := d.Get("policy_arn").(string)
+	users := expandStringList(d.Get("users").(*schema.Set).List())
+	roles := expandStringList(d.Get("roles").(*schema.Set).List())
+	groups := expandStringList(d.Get("groups").(*schema.Set).List())
+
+	if len(users) > 0 && len(roles) > 0 && len(groups) > 0 {
+		return fmt.Errorf("[WARN] No Users, Roles, or Groups specified for IAM Policy Attachment %s", name)
+	} else {
+		var userErr, roleErr, groupErr error
+		if users != nil {
+			userErr = attachPolicyToUsers(conn, users, arn)
+		}
+		if roles != nil {
+			roleErr = attachPolicyToRoles(conn, roles, arn)
+		}
+		if groups != nil {
+			groupErr = attachPolicyToGroups(conn, groups, arn)
+		}
+		if userErr != nil || roleErr != nil || groupErr != nil {
+			return composeErrors(fmt.Sprint("[WARN] Error attaching policy with IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+		}
+	}
+	d.SetId(d.Get("name").(string))
+	return resourceAwsIamPolicyAttachmentRead(d, meta)
+}
+
+func resourceAwsIamPolicyAttachmentRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	arn := d.Get("policy_arn").(string)
+	name := d.Get("name").(string)
+
+	_, err := conn.GetPolicy(&iam.GetPolicyInput{
+		PolicyARN: aws.String(arn),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			if awsErr.Code() == "NoSuchIdentity" {
+				d.SetId("")
+				return nil
+			}
+		}
+		return err
+	}
+
+	policyEntities, err := conn.ListEntitiesForPolicy(&iam.ListEntitiesForPolicyInput{
+		PolicyARN: aws.String(arn),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	ul := make([]string, 0, len(policyEntities.PolicyUsers))
+	rl := make([]string, 0, len(policyEntities.PolicyRoles))
+	gl := make([]string, 0, len(policyEntities.PolicyGroups))
+
+	for _, u := range policyEntities.PolicyUsers {
+		ul = append(ul, *u.UserName)
+	}
+
+	for _, r := range policyEntities.PolicyRoles {
+		rl = append(rl, *r.RoleName)
+	}
+
+	for _, g := range policyEntities.PolicyGroups {
+		gl = append(gl, *g.GroupName)
+	}
+
+	userErr := d.Set("users", ul)
+	roleErr := d.Set("roles", rl)
+	groupErr := d.Set("groups", gl)
+
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN} Error setting user, role, or group list from IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+	}
+
+	return nil
+}
+func resourceAwsIamPolicyAttachmentUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	name := d.Get("name").(string)
+	var userErr, roleErr, groupErr error
+
+	if d.HasChange("users") {
+		userErr = updateUsers(conn, d, meta)
+	}
+	if d.HasChange("roles") {
+		roleErr = updateRoles(conn, d, meta)
+	}
+	if d.HasChange("groups") {
+		groupErr = updateGroups(conn, d, meta)
+	}
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN] Error updating user, role, or group list from IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+	}
+	return resourceAwsIamPolicyAttachmentRead(d, meta)
+}
+
+func resourceAwsIamPolicyAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	name := d.Get("name").(string)
+	arn := d.Get("policy_arn").(string)
+	users := expandStringList(d.Get("users").(*schema.Set).List())
+	roles := expandStringList(d.Get("roles").(*schema.Set).List())
+	groups := expandStringList(d.Get("groups").(*schema.Set).List())
+
+	var userErr, roleErr, groupErr error
+	if len(users) != 0 {
+		userErr = detachPolicyFromUsers(conn, users, arn)
+	}
+	if len(roles) != 0 {
+		roleErr = detachPolicyFromRoles(conn, roles, arn)
+	}
+	if len(groups) != 0 {
+		groupErr = detachPolicyFromGroups(conn, groups, arn)
+	}
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN] Error removing user, role, or group list from IAM Policy Detach ", name, ":"), userErr, roleErr, groupErr)
+	}
+	return nil
+}
+
+func composeErrors(desc string, uErr error, rErr error, gErr error) error {
+	errMsg := fmt.Sprintf(desc)
+	errs := []error{uErr, rErr, gErr}
+	for _, e := range errs {
+		if e != nil {
+			errMsg = errMsg + "\n– " + e.Error()
+		}
+	}
+	return fmt.Errorf(errMsg)
+}
+
+func attachPolicyToUsers(conn *iam.IAM, users []*string, arn string) error {
+	for _, u := range users {
+		_, err := conn.AttachUserPolicy(&iam.AttachUserPolicyInput{
+			UserName:  u,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func attachPolicyToRoles(conn *iam.IAM, roles []*string, arn string) error {
+	for _, r := range roles {
+		_, err := conn.AttachRolePolicy(&iam.AttachRolePolicyInput{
+			RoleName:  r,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func attachPolicyToGroups(conn *iam.IAM, groups []*string, arn string) error {
+	for _, g := range groups {
+		_, err := conn.AttachGroupPolicy(&iam.AttachGroupPolicyInput{
+			GroupName: g,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func updateUsers(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("users")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromUsers(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToUsers(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+}
+func updateRoles(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("roles")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromRoles(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToRoles(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+}
+func updateGroups(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("groups")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromGroups(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToGroups(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+
+}
+func detachPolicyFromUsers(conn *iam.IAM, users []*string, arn string) error {
+	for _, u := range users {
+		_, err := conn.DetachUserPolicy(&iam.DetachUserPolicyInput{
+			UserName:  u,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func detachPolicyFromRoles(conn *iam.IAM, roles []*string, arn string) error {
+	for _, r := range roles {
+		_, err := conn.DetachRolePolicy(&iam.DetachRolePolicyInput{
+			RoleName:  r,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func detachPolicyFromGroups(conn *iam.IAM, groups []*string, arn string) error {
+	for _, g := range groups {
+		_, err := conn.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
+			GroupName: g,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go b/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go
new file mode 100644
index 000000000..3e6ef445d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go
@@ -0,0 +1,213 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"testing"
+)
+
+func TestAccAWSPolicyAttachment_basic(t *testing.T) {
+	var out iam.ListEntitiesForPolicyOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSPolicyAttachmentDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSPolicyAttachConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSPolicyAttachmentExists("aws_iam_policy_attachment.test-attachment", 3, &out),
+					testAccCheckAWSPolicyAttachmentAttributes([]string{"test-user"}, []string{"test-role"}, []string{"test-group"}, &out),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSPolicyAttachConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSPolicyAttachmentExists("aws_iam_policy_attachment.test-attachment", 6, &out),
+					testAccCheckAWSPolicyAttachmentAttributes([]string{"test-user3", "test-user3"}, []string{"test-role2", "test-role3"}, []string{"test-group2", "test-group3"}, &out),
+				),
+			},
+		},
+	})
+}
+func testAccCheckAWSPolicyAttachmentDestroy(s *terraform.State) error {
+
+	return nil
+}
+
+func testAccCheckAWSPolicyAttachmentExists(n string, c int64, out *iam.ListEntitiesForPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No policy name is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		arn := rs.Primary.Attributes["policy_arn"]
+
+		resp, err := conn.GetPolicy(&iam.GetPolicyInput{
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return fmt.Errorf("Error: Policy (%s) not found", n)
+		}
+		if c != *resp.Policy.AttachmentCount {
+			return fmt.Errorf("Error: Policy (%s) has wrong number of entities attached on initial creation", n)
+		}
+		resp2, err := conn.ListEntitiesForPolicy(&iam.ListEntitiesForPolicyInput{
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return fmt.Errorf("Error: Failed to get entities for Policy (%s)", arn)
+		}
+
+		*out = *resp2
+		return nil
+	}
+}
+func testAccCheckAWSPolicyAttachmentAttributes(users []string, roles []string, groups []string, out *iam.ListEntitiesForPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		uc := len(users)
+		rc := len(roles)
+		gc := len(groups)
+
+		for _, u := range users {
+			for _, pu := range out.PolicyUsers {
+				if u == *pu.UserName {
+					uc--
+				}
+			}
+		}
+		for _, r := range roles {
+			for _, pr := range out.PolicyRoles {
+				if r == *pr.RoleName {
+					rc--
+				}
+			}
+		}
+		for _, g := range users {
+			for _, pg := range out.PolicyGroups {
+				if g == *pg.GroupName {
+					gc--
+				}
+			}
+		}
+		if uc != 0 || rc != 0 || gc != 0 {
+			return fmt.Errorf("Error: Number of attached users, roles, or groups was incorrect:\n expected %d users and found %d\nexpected %d roles and found %d\nexpected %d groups and found %d", len(users), (len(users) - uc), len(roles), (len(roles) - rc), len(groups), (len(groups) - gc))
+		}
+		return nil
+	}
+}
+
+const testAccAWSPolicyAttachConfig = `
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:ChangePassword"
+      ],
+      "Resource": "*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = ["${aws_iam_user.user.name}"]
+    roles = ["${aws_iam_role.role.name}"]
+    groups = ["${aws_iam_group.group.name}"]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+`
+
+const testAccAWSPolicyAttachConfigUpdate = `
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_user" "user2" {
+    name = "test-user2"
+}
+resource "aws_iam_user" "user3" {
+    name = "test-user3"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_role" "role2" {
+    name = "test-role2"
+}
+resource "aws_iam_role" "role3" {
+    name = "test-role3"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+resource "aws_iam_group" "group2" {
+    name = "test-group2"
+}
+resource "aws_iam_group" "group3" {
+    name = "test-group3"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:ChangePassword"
+      ],
+      "Resource": "*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = [
+        "${aws_iam_user.user2.name}",
+        "${aws_iam_user.user3.name}"
+    ]
+    roles = [
+        "${aws_iam_role.role2.name}",
+        "${aws_iam_role.role3.name}"
+    ]
+    groups = [
+        "${aws_iam_group.group2.name}",
+        "${aws_iam_group.group3.name}"
+    ]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_role.go b/builtin/providers/aws/resource_aws_iam_role.go
index 6a9bdc00a..d8cd00cdc 100644
--- a/builtin/providers/aws/resource_aws_iam_role.go
+++ b/builtin/providers/aws/resource_aws_iam_role.go
@@ -2,9 +2,11 @@ package aws
 
 import (
 	"fmt"
+	"regexp"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -30,6 +32,19 @@ func resourceAwsIamRole() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8329-L8334
+					value := v.(string)
+					if len(value) > 64 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 64 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]*$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"path": &schema.Schema{
 				Type:     schema.TypeString,
@@ -72,7 +87,7 @@ func resourceAwsIamRoleRead(d *schema.ResourceData, meta interface{}) error {
 
 	getResp, err := iamconn.GetRole(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX test me
 			d.SetId("")
 			return nil
 		}
@@ -101,6 +116,27 @@ func resourceAwsIamRoleReadResult(d *schema.ResourceData, role *iam.Role) error
 func resourceAwsIamRoleDelete(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
+	// Roles cannot be destroyed when attached to an existing Instance Profile
+	resp, err := iamconn.ListInstanceProfilesForRole(&iam.ListInstanceProfilesForRoleInput{
+		RoleName: aws.String(d.Id()),
+	})
+	if err != nil {
+		return fmt.Errorf("Error listing Profiles for IAM Role (%s) when trying to delete: %s", d.Id(), err)
+	}
+
+	// Loop and remove this Role from any Profiles
+	if len(resp.InstanceProfiles) > 0 {
+		for _, i := range resp.InstanceProfiles {
+			_, err := iamconn.RemoveRoleFromInstanceProfile(&iam.RemoveRoleFromInstanceProfileInput{
+				InstanceProfileName: i.InstanceProfileName,
+				RoleName:            aws.String(d.Id()),
+			})
+			if err != nil {
+				return fmt.Errorf("Error deleting IAM Role %s: %s", d.Id(), err)
+			}
+		}
+	}
+
 	request := &iam.DeleteRoleInput{
 		RoleName: aws.String(d.Id()),
 	}
diff --git a/builtin/providers/aws/resource_aws_iam_role_policy.go b/builtin/providers/aws/resource_aws_iam_role_policy.go
index 0eb073a9d..1424bb621 100644
--- a/builtin/providers/aws/resource_aws_iam_role_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_role_policy.go
@@ -3,10 +3,12 @@ package aws
 import (
 	"fmt"
 	"net/url"
+	"regexp"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -29,6 +31,19 @@ func resourceAwsIamRolePolicy() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8291-L8296
+					value := v.(string)
+					if len(value) > 128 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 128 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"role": &schema.Schema{
 				Type:     schema.TypeString,
@@ -66,9 +81,10 @@ func resourceAwsIamRolePolicyRead(d *schema.ResourceData, meta interface{}) erro
 		RoleName:   aws.String(role),
 	}
 
+	var err error
 	getResp, err := iamconn.GetRolePolicy(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX test me
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_role_policy_test.go b/builtin/providers/aws/resource_aws_iam_role_policy_test.go
index a43fe94c8..219c676eb 100644
--- a/builtin/providers/aws/resource_aws_iam_role_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_role_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMRolePolicy(t *testing.T) {
+func TestAccAWSIAMRolePolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_role_test.go b/builtin/providers/aws/resource_aws_iam_role_test.go
index d7f05fcfc..e61d49b2a 100644
--- a/builtin/providers/aws/resource_aws_iam_role_test.go
+++ b/builtin/providers/aws/resource_aws_iam_role_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRole_normal(t *testing.T) {
+func TestAccAWSRole_basic(t *testing.T) {
 	var conf iam.GetRoleOutput
 
 	resource.Test(t, resource.TestCase{
@@ -29,6 +30,31 @@ func TestAccAWSRole_normal(t *testing.T) {
 	})
 }
 
+func TestAccAWSRole_testNameChange(t *testing.T) {
+	var conf iam.GetRoleOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSRoleDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSRolePre,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSRoleExists("aws_iam_role.role_update_test", &conf),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSRolePost,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSRoleExists("aws_iam_role.role_update_test", &conf),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSRoleDestroy(s *terraform.State) error {
 	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -46,11 +72,11 @@ func testAccCheckAWSRoleDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "NoSuchEntity" {
+		if ec2err.Code() != "NoSuchEntity" {
 			return err
 		}
 	}
@@ -104,3 +130,101 @@ resource "aws_iam_role" "role" {
 	assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"ec2.amazonaws.com\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
 }
 `
+
+const testAccAWSRolePre = `
+resource "aws_iam_role" "role_update_test" {
+  name = "tf_old_name"
+  path = "/test/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "role_update_test" {
+  name = "role_update_test"
+  role = "${aws_iam_role.role_update_test.id}"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListAllMyBuckets"
+      ],
+      "Resource": "arn:aws:s3:::*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "role_update_test" {
+  name = "role_update_test"
+  path = "/test/"
+  roles = ["${aws_iam_role.role_update_test.name}"]
+}
+
+`
+
+const testAccAWSRolePost = `
+resource "aws_iam_role" "role_update_test" {
+  name = "tf_new_name"
+  path = "/test/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "role_update_test" {
+  name = "role_update_test"
+  role = "${aws_iam_role.role_update_test.id}"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListAllMyBuckets"
+      ],
+      "Resource": "arn:aws:s3:::*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "role_update_test" {
+  name = "role_update_test"
+  path = "/test/"
+  roles = ["${aws_iam_role.role_update_test.name}"]
+}
+
+`
diff --git a/builtin/providers/aws/resource_aws_iam_server_certificate.go b/builtin/providers/aws/resource_aws_iam_server_certificate.go
new file mode 100644
index 000000000..ac1496133
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_server_certificate.go
@@ -0,0 +1,148 @@
+package aws
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIAMServerCertificate() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIAMServerCertificateCreate,
+		Read:   resourceAwsIAMServerCertificateRead,
+		Delete: resourceAwsIAMServerCertificateDelete,
+
+		Schema: map[string]*schema.Schema{
+			"certificate_body": &schema.Schema{
+				Type:      schema.TypeString,
+				Required:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"certificate_chain": &schema.Schema{
+				Type:      schema.TypeString,
+				Optional:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"path": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"private_key": &schema.Schema{
+				Type:      schema.TypeString,
+				Required:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIAMServerCertificateCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	createOpts := &iam.UploadServerCertificateInput{
+		CertificateBody:       aws.String(d.Get("certificate_body").(string)),
+		PrivateKey:            aws.String(d.Get("private_key").(string)),
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	}
+
+	if v, ok := d.GetOk("certificate_chain"); ok {
+		createOpts.CertificateChain = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("Path"); ok {
+		createOpts.Path = aws.String(v.(string))
+	}
+
+	resp, err := conn.UploadServerCertificate(createOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error uploading server certificate, error: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return fmt.Errorf("[WARN] Error uploading server certificate, error: %s", err)
+	}
+
+	d.SetId(*resp.ServerCertificateMetadata.ServerCertificateID)
+
+	return resourceAwsIAMServerCertificateRead(d, meta)
+}
+
+func resourceAwsIAMServerCertificateRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	resp, err := conn.GetServerCertificate(&iam.GetServerCertificateInput{
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error reading IAM Server Certificate: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return fmt.Errorf("[WARN] Error reading IAM Server Certificate: %s", err)
+	}
+
+	// these values should always be present, and have a default if not set in
+	// configuration, and so safe to reference with nil checks
+	d.Set("certificate_body", normalizeCert(resp.ServerCertificate.CertificateBody))
+	d.Set("certificate_chain", normalizeCert(resp.ServerCertificate.CertificateChain))
+	d.Set("path", resp.ServerCertificate.ServerCertificateMetadata.Path)
+	d.Set("arn", resp.ServerCertificate.ServerCertificateMetadata.ARN)
+
+	return nil
+}
+
+func resourceAwsIAMServerCertificateDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	_, err := conn.DeleteServerCertificate(&iam.DeleteServerCertificateInput{
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error deleting server certificate: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return err
+	}
+
+	d.SetId("")
+	return nil
+}
+
+func normalizeCert(cert interface{}) string {
+	if cert == nil {
+		return ""
+	}
+	switch cert.(type) {
+	case string:
+		hash := sha1.Sum([]byte(strings.TrimSpace(cert.(string))))
+		return hex.EncodeToString(hash[:])
+	case *string:
+		hash := sha1.Sum([]byte(strings.TrimSpace(*cert.(*string))))
+		return hex.EncodeToString(hash[:])
+	default:
+		return ""
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_iam_server_certificate_test.go b/builtin/providers/aws/resource_aws_iam_server_certificate_test.go
new file mode 100644
index 000000000..3165416fc
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_server_certificate_test.go
@@ -0,0 +1,191 @@
+package aws
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccIAMServerCertificate_basic(t *testing.T) {
+	var cert iam.ServerCertificate
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckIAMServerCertificateDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccIAMServerCertConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertExists("aws_iam_server_certificate.test_cert", &cert),
+					testAccCheckAWSServerCertAttributes(&cert),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCertExists(n string, cert *iam.ServerCertificate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Server Cert ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		describeOpts := &iam.GetServerCertificateInput{
+			ServerCertificateName: aws.String(rs.Primary.Attributes["name"]),
+		}
+		resp, err := conn.GetServerCertificate(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		*cert = *resp.ServerCertificate
+
+		return nil
+	}
+}
+
+func testAccCheckAWSServerCertAttributes(cert *iam.ServerCertificate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if !strings.HasPrefix(*cert.ServerCertificateMetadata.ServerCertificateName, "terraform-test-cert") {
+			return fmt.Errorf("Bad Server Cert Name: %s", *cert.ServerCertificateMetadata.ServerCertificateName)
+		}
+
+		if *cert.CertificateBody != strings.TrimSpace(certBody) {
+			return fmt.Errorf("Bad Server Cert body\n\t expected: %s\n\tgot: %s\n", certBody, *cert.CertificateBody)
+		}
+		return nil
+	}
+}
+
+func testAccCheckIAMServerCertificateDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iamconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iam_server_certificate" {
+			continue
+		}
+
+		// Try to find the Cert
+		opts := &iam.GetServerCertificateInput{
+			ServerCertificateName: aws.String(rs.Primary.Attributes["name"]),
+		}
+		resp, err := conn.GetServerCertificate(opts)
+		if err == nil {
+			if resp.ServerCertificate != nil {
+				return fmt.Errorf("Error: Server Cert still exists")
+			}
+
+			return nil
+		}
+
+	}
+
+	return nil
+}
+
+var certBody = fmt.Sprintf(`
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAfACAQEwDQYJKoZIhvcNAQELBQAwgY4xCzAJBgNVBAYTAlVTMREwDwYD
+VQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxFjAUBgNVBAoMDUJhcmVm
+b290IExhYnMxGDAWBgNVBAMMD0phc29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJ
+ARYYamFzb25AYmFyZWZvb3Rjb2RlcnMuY29tMB4XDTE1MDYyMTA1MzcwNVoXDTE2
+MDYyMDA1MzcwNVowgYgxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazEL
+MAkGA1UEBwwCTlkxFjAUBgNVBAoMDUJhcmVmb290IExhYnMxGDAWBgNVBAMMD0ph
+c29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJARYYamFzb25AYmFyZWZvb3Rjb2Rl
+cnMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2AVGKRIx+EFM0kkg7
+6GoJv9uy0biEDHB4phQBqnDIf8J8/gq9eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jD
+bI/yS+DOAjrh30vN79Au74jGN2Cw8fIak40iDUwjZaczK2Gkna54XIO9pqMcbQ6Q
+mLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCDGNvU
+eioQMVPNlmmxW3+Rwo0Kl+/HtUOmqUDKUDvJnelxulBr7O8w75N/Z7h7+aBJCUkt
+tz+DwATZswXtsal6TuzHHpAhpFql82jQZVE8OYkrX84XKRQpm8ZnbyZObMdXTJWk
+ArC/rGVIWsvhlbgGM8zu7a3zbeuAESZ8Bn4ZbJxnoaRK8p36/alvzAwkgzSf3oUX
+HtU4LrdunevBs6/CbKCWrxYcvNCy8EcmHitqCfQL5nxCCXpgf/Mw1vmIPTwbPSJq
+oUkh5yjGRKzhh7QbG1TlFX6zUp4vb+UJn5+g4edHrqivRSjIqYrC45ygVMOABn21
+hpMXOlZL+YXfR4Kp
+-----END CERTIFICATE-----`)
+
+var testAccIAMServerCertConfig = fmt.Sprintf(`
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "terraform-test-cert-%d"
+  certificate_body = <<EOF
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAfACAQEwDQYJKoZIhvcNAQELBQAwgY4xCzAJBgNVBAYTAlVTMREwDwYD
+VQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxFjAUBgNVBAoMDUJhcmVm
+b290IExhYnMxGDAWBgNVBAMMD0phc29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJ
+ARYYamFzb25AYmFyZWZvb3Rjb2RlcnMuY29tMB4XDTE1MDYyMTA1MzcwNVoXDTE2
+MDYyMDA1MzcwNVowgYgxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazEL
+MAkGA1UEBwwCTlkxFjAUBgNVBAoMDUJhcmVmb290IExhYnMxGDAWBgNVBAMMD0ph
+c29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJARYYamFzb25AYmFyZWZvb3Rjb2Rl
+cnMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2AVGKRIx+EFM0kkg7
+6GoJv9uy0biEDHB4phQBqnDIf8J8/gq9eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jD
+bI/yS+DOAjrh30vN79Au74jGN2Cw8fIak40iDUwjZaczK2Gkna54XIO9pqMcbQ6Q
+mLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCDGNvU
+eioQMVPNlmmxW3+Rwo0Kl+/HtUOmqUDKUDvJnelxulBr7O8w75N/Z7h7+aBJCUkt
+tz+DwATZswXtsal6TuzHHpAhpFql82jQZVE8OYkrX84XKRQpm8ZnbyZObMdXTJWk
+ArC/rGVIWsvhlbgGM8zu7a3zbeuAESZ8Bn4ZbJxnoaRK8p36/alvzAwkgzSf3oUX
+HtU4LrdunevBs6/CbKCWrxYcvNCy8EcmHitqCfQL5nxCCXpgf/Mw1vmIPTwbPSJq
+oUkh5yjGRKzhh7QbG1TlFX6zUp4vb+UJn5+g4edHrqivRSjIqYrC45ygVMOABn21
+hpMXOlZL+YXfR4Kp
+-----END CERTIFICATE-----
+EOF
+
+  certificate_chain = <<EOF
+-----BEGIN CERTIFICATE-----
+MIID8TCCAtmgAwIBAgIJAKX2xeCkfFcbMA0GCSqGSIb3DQEBCwUAMIGOMQswCQYD
+VQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxETAPBgNVBAcMCE5ldyBZb3JrMRYw
+FAYDVQQKDA1CYXJlZm9vdCBMYWJzMRgwFgYDVQQDDA9KYXNvbiBCZXJsaW5za3kx
+JzAlBgkqhkiG9w0BCQEWGGphc29uQGJhcmVmb290Y29kZXJzLmNvbTAeFw0xNTA2
+MjEwNTM2MDZaFw0yNTA2MTgwNTM2MDZaMIGOMQswCQYDVQQGEwJVUzERMA8GA1UE
+CAwITmV3IFlvcmsxETAPBgNVBAcMCE5ldyBZb3JrMRYwFAYDVQQKDA1CYXJlZm9v
+dCBMYWJzMRgwFgYDVQQDDA9KYXNvbiBCZXJsaW5za3kxJzAlBgkqhkiG9w0BCQEW
+GGphc29uQGJhcmVmb290Y29kZXJzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMteFbwfLz7NyQn3eDxxw22l1ZPBrzfPON0HOAq8nHat4kT4A2cI
+45kCtxKMzCVoG84tXoX/rbjGkez7lz9lEfvEuSh+I+UqinFA/sefhcE63foVMZu1
+2t6O3+utdxBvOYJwAQaiGW44x0h6fTyqDv6Gc5Ml0uoIVeMWPhT1MREoOcPDz1gb
+Ep3VT2aqFULLJedP37qbzS4D04rn1tS7pcm3wYivRyjVNEvs91NsWEvvE1WtS2Cl
+2RBt+ihXwq4UNB9UPYG75+FuRcQQvfqameyweyKT9qBmJLELMtYa/KTCYvSch4JY
+YVPAPOlhFlO4BcTto/gpBes2WEAWZtE/jnECAwEAAaNQME4wHQYDVR0OBBYEFOna
+aiYnm5583EY7FT/mXwTBuLZgMB8GA1UdIwQYMBaAFOnaaiYnm5583EY7FT/mXwTB
+uLZgMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBABp/dKQ489CCzzB1
+IX78p6RFAdda4e3lL6uVjeS3itzFIIiKvdf1/txhmsEeCEYz0El6aMnXLkpk7jAr
+kCwlAOOz2R2hlA8k8opKTYX4IQQau8DATslUFAFOvRGOim/TD/Yuch+a/VF2VQKz
+L2lUVi5Hjp9KvWe2HQYPjnJaZs/OKAmZQ4uP547dqFrTz6sWfisF1rJ60JH70cyM
+qjZQp/xYHTZIB8TCPvLgtVIGFmd/VAHVBFW2p9IBwtSxBIsEPwYQOV3XbwhhmGIv
+DWx5TpnEzH7ZM33RNbAKcdwOBxdRY+SI/ua5hYCm4QngAqY69lEuk4zXZpdDLPq1
+qxxQx0E=
+-----END CERTIFICATE-----
+EOF
+
+	private_key =  <<EOF
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQD2AVGKRIx+EFM0kkg76GoJv9uy0biEDHB4phQBqnDIf8J8/gq9
+eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jDbI/yS+DOAjrh30vN79Au74jGN2Cw8fIa
+k40iDUwjZaczK2Gkna54XIO9pqMcbQ6QmLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQAB
+AoGALmVBQ5p6BKx/hMKx7NqAZSZSAP+clQrji12HGGlUq/usanZfAC0LK+f6eygv
+5QbfxJ1UrxdYTukq7dm2qOSooOMUuukWInqC6ztjdLwH70CKnl0bkNB3/NkW2VNc
+32YiUuZCM9zaeBuEUclKNs+dhD2EeGdJF8KGntWGOTU/M4ECQQD9gdYb38PvaMdu
+opM3sKJF5n9pMoLDleBpCGqq3nD3DFn0V6PHQAwn30EhRN+7BbUEpde5PmfoIdAR
+uDlj/XPlAkEA+GyY1e4uU9rz+1K4ubxmtXTp9ZIR2LsqFy5L/MS5hqX2zq5GGq8g
+jZYDxnxPEUrxaWQH4nh0qdu3skUBi4a0nQJBAKJaqLkpUd7eB/t++zHLWeHSgP7q
+bny8XABod4f+9fICYwntpuJQzngqrxeTeIXaXdggLkxg/0LXhN4UUg0LoVECQQDE
+Pi1h2dyY+37/CzLH7q+IKopjJneYqQmv9C+sxs70MgjM7liM3ckub9IdqrdfJr+c
+DJw56APo5puvZNm6mbf1AkBVMDyfdOOyoHpJjrhmZWo6QqynujfwErrBYQ0sZQ3l
+O57Z0RUNQ8DRyymhLd2t5nAHTfpcFA1sBeKE6CziLbZB
+-----END RSA PRIVATE KEY-----
+EOF
+}
+`, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
diff --git a/builtin/providers/aws/resource_aws_iam_user.go b/builtin/providers/aws/resource_aws_iam_user.go
index 73c5ac8f0..100197c5f 100644
--- a/builtin/providers/aws/resource_aws_iam_user.go
+++ b/builtin/providers/aws/resource_aws_iam_user.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -75,7 +76,7 @@ func resourceAwsIamUserRead(d *schema.ResourceData, meta interface{}) error {
 
 	getResp, err := iamconn.GetUser(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX test me
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_user_policy.go b/builtin/providers/aws/resource_aws_iam_user_policy.go
index 96ea6afc0..24d107867 100644
--- a/builtin/providers/aws/resource_aws_iam_user_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_user_policy.go
@@ -5,8 +5,9 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -66,9 +67,10 @@ func resourceAwsIamUserPolicyRead(d *schema.ResourceData, meta interface{}) erro
 		UserName:   aws.String(user),
 	}
 
+	var err error
 	getResp, err := iamconn.GetUserPolicy(request)
 	if err != nil {
-		if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { // XXX test me
 			d.SetId("")
 			return nil
 		}
diff --git a/builtin/providers/aws/resource_aws_iam_user_policy_test.go b/builtin/providers/aws/resource_aws_iam_user_policy_test.go
index 2a2147e56..f5c520180 100644
--- a/builtin/providers/aws/resource_aws_iam_user_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_user_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMUserPolicy(t *testing.T) {
+func TestAccAWSIAMUserPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_user_test.go b/builtin/providers/aws/resource_aws_iam_user_test.go
index 513636f98..0dd2530a1 100644
--- a/builtin/providers/aws/resource_aws_iam_user_test.go
+++ b/builtin/providers/aws/resource_aws_iam_user_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSUser_normal(t *testing.T) {
+func TestAccAWSUser_basic(t *testing.T) {
 	var conf iam.GetUserOutput
 
 	resource.Test(t, resource.TestCase{
@@ -46,11 +47,11 @@ func testAccCheckAWSUserDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "NoSuchEntity" {
+		if ec2err.Code() != "NoSuchEntity" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_instance.go b/builtin/providers/aws/resource_aws_instance.go
index c95b722ed..9a4306acb 100644
--- a/builtin/providers/aws/resource_aws_instance.go
+++ b/builtin/providers/aws/resource_aws_instance.go
@@ -10,8 +10,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -36,8 +38,8 @@ func resourceAwsInstance() *schema.Resource {
 
 			"associate_public_ip_address": &schema.Schema{
 				Type:     schema.TypeBool,
-				Optional: true,
 				ForceNew: true,
+				Optional: true,
 			},
 
 			"availability_zone": &schema.Schema{
@@ -84,6 +86,7 @@ func resourceAwsInstance() *schema.Resource {
 			"source_dest_check": &schema.Schema{
 				Type:     schema.TypeBool,
 				Optional: true,
+				Default:  true,
 			},
 
 			"user_data": &schema.Schema{
@@ -140,6 +143,16 @@ func resourceAwsInstance() *schema.Resource {
 				Optional: true,
 			},
 
+			"disable_api_termination": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+
+			"monitoring": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+
 			"iam_instance_profile": &schema.Schema{
 				Type:     schema.TypeString,
 				ForceNew: true,
@@ -306,204 +319,49 @@ func resourceAwsInstance() *schema.Resource {
 func resourceAwsInstanceCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
-	// Figure out user data
-	userData := ""
-	if v := d.Get("user_data"); v != nil {
-		userData = base64.StdEncoding.EncodeToString([]byte(v.(string)))
-	}
-
-	// check for non-default Subnet, and cast it to a String
-	var hasSubnet bool
-	subnet, hasSubnet := d.GetOk("subnet_id")
-	subnetID := subnet.(string)
-
-	placement := &ec2.Placement{
-		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
-		GroupName:        aws.String(d.Get("placement_group").(string)),
-	}
-
-	if hasSubnet {
-		// Tenancy is only valid inside a VPC
-		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Placement.html
-		if v := d.Get("tenancy").(string); v != "" {
-			placement.Tenancy = aws.String(v)
-		}
-	}
-
-	iam := &ec2.IAMInstanceProfileSpecification{
-		Name: aws.String(d.Get("iam_instance_profile").(string)),
+	instanceOpts, err := buildAwsInstanceOpts(d, meta)
+	if err != nil {
+		return err
 	}
 
 	// Build the creation struct
 	runOpts := &ec2.RunInstancesInput{
-		ImageID:            aws.String(d.Get("ami").(string)),
-		Placement:          placement,
-		InstanceType:       aws.String(d.Get("instance_type").(string)),
-		MaxCount:           aws.Long(int64(1)),
-		MinCount:           aws.Long(int64(1)),
-		UserData:           aws.String(userData),
-		EBSOptimized:       aws.Boolean(d.Get("ebs_optimized").(bool)),
-		IAMInstanceProfile: iam,
-	}
-
-	associatePublicIPAddress := false
-	if v := d.Get("associate_public_ip_address"); v != nil {
-		associatePublicIPAddress = v.(bool)
-	}
-
-	var groups []*string
-	if v := d.Get("security_groups"); v != nil {
-		// Security group names.
-		// For a nondefault VPC, you must use security group IDs instead.
-		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
-		sgs := v.(*schema.Set).List()
-		if len(sgs) > 0 && hasSubnet {
-			log.Printf("[WARN] Deprecated. Attempting to use 'security_groups' within a VPC instance. Use 'vpc_security_group_ids' instead.")
-		}
-		for _, v := range sgs {
-			str := v.(string)
-			groups = append(groups, aws.String(str))
-		}
-	}
-
-	if hasSubnet && associatePublicIPAddress {
-		// If we have a non-default VPC / Subnet specified, we can flag
-		// AssociatePublicIpAddress to get a Public IP assigned. By default these are not provided.
-		// You cannot specify both SubnetId and the NetworkInterface.0.* parameters though, otherwise
-		// you get: Network interfaces and an instance-level subnet ID may not be specified on the same request
-		// You also need to attach Security Groups to the NetworkInterface instead of the instance,
-		// to avoid: Network interfaces and an instance-level security groups may not be specified on
-		// the same request
-		ni := &ec2.InstanceNetworkInterfaceSpecification{
-			AssociatePublicIPAddress: aws.Boolean(associatePublicIPAddress),
-			DeviceIndex:              aws.Long(int64(0)),
-			SubnetID:                 aws.String(subnetID),
-			Groups:                   groups,
-		}
-
-		if v, ok := d.GetOk("private_ip"); ok {
-			ni.PrivateIPAddress = aws.String(v.(string))
-		}
-
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
-				ni.Groups = append(ni.Groups, aws.String(v.(string)))
-			}
-		}
-
-		runOpts.NetworkInterfaces = []*ec2.InstanceNetworkInterfaceSpecification{ni}
-	} else {
-		if subnetID != "" {
-			runOpts.SubnetID = aws.String(subnetID)
-		}
-
-		if v, ok := d.GetOk("private_ip"); ok {
-			runOpts.PrivateIPAddress = aws.String(v.(string))
-		}
-		if runOpts.SubnetID != nil &&
-			*runOpts.SubnetID != "" {
-			runOpts.SecurityGroupIDs = groups
-		} else {
-			runOpts.SecurityGroups = groups
-		}
-
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
-				runOpts.SecurityGroupIDs = append(runOpts.SecurityGroupIDs, aws.String(v.(string)))
-			}
-		}
-	}
-
-	if v, ok := d.GetOk("key_name"); ok {
-		runOpts.KeyName = aws.String(v.(string))
-	}
-
-	blockDevices := make([]*ec2.BlockDeviceMapping, 0)
-
-	if v, ok := d.GetOk("ebs_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			ebs := &ec2.EBSBlockDevice{
-				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
-				Encrypted:           aws.Boolean(bd["encrypted"].(bool)),
-			}
-
-			if v, ok := bd["snapshot_id"].(string); ok && v != "" {
-				ebs.SnapshotID = aws.String(v)
-			}
-
-			if v, ok := bd["volume_size"].(int); ok && v != 0 {
-				ebs.VolumeSize = aws.Long(int64(v))
-			}
-
-			if v, ok := bd["volume_type"].(string); ok && v != "" {
-				ebs.VolumeType = aws.String(v)
-			}
-
-			if v, ok := bd["iops"].(int); ok && v > 0 {
-				ebs.IOPS = aws.Long(int64(v))
-			}
-
-			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-				DeviceName: aws.String(bd["device_name"].(string)),
-				EBS:        ebs,
-			})
-		}
-	}
-
-	if v, ok := d.GetOk("ephemeral_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-				DeviceName:  aws.String(bd["device_name"].(string)),
-				VirtualName: aws.String(bd["virtual_name"].(string)),
-			})
-		}
-	}
-
-	if v, ok := d.GetOk("root_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		if len(vL) > 1 {
-			return fmt.Errorf("Cannot specify more than one root_block_device.")
-		}
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			ebs := &ec2.EBSBlockDevice{
-				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
-			}
-
-			if v, ok := bd["volume_size"].(int); ok && v != 0 {
-				ebs.VolumeSize = aws.Long(int64(v))
-			}
-
-			if v, ok := bd["volume_type"].(string); ok && v != "" {
-				ebs.VolumeType = aws.String(v)
-			}
-
-			if v, ok := bd["iops"].(int); ok && v > 0 {
-				ebs.IOPS = aws.Long(int64(v))
-			}
-
-			if dn, err := fetchRootDeviceName(d.Get("ami").(string), conn); err == nil {
-				blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-					DeviceName: dn,
-					EBS:        ebs,
-				})
-			} else {
-				return err
-			}
-		}
-	}
-
-	if len(blockDevices) > 0 {
-		runOpts.BlockDeviceMappings = blockDevices
+		BlockDeviceMappings:   instanceOpts.BlockDeviceMappings,
+		DisableAPITermination: instanceOpts.DisableAPITermination,
+		EBSOptimized:          instanceOpts.EBSOptimized,
+		Monitoring:            instanceOpts.Monitoring,
+		IAMInstanceProfile:    instanceOpts.IAMInstanceProfile,
+		ImageID:               instanceOpts.ImageID,
+		InstanceType:          instanceOpts.InstanceType,
+		KeyName:               instanceOpts.KeyName,
+		MaxCount:              aws.Long(int64(1)),
+		MinCount:              aws.Long(int64(1)),
+		NetworkInterfaces:     instanceOpts.NetworkInterfaces,
+		Placement:             instanceOpts.Placement,
+		PrivateIPAddress:      instanceOpts.PrivateIPAddress,
+		SecurityGroupIDs:      instanceOpts.SecurityGroupIDs,
+		SecurityGroups:        instanceOpts.SecurityGroups,
+		SubnetID:              instanceOpts.SubnetID,
+		UserData:              instanceOpts.UserData64,
 	}
 
 	// Create the instance
-	log.Printf("[DEBUG] Run configuration: %#v", runOpts)
-	runResp, err := conn.RunInstances(runOpts)
+	log.Printf("[DEBUG] Run configuration: %s", awsutil.StringValue(runOpts))
+
+	var runResp *ec2.Reservation
+	for i := 0; i < 5; i++ {
+		runResp, err = conn.RunInstances(runOpts)
+		if awsErr, ok := err.(awserr.Error); ok {
+			// IAM profiles can take ~10 seconds to propagate in AWS:
+			//  http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
+			if awsErr.Code() == "InvalidParameterValue" && strings.Contains(awsErr.Message(), "Invalid IAM Instance Profile") {
+				log.Printf("[DEBUG] Invalid IAM Instance Profile referenced, retrying...")
+				time.Sleep(2 * time.Second)
+				continue
+			}
+		}
+		break
+	}
 	if err != nil {
 		return fmt.Errorf("Error launching source instance: %s", err)
 	}
@@ -569,7 +427,7 @@ func resourceAwsInstanceRead(d *schema.ResourceData, meta interface{}) error {
 	if err != nil {
 		// If the instance was not found, return nil so that we can show
 		// that the instance is gone.
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidInstanceID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidInstanceID.NotFound" {
 			d.SetId("")
 			return nil
 		}
@@ -599,6 +457,8 @@ func resourceAwsInstanceRead(d *schema.ResourceData, meta interface{}) error {
 		d.Set("tenancy", instance.Placement.Tenancy)
 	}
 
+	d.Set("ami", instance.ImageID)
+	d.Set("instance_type", instance.InstanceType)
 	d.Set("key_name", instance.KeyName)
 	d.Set("public_dns", instance.PublicDNSName)
 	d.Set("public_ip", instance.PublicIPAddress)
@@ -610,7 +470,13 @@ func resourceAwsInstanceRead(d *schema.ResourceData, meta interface{}) error {
 		d.Set("subnet_id", instance.SubnetID)
 	}
 	d.Set("ebs_optimized", instance.EBSOptimized)
-	d.Set("tags", tagsToMapSDK(instance.Tags))
+
+	if instance.Monitoring != nil && instance.Monitoring.State != nil {
+		monitoringState := *instance.Monitoring.State
+		d.Set("monitoring", monitoringState == "enabled" || monitoringState == "pending")
+	}
+
+	d.Set("tags", tagsToMap(instance.Tags))
 
 	// Determine whether we're referring to security groups with
 	// IDs or names. We use a heuristic to figure this out. By default,
@@ -665,6 +531,11 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
 	d.Partial(true)
+	if err := setTags(conn, d); err != nil {
+		return err
+	} else {
+		d.SetPartial("tags")
+	}
 
 	// SourceDestCheck can only be set on VPC instances
 	if d.Get("subnet_id").(string) != "" {
@@ -682,8 +553,8 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 
 	if d.HasChange("vpc_security_group_ids") {
 		var groups []*string
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
 				groups = append(groups, aws.String(v.(string)))
 			}
 		}
@@ -694,17 +565,23 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 		if err != nil {
 			return err
 		}
+	}
 
+	if d.HasChange("disable_api_termination") {
+		_, err := conn.ModifyInstanceAttribute(&ec2.ModifyInstanceAttributeInput{
+			InstanceID: aws.String(d.Id()),
+			DisableAPITermination: &ec2.AttributeBooleanValue{
+				Value: aws.Boolean(d.Get("disable_api_termination").(bool)),
+			},
+		})
+		if err != nil {
+			return err
+		}
 	}
 
 	// TODO(mitchellh): wait for the attributes we modified to
 	// persist the change...
 
-	if err := setTagsSDK(conn, d); err != nil {
-		return err
-	} else {
-		d.SetPartial("tags")
-	}
 	d.Partial(false)
 
 	return resourceAwsInstanceRead(d, meta)
@@ -713,32 +590,8 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 func resourceAwsInstanceDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
-	log.Printf("[INFO] Terminating instance: %s", d.Id())
-	req := &ec2.TerminateInstancesInput{
-		InstanceIDs: []*string{aws.String(d.Id())},
-	}
-	if _, err := conn.TerminateInstances(req); err != nil {
-		return fmt.Errorf("Error terminating instance: %s", err)
-	}
-
-	log.Printf(
-		"[DEBUG] Waiting for instance (%s) to become terminated",
-		d.Id())
-
-	stateConf := &resource.StateChangeConf{
-		Pending:    []string{"pending", "running", "shutting-down", "stopped", "stopping"},
-		Target:     "terminated",
-		Refresh:    InstanceStateRefreshFunc(conn, d.Id()),
-		Timeout:    10 * time.Minute,
-		Delay:      10 * time.Second,
-		MinTimeout: 3 * time.Second,
-	}
-
-	_, err := stateConf.WaitForState()
-	if err != nil {
-		return fmt.Errorf(
-			"Error waiting for instance (%s) to terminate: %s",
-			d.Id(), err)
+	if err := awsTerminateInstance(conn, d.Id()); err != nil {
+		return err
 	}
 
 	d.SetId("")
@@ -753,7 +606,7 @@ func InstanceStateRefreshFunc(conn *ec2.EC2, instanceID string) resource.StateRe
 			InstanceIDs: []*string{aws.String(instanceID)},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidInstanceID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidInstanceID.NotFound" {
 				// Set this to nil as if we didn't find anything.
 				resp = nil
 			} else {
@@ -870,14 +723,305 @@ func fetchRootDeviceName(ami string, conn *ec2.EC2) (*string, error) {
 	}
 
 	log.Printf("[DEBUG] Describing AMI %q to get root block device name", ami)
-	req := &ec2.DescribeImagesInput{ImageIDs: []*string{aws.String(ami)}}
-	if res, err := conn.DescribeImages(req); err == nil {
-		if len(res.Images) == 1 {
-			return res.Images[0].RootDeviceName, nil
-		} else {
-			return nil, fmt.Errorf("Expected 1 AMI for ID: %s, got: %#v", ami, res.Images)
-		}
-	} else {
+	res, err := conn.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIDs: []*string{aws.String(ami)},
+	})
+	if err != nil {
 		return nil, err
 	}
+
+	// For a bad image, we just return nil so we don't block a refresh
+	if len(res.Images) == 0 {
+		return nil, nil
+	}
+
+	image := res.Images[0]
+	rootDeviceName := image.RootDeviceName
+
+	// Some AMIs have a RootDeviceName like "/dev/sda1" that does not appear as a
+	// DeviceName in the BlockDeviceMapping list (which will instead have
+	// something like "/dev/sda")
+	//
+	// While this seems like it breaks an invariant of AMIs, it ends up working
+	// on the AWS side, and AMIs like this are common enough that we need to
+	// special case it so Terraform does the right thing.
+	//
+	// Our heuristic is: if the RootDeviceName does not appear in the
+	// BlockDeviceMapping, assume that the DeviceName of the first
+	// BlockDeviceMapping entry serves as the root device.
+	rootDeviceNameInMapping := false
+	for _, bdm := range image.BlockDeviceMappings {
+		if bdm.DeviceName == image.RootDeviceName {
+			rootDeviceNameInMapping = true
+		}
+	}
+
+	if !rootDeviceNameInMapping && len(image.BlockDeviceMappings) > 0 {
+		rootDeviceName = image.BlockDeviceMappings[0].DeviceName
+	}
+
+	return rootDeviceName, nil
+}
+
+func readBlockDeviceMappingsFromConfig(
+	d *schema.ResourceData, conn *ec2.EC2) ([]*ec2.BlockDeviceMapping, error) {
+	blockDevices := make([]*ec2.BlockDeviceMapping, 0)
+
+	if v, ok := d.GetOk("ebs_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			ebs := &ec2.EBSBlockDevice{
+				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
+			}
+
+			if v, ok := bd["snapshot_id"].(string); ok && v != "" {
+				ebs.SnapshotID = aws.String(v)
+			}
+
+			if v, ok := bd["encrypted"].(bool); ok && v {
+				ebs.Encrypted = aws.Boolean(v)
+			}
+
+			if v, ok := bd["volume_size"].(int); ok && v != 0 {
+				ebs.VolumeSize = aws.Long(int64(v))
+			}
+
+			if v, ok := bd["volume_type"].(string); ok && v != "" {
+				ebs.VolumeType = aws.String(v)
+			}
+
+			if v, ok := bd["iops"].(int); ok && v > 0 {
+				ebs.IOPS = aws.Long(int64(v))
+			}
+
+			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+				DeviceName: aws.String(bd["device_name"].(string)),
+				EBS:        ebs,
+			})
+		}
+	}
+
+	if v, ok := d.GetOk("ephemeral_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+				DeviceName:  aws.String(bd["device_name"].(string)),
+				VirtualName: aws.String(bd["virtual_name"].(string)),
+			})
+		}
+	}
+
+	if v, ok := d.GetOk("root_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		if len(vL) > 1 {
+			return nil, fmt.Errorf("Cannot specify more than one root_block_device.")
+		}
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			ebs := &ec2.EBSBlockDevice{
+				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
+			}
+
+			if v, ok := bd["volume_size"].(int); ok && v != 0 {
+				ebs.VolumeSize = aws.Long(int64(v))
+			}
+
+			if v, ok := bd["volume_type"].(string); ok && v != "" {
+				ebs.VolumeType = aws.String(v)
+			}
+
+			if v, ok := bd["iops"].(int); ok && v > 0 {
+				ebs.IOPS = aws.Long(int64(v))
+			}
+
+			if dn, err := fetchRootDeviceName(d.Get("ami").(string), conn); err == nil {
+				if dn == nil {
+					return nil, fmt.Errorf(
+						"Expected 1 AMI for ID: %s, got none",
+						d.Get("ami").(string))
+				}
+
+				blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+					DeviceName: dn,
+					EBS:        ebs,
+				})
+			} else {
+				return nil, err
+			}
+		}
+	}
+
+	return blockDevices, nil
+}
+
+type awsInstanceOpts struct {
+	BlockDeviceMappings   []*ec2.BlockDeviceMapping
+	DisableAPITermination *bool
+	EBSOptimized          *bool
+	Monitoring            *ec2.RunInstancesMonitoringEnabled
+	IAMInstanceProfile    *ec2.IAMInstanceProfileSpecification
+	ImageID               *string
+	InstanceType          *string
+	KeyName               *string
+	NetworkInterfaces     []*ec2.InstanceNetworkInterfaceSpecification
+	Placement             *ec2.Placement
+	PrivateIPAddress      *string
+	SecurityGroupIDs      []*string
+	SecurityGroups        []*string
+	SpotPlacement         *ec2.SpotPlacement
+	SubnetID              *string
+	UserData64            *string
+}
+
+func buildAwsInstanceOpts(
+	d *schema.ResourceData, meta interface{}) (*awsInstanceOpts, error) {
+	conn := meta.(*AWSClient).ec2conn
+
+	opts := &awsInstanceOpts{
+		DisableAPITermination: aws.Boolean(d.Get("disable_api_termination").(bool)),
+		EBSOptimized:          aws.Boolean(d.Get("ebs_optimized").(bool)),
+		ImageID:               aws.String(d.Get("ami").(string)),
+		InstanceType:          aws.String(d.Get("instance_type").(string)),
+	}
+
+	opts.Monitoring = &ec2.RunInstancesMonitoringEnabled{
+		Enabled: aws.Boolean(d.Get("monitoring").(bool)),
+	}
+
+	opts.IAMInstanceProfile = &ec2.IAMInstanceProfileSpecification{
+		Name: aws.String(d.Get("iam_instance_profile").(string)),
+	}
+
+	opts.UserData64 = aws.String(
+		base64.StdEncoding.EncodeToString([]byte(d.Get("user_data").(string))))
+
+	// check for non-default Subnet, and cast it to a String
+	subnet, hasSubnet := d.GetOk("subnet_id")
+	subnetID := subnet.(string)
+
+	// Placement is used for aws_instance; SpotPlacement is used for
+	// aws_spot_instance_request. They represent the same data. :-|
+	opts.Placement = &ec2.Placement{
+		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
+		GroupName:        aws.String(d.Get("placement_group").(string)),
+	}
+
+	opts.SpotPlacement = &ec2.SpotPlacement{
+		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
+		GroupName:        aws.String(d.Get("placement_group").(string)),
+	}
+
+	if v := d.Get("tenancy").(string); v != "" {
+		opts.Placement.Tenancy = aws.String(v)
+	}
+
+	associatePublicIPAddress := d.Get("associate_public_ip_address").(bool)
+
+	var groups []*string
+	if v := d.Get("security_groups"); v != nil {
+		// Security group names.
+		// For a nondefault VPC, you must use security group IDs instead.
+		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
+		sgs := v.(*schema.Set).List()
+		if len(sgs) > 0 && hasSubnet {
+			log.Printf("[WARN] Deprecated. Attempting to use 'security_groups' within a VPC instance. Use 'vpc_security_group_ids' instead.")
+		}
+		for _, v := range sgs {
+			str := v.(string)
+			groups = append(groups, aws.String(str))
+		}
+	}
+
+	if hasSubnet && associatePublicIPAddress {
+		// If we have a non-default VPC / Subnet specified, we can flag
+		// AssociatePublicIpAddress to get a Public IP assigned. By default these are not provided.
+		// You cannot specify both SubnetId and the NetworkInterface.0.* parameters though, otherwise
+		// you get: Network interfaces and an instance-level subnet ID may not be specified on the same request
+		// You also need to attach Security Groups to the NetworkInterface instead of the instance,
+		// to avoid: Network interfaces and an instance-level security groups may not be specified on
+		// the same request
+		ni := &ec2.InstanceNetworkInterfaceSpecification{
+			AssociatePublicIPAddress: aws.Boolean(associatePublicIPAddress),
+			DeviceIndex:              aws.Long(int64(0)),
+			SubnetID:                 aws.String(subnetID),
+			Groups:                   groups,
+		}
+
+		if v, ok := d.GetOk("private_ip"); ok {
+			ni.PrivateIPAddress = aws.String(v.(string))
+		}
+
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
+				ni.Groups = append(ni.Groups, aws.String(v.(string)))
+			}
+		}
+
+		opts.NetworkInterfaces = []*ec2.InstanceNetworkInterfaceSpecification{ni}
+	} else {
+		if subnetID != "" {
+			opts.SubnetID = aws.String(subnetID)
+		}
+
+		if v, ok := d.GetOk("private_ip"); ok {
+			opts.PrivateIPAddress = aws.String(v.(string))
+		}
+		if opts.SubnetID != nil &&
+			*opts.SubnetID != "" {
+			opts.SecurityGroupIDs = groups
+		} else {
+			opts.SecurityGroups = groups
+		}
+
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
+				opts.SecurityGroupIDs = append(opts.SecurityGroupIDs, aws.String(v.(string)))
+			}
+		}
+	}
+
+	if v, ok := d.GetOk("key_name"); ok {
+		opts.KeyName = aws.String(v.(string))
+	}
+
+	blockDevices, err := readBlockDeviceMappingsFromConfig(d, conn)
+	if err != nil {
+		return nil, err
+	}
+	if len(blockDevices) > 0 {
+		opts.BlockDeviceMappings = blockDevices
+	}
+
+	return opts, nil
+}
+
+func awsTerminateInstance(conn *ec2.EC2, id string) error {
+	log.Printf("[INFO] Terminating instance: %s", id)
+	req := &ec2.TerminateInstancesInput{
+		InstanceIDs: []*string{aws.String(id)},
+	}
+	if _, err := conn.TerminateInstances(req); err != nil {
+		return fmt.Errorf("Error terminating instance: %s", err)
+	}
+
+	log.Printf("[DEBUG] Waiting for instance (%s) to become terminated", id)
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"pending", "running", "shutting-down", "stopped", "stopping"},
+		Target:     "terminated",
+		Refresh:    InstanceStateRefreshFunc(conn, id),
+		Timeout:    10 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err := stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for instance (%s) to terminate: %s", id, err)
+	}
+
+	return nil
 }
diff --git a/builtin/providers/aws/resource_aws_instance_test.go b/builtin/providers/aws/resource_aws_instance_test.go
index e825062fd..c189a5963 100644
--- a/builtin/providers/aws/resource_aws_instance_test.go
+++ b/builtin/providers/aws/resource_aws_instance_test.go
@@ -5,14 +5,16 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSInstance_normal(t *testing.T) {
+func TestAccAWSInstance_basic(t *testing.T) {
 	var v ec2.Instance
 	var vol *ec2.Volume
 
@@ -229,6 +231,51 @@ func TestAccAWSInstance_sourceDestCheck(t *testing.T) {
 	})
 }
 
+func TestAccAWSInstance_disableApiTermination(t *testing.T) {
+	var v ec2.Instance
+
+	checkDisableApiTermination := func(expected bool) resource.TestCheckFunc {
+		return func(*terraform.State) error {
+			conn := testAccProvider.Meta().(*AWSClient).ec2conn
+			r, err := conn.DescribeInstanceAttribute(&ec2.DescribeInstanceAttributeInput{
+				InstanceID: v.InstanceID,
+				Attribute:  aws.String("disableApiTermination"),
+			})
+			if err != nil {
+				return err
+			}
+			got := *r.DisableAPITermination.Value
+			if got != expected {
+				return fmt.Errorf("expected: %t, got: %t", expected, got)
+			}
+			return nil
+		}
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceConfigDisableAPITermination(true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					checkDisableApiTermination(true),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccInstanceConfigDisableAPITermination(false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					checkDisableApiTermination(false),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSInstance_vpc(t *testing.T) {
 	var v ec2.Instance
 
@@ -334,9 +381,9 @@ func TestAccAWSInstance_tags(t *testing.T) {
 				Config: testAccCheckInstanceConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists("aws_instance.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", "bar"),
+					testAccCheckTags(&v.Tags, "foo", "bar"),
 					// Guard against regression of https://github.com/hashicorp/terraform/issues/914
-					testAccCheckTagsSDK(&v.Tags, "#", ""),
+					testAccCheckTags(&v.Tags, "#", ""),
 				),
 			},
 
@@ -344,8 +391,8 @@ func TestAccAWSInstance_tags(t *testing.T) {
 				Config: testAccCheckInstanceConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists("aws_instance.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", ""),
-					testAccCheckTagsSDK(&v.Tags, "bar", "baz"),
+					testAccCheckTags(&v.Tags, "foo", ""),
+					testAccCheckTags(&v.Tags, "bar", "baz"),
 				),
 			},
 		},
@@ -410,6 +457,60 @@ func TestAccAWSInstance_associatePublicIPAndPrivateIP(t *testing.T) {
 	})
 }
 
+// Guard against regression with KeyPairs
+// https://github.com/hashicorp/terraform/issues/2302
+func TestAccAWSInstance_keyPairCheck(t *testing.T) {
+	var v ec2.Instance
+
+	testCheckKeyPair := func(keyName string) resource.TestCheckFunc {
+		return func(*terraform.State) error {
+			if v.KeyName == nil {
+				return fmt.Errorf("No Key Pair found, expected(%s)", keyName)
+			}
+			if *v.KeyName != keyName {
+				return fmt.Errorf("Bad key name, expected (%s), got (%s)", keyName, awsutil.StringValue(v.KeyName))
+			}
+
+			return nil
+		}
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceConfigKeyPair,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					testCheckKeyPair("tmp-key"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSInstance_rootBlockDeviceMismatch(t *testing.T) {
+	var v ec2.Instance
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceConfigRootBlockDeviceMismatch,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					resource.TestCheckResourceAttr(
+						"aws_instance.foo", "root_block_device.0.volume_size", "13"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckInstanceDestroy(s *terraform.State) error {
 	return testAccCheckInstanceDestroyWithProvider(s, testAccProvider)
 }
@@ -437,6 +538,7 @@ func testAccCheckInstanceDestroyWithProvider(s *terraform.State, provider *schem
 		}
 
 		// Try to find the resource
+		var err error
 		resp, err := conn.DescribeInstances(&ec2.DescribeInstancesInput{
 			InstanceIDs: []*string{aws.String(rs.Primary.ID)},
 		})
@@ -449,11 +551,11 @@ func testAccCheckInstanceDestroyWithProvider(s *terraform.State, provider *schem
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidInstanceID.NotFound" {
+		if ec2err.Code() != "InvalidInstanceID.NotFound" {
 			return err
 		}
 	}
@@ -477,11 +579,16 @@ func testAccCheckInstanceExistsWithProviders(n string, i *ec2.Instance, provider
 			return fmt.Errorf("No ID is set")
 		}
 		for _, provider := range *providers {
+			// Ignore if Meta is empty, this can happen for validation providers
+			if provider.Meta() == nil {
+				continue
+			}
+
 			conn := provider.Meta().(*AWSClient).ec2conn
 			resp, err := conn.DescribeInstances(&ec2.DescribeInstancesInput{
 				InstanceIDs: []*string{aws.String(rs.Primary.ID)},
 			})
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidInstanceID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidInstanceID.NotFound" {
 				continue
 			}
 			if err != nil {
@@ -606,7 +713,6 @@ resource "aws_instance" "foo" {
 	ami = "ami-4fccb37f"
 	instance_type = "m1.small"
 	subnet_id = "${aws_subnet.foo.id}"
-	source_dest_check = true
 }
 `
 
@@ -629,6 +735,27 @@ resource "aws_instance" "foo" {
 }
 `
 
+func testAccInstanceConfigDisableAPITermination(val bool) string {
+	return fmt.Sprintf(`
+	resource "aws_vpc" "foo" {
+		cidr_block = "10.1.0.0/16"
+	}
+
+	resource "aws_subnet" "foo" {
+		cidr_block = "10.1.1.0/24"
+		vpc_id = "${aws_vpc.foo.id}"
+	}
+
+	resource "aws_instance" "foo" {
+		# us-west-2
+		ami = "ami-4fccb37f"
+		instance_type = "m1.small"
+		subnet_id = "${aws_subnet.foo.id}"
+		disable_api_termination = %t
+	}
+	`, val)
+}
+
 const testAccInstanceConfigVPC = `
 resource "aws_vpc" "foo" {
 	cidr_block = "10.1.0.0/16"
@@ -822,3 +949,41 @@ resource "aws_eip" "foo_eip" {
 	depends_on = ["aws_internet_gateway.gw"]
 }
 `
+
+const testAccInstanceConfigKeyPair = `
+provider "aws" {
+	region = "us-east-1"
+}
+
+resource "aws_key_pair" "debugging" {
+	key_name = "tmp-key"
+	public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 phodgson@thoughtworks.com"
+}
+
+resource "aws_instance" "foo" {
+  ami = "ami-408c7f28"
+  instance_type = "t1.micro"
+  key_name = "${aws_key_pair.debugging.key_name}"
+}
+`
+
+const testAccInstanceConfigRootBlockDeviceMismatch = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.1.0.0/16"
+}
+
+resource "aws_subnet" "foo" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_instance" "foo" {
+	// This is an AMI with RootDeviceName: "/dev/sda1"; actual root: "/dev/sda"
+	ami = "ami-ef5b69df"
+	instance_type = "t1.micro"
+	subnet_id = "${aws_subnet.foo.id}"
+	root_block_device {
+		volume_size = 13
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_internet_gateway.go b/builtin/providers/aws/resource_aws_internet_gateway.go
index 5a91b4dd3..9d6037a8d 100644
--- a/builtin/providers/aws/resource_aws_internet_gateway.go
+++ b/builtin/providers/aws/resource_aws_internet_gateway.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -33,6 +34,7 @@ func resourceAwsInternetGatewayCreate(d *schema.ResourceData, meta interface{})
 
 	// Create the gateway
 	log.Printf("[DEBUG] Creating internet gateway")
+	var err error
 	resp, err := conn.CreateInternetGateway(nil)
 	if err != nil {
 		return fmt.Errorf("Error creating internet gateway: %s", err)
@@ -43,7 +45,7 @@ func resourceAwsInternetGatewayCreate(d *schema.ResourceData, meta interface{})
 	d.SetId(*ig.InternetGatewayID)
 	log.Printf("[INFO] InternetGateway ID: %s", d.Id())
 
-	err = setTagsSDK(conn, d)
+	err = setTags(conn, d)
 	if err != nil {
 		return err
 	}
@@ -73,7 +75,7 @@ func resourceAwsInternetGatewayRead(d *schema.ResourceData, meta interface{}) er
 		d.Set("vpc_id", ig.Attachments[0].VPCID)
 	}
 
-	d.Set("tags", tagsToMapSDK(ig.Tags))
+	d.Set("tags", tagsToMap(ig.Tags))
 
 	return nil
 }
@@ -93,7 +95,7 @@ func resourceAwsInternetGatewayUpdate(d *schema.ResourceData, meta interface{})
 
 	conn := meta.(*AWSClient).ec2conn
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -120,12 +122,12 @@ func resourceAwsInternetGatewayDelete(d *schema.ResourceData, meta interface{})
 			return nil
 		}
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 
-		switch ec2err.Code {
+		switch ec2err.Code() {
 		case "InvalidInternetGatewayID.NotFound":
 			return nil
 		case "DependencyViolation":
@@ -205,7 +207,7 @@ func resourceAwsInternetGatewayDetach(d *schema.ResourceData, meta interface{})
 		Pending: []string{"detaching"},
 		Target:  "detached",
 		Refresh: detachIGStateRefreshFunc(conn, d.Id(), vpcID.(string)),
-		Timeout: 2 * time.Minute,
+		Timeout: 5 * time.Minute,
 		Delay:   10 * time.Second,
 	}
 	if _, err := stateConf.WaitForState(); err != nil {
@@ -226,13 +228,13 @@ func detachIGStateRefreshFunc(conn *ec2.EC2, instanceID, vpcID string) resource.
 			VPCID:             aws.String(vpcID),
 		})
 		if err != nil {
-			ec2err, ok := err.(aws.APIError)
+			ec2err, ok := err.(awserr.Error)
 			if ok {
-				if ec2err.Code == "InvalidInternetGatewayID.NotFound" {
+				if ec2err.Code() == "InvalidInternetGatewayID.NotFound" {
 					return nil, "Not Found", err
-				} else if ec2err.Code == "Gateway.NotAttached" {
+				} else if ec2err.Code() == "Gateway.NotAttached" {
 					return "detached", "detached", nil
-				} else if ec2err.Code == "DependencyViolation" {
+				} else if ec2err.Code() == "DependencyViolation" {
 					return nil, "detaching", nil
 				}
 			}
@@ -251,8 +253,8 @@ func IGStateRefreshFunc(conn *ec2.EC2, id string) resource.StateRefreshFunc {
 			InternetGatewayIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			ec2err, ok := err.(aws.APIError)
-			if ok && ec2err.Code == "InvalidInternetGatewayID.NotFound" {
+			ec2err, ok := err.(awserr.Error)
+			if ok && ec2err.Code() == "InvalidInternetGatewayID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("[ERROR] Error on IGStateRefresh: %s", err)
@@ -284,8 +286,8 @@ func IGAttachStateRefreshFunc(conn *ec2.EC2, id string, expected string) resourc
 			InternetGatewayIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			ec2err, ok := err.(aws.APIError)
-			if ok && ec2err.Code == "InvalidInternetGatewayID.NotFound" {
+			ec2err, ok := err.(awserr.Error)
+			if ok && ec2err.Code() == "InvalidInternetGatewayID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("[ERROR] Error on IGStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_internet_gateway_test.go b/builtin/providers/aws/resource_aws_internet_gateway_test.go
index a82ea7c8a..6698de6ea 100644
--- a/builtin/providers/aws/resource_aws_internet_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_internet_gateway_test.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -98,7 +99,7 @@ func TestAccAWSInternetGateway_tags(t *testing.T) {
 				Config: testAccCheckInternetGatewayConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInternetGatewayExists("aws_internet_gateway.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", "bar"),
+					testAccCheckTags(&v.Tags, "foo", "bar"),
 				),
 			},
 
@@ -106,8 +107,8 @@ func TestAccAWSInternetGateway_tags(t *testing.T) {
 				Config: testAccCheckInternetGatewayConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInternetGatewayExists("aws_internet_gateway.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", ""),
-					testAccCheckTagsSDK(&v.Tags, "bar", "baz"),
+					testAccCheckTags(&v.Tags, "foo", ""),
+					testAccCheckTags(&v.Tags, "bar", "baz"),
 				),
 			},
 		},
@@ -135,11 +136,11 @@ func testAccCheckInternetGatewayDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidInternetGatewayID.NotFound" {
+		if ec2err.Code() != "InvalidInternetGatewayID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_key_pair.go b/builtin/providers/aws/resource_aws_key_pair.go
index b9c406467..e747fbfc5 100644
--- a/builtin/providers/aws/resource_aws_key_pair.go
+++ b/builtin/providers/aws/resource_aws_key_pair.go
@@ -6,8 +6,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func resourceAwsKeyPair() *schema.Resource {
@@ -65,6 +66,11 @@ func resourceAwsKeyPairRead(d *schema.ResourceData, meta interface{}) error {
 	}
 	resp, err := conn.DescribeKeyPairs(req)
 	if err != nil {
+		awsErr, ok := err.(awserr.Error)
+		if ok && awsErr.Code() == "InvalidKeyPair.NotFound" {
+			d.SetId("")
+			return nil
+		}
 		return fmt.Errorf("Error retrieving KeyPair: %s", err)
 	}
 
diff --git a/builtin/providers/aws/resource_aws_key_pair_test.go b/builtin/providers/aws/resource_aws_key_pair_test.go
index 62c1b57cf..cb0b28639 100644
--- a/builtin/providers/aws/resource_aws_key_pair_test.go
+++ b/builtin/providers/aws/resource_aws_key_pair_test.go
@@ -5,13 +5,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSKeyPair_normal(t *testing.T) {
+func TestAccAWSKeyPair_basic(t *testing.T) {
 	var conf ec2.KeyPairInfo
 
 	resource.Test(t, resource.TestCase{
@@ -78,11 +79,11 @@ func testAccCheckAWSKeyPairDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidKeyPair.NotFound" {
+		if ec2err.Code() != "InvalidKeyPair.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_kinesis_stream.go b/builtin/providers/aws/resource_aws_kinesis_stream.go
new file mode 100644
index 000000000..f4c84f803
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_kinesis_stream.go
@@ -0,0 +1,156 @@
+package aws
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsKinesisStream() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsKinesisStreamCreate,
+		Read:   resourceAwsKinesisStreamRead,
+		Delete: resourceAwsKinesisStreamDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"shard_count": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsKinesisStreamCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	sn := d.Get("name").(string)
+	createOpts := &kinesis.CreateStreamInput{
+		ShardCount: aws.Long(int64(d.Get("shard_count").(int))),
+		StreamName: aws.String(sn),
+	}
+
+	_, err := conn.CreateStream(createOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error creating Kinesis Stream: \"%s\", code: \"%s\"", awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"CREATING"},
+		Target:     "ACTIVE",
+		Refresh:    streamStateRefreshFunc(conn, sn),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	streamRaw, err := stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Kinesis Stream (%s) to become active: %s",
+			sn, err)
+	}
+
+	s := streamRaw.(*kinesis.StreamDescription)
+	d.SetId(*s.StreamARN)
+	d.Set("arn", s.StreamARN)
+
+	return nil
+}
+
+func resourceAwsKinesisStreamRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	describeOpts := &kinesis.DescribeStreamInput{
+		StreamName: aws.String(d.Get("name").(string)),
+		Limit:      aws.Long(1),
+	}
+	resp, err := conn.DescribeStream(describeOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			if awsErr.Code() == "ResourceNotFoundException" {
+				d.SetId("")
+				return nil
+			}
+			return fmt.Errorf("[WARN] Error reading Kinesis Stream: \"%s\", code: \"%s\"", awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	s := resp.StreamDescription
+	d.Set("arn", *s.StreamARN)
+	d.Set("shard_count", len(s.Shards))
+
+	return nil
+}
+
+func resourceAwsKinesisStreamDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	sn := d.Get("name").(string)
+	_, err := conn.DeleteStream(&kinesis.DeleteStreamInput{
+		StreamName: aws.String(sn),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"DELETING"},
+		Target:     "DESTROYED",
+		Refresh:    streamStateRefreshFunc(conn, sn),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Stream (%s) to be destroyed: %s",
+			sn, err)
+	}
+
+	d.SetId("")
+	return nil
+}
+
+func streamStateRefreshFunc(conn *kinesis.Kinesis, sn string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(sn),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Code() == "ResourceNotFoundException" {
+					return 42, "DESTROYED", nil
+				}
+				return nil, awsErr.Code(), err
+			}
+			return nil, "failed", err
+		}
+
+		return resp.StreamDescription, *resp.StreamDescription.StreamStatus, nil
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_kinesis_stream_test.go b/builtin/providers/aws/resource_aws_kinesis_stream_test.go
new file mode 100644
index 000000000..01d14d3d0
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_kinesis_stream_test.go
@@ -0,0 +1,108 @@
+package aws
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccKinesisStream_basic(t *testing.T) {
+	var stream kinesis.StreamDescription
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckKinesisStreamDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccKinesisStreamConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKinesisStreamExists("aws_kinesis_stream.test_stream", &stream),
+					testAccCheckAWSKinesisStreamAttributes(&stream),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckKinesisStreamExists(n string, stream *kinesis.StreamDescription) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Kinesis ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).kinesisconn
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(rs.Primary.Attributes["name"]),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		*stream = *resp.StreamDescription
+
+		return nil
+	}
+}
+
+func testAccCheckAWSKinesisStreamAttributes(stream *kinesis.StreamDescription) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if !strings.HasPrefix(*stream.StreamName, "terraform-kinesis-test") {
+			return fmt.Errorf("Bad Stream name: %s", *stream.StreamName)
+		}
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_kinesis_stream" {
+				continue
+			}
+			if *stream.StreamARN != rs.Primary.Attributes["arn"] {
+				return fmt.Errorf("Bad Stream ARN\n\t expected: %s\n\tgot: %s\n", rs.Primary.Attributes["arn"], *stream.StreamARN)
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckKinesisStreamDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_kinesis_stream" {
+			continue
+		}
+		conn := testAccProvider.Meta().(*AWSClient).kinesisconn
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(rs.Primary.Attributes["name"]),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err == nil {
+			if resp.StreamDescription != nil && *resp.StreamDescription.StreamStatus != "DELETING" {
+				return fmt.Errorf("Error: Stream still exists")
+			}
+		}
+
+		return nil
+
+	}
+
+	return nil
+}
+
+var testAccKinesisStreamConfig = fmt.Sprintf(`
+resource "aws_kinesis_stream" "test_stream" {
+	name = "terraform-kinesis-test-%d"
+	shard_count = 1
+}
+`, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
diff --git a/builtin/providers/aws/resource_aws_lambda_function.go b/builtin/providers/aws/resource_aws_lambda_function.go
new file mode 100644
index 000000000..72dab0154
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_lambda_function.go
@@ -0,0 +1,207 @@
+package aws
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/mitchellh/go-homedir"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsLambdaFunction() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsLambdaFunctionCreate,
+		Read:   resourceAwsLambdaFunctionRead,
+		Update: resourceAwsLambdaFunctionUpdate,
+		Delete: resourceAwsLambdaFunctionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"filename": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"function_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"handler": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"memory_size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  128,
+				ForceNew: true, // TODO make this editable
+			},
+			"role": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"runtime": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  "nodejs",
+			},
+			"timeout": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  3,
+				ForceNew: true, // TODO make this editable
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"last_modified": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"source_code_hash": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+// resourceAwsLambdaFunction maps to:
+// CreateFunction in the API / SDK
+func resourceAwsLambdaFunctionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	functionName := d.Get("function_name").(string)
+	iamRole := d.Get("role").(string)
+
+	log.Printf("[DEBUG] Creating Lambda Function %s with role %s", functionName, iamRole)
+
+	filename, err := homedir.Expand(d.Get("filename").(string))
+	if err != nil {
+		return err
+	}
+	zipfile, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+	d.Set("source_code_hash", sha256.Sum256(zipfile))
+
+	log.Printf("[DEBUG] ")
+
+	params := &lambda.CreateFunctionInput{
+		Code: &lambda.FunctionCode{
+			ZipFile: zipfile,
+		},
+		Description:  aws.String(d.Get("description").(string)),
+		FunctionName: aws.String(functionName),
+		Handler:      aws.String(d.Get("handler").(string)),
+		MemorySize:   aws.Long(int64(d.Get("memory_size").(int))),
+		Role:         aws.String(iamRole),
+		Runtime:      aws.String(d.Get("runtime").(string)),
+		Timeout:      aws.Long(int64(d.Get("timeout").(int))),
+	}
+
+	for i := 0; i < 5; i++ {
+		_, err = conn.CreateFunction(params)
+		if awsErr, ok := err.(awserr.Error); ok {
+
+			// IAM profiles can take ~10 seconds to propagate in AWS:
+			//  http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
+			// Error creating Lambda function: InvalidParameterValueException: The role defined for the task cannot be assumed by Lambda.
+			if awsErr.Code() == "InvalidParameterValueException" && strings.Contains(awsErr.Message(), "The role defined for the task cannot be assumed by Lambda.") {
+				log.Printf("[DEBUG] Invalid IAM Instance Profile referenced, retrying...")
+				time.Sleep(2 * time.Second)
+				continue
+			}
+		}
+		break
+	}
+	if err != nil {
+		return fmt.Errorf("Error creating Lambda function: %s", err)
+	}
+
+	d.SetId(d.Get("function_name").(string))
+
+	return resourceAwsLambdaFunctionRead(d, meta)
+}
+
+// resourceAwsLambdaFunctionRead maps to:
+// GetFunction in the API / SDK
+func resourceAwsLambdaFunctionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	log.Printf("[DEBUG] Fetching Lambda Function: %s", d.Id())
+
+	params := &lambda.GetFunctionInput{
+		FunctionName: aws.String(d.Get("function_name").(string)),
+	}
+
+	getFunctionOutput, err := conn.GetFunction(params)
+	if err != nil {
+		return err
+	}
+
+	// getFunctionOutput.Code.Location is a pre-signed URL pointing at the zip
+	// file that we uploaded when we created the resource. You can use it to
+	// download the code from AWS. The other part is
+	// getFunctionOutput.Configuration which holds metadata.
+
+	function := getFunctionOutput.Configuration
+	// TODO error checking / handling on the Set() calls.
+	d.Set("arn", function.FunctionARN)
+	d.Set("description", function.Description)
+	d.Set("handler", function.Handler)
+	d.Set("memory_size", function.MemorySize)
+	d.Set("last_modified", function.LastModified)
+	d.Set("role", function.Role)
+	d.Set("runtime", function.Runtime)
+	d.Set("timeout", function.Timeout)
+
+	return nil
+}
+
+// resourceAwsLambdaFunction maps to:
+// DeleteFunction in the API / SDK
+func resourceAwsLambdaFunctionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	log.Printf("[INFO] Deleting Lambda Function: %s", d.Id())
+
+	params := &lambda.DeleteFunctionInput{
+		FunctionName: aws.String(d.Get("function_name").(string)),
+	}
+
+	_, err := conn.DeleteFunction(params)
+	if err != nil {
+		return fmt.Errorf("Error deleting Lambda Function: %s", err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+// resourceAwsLambdaFunctionUpdate maps to:
+// UpdateFunctionCode in the API / SDK
+func resourceAwsLambdaFunctionUpdate(d *schema.ResourceData, meta interface{}) error {
+	// conn := meta.(*AWSClient).lambdaconn
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_lambda_function_test.go b/builtin/providers/aws/resource_aws_lambda_function_test.go
new file mode 100644
index 000000000..d85bd7e8d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_lambda_function_test.go
@@ -0,0 +1,125 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSLambdaFunction_normal(t *testing.T) {
+	var conf lambda.GetFunctionOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckLambdaFunctionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSLambdaConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAwsLambdaFunctionExists("aws_lambda_function.lambda_function_test", &conf),
+					testAccCheckAWSLambdaAttributes(&conf),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckLambdaFunctionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).lambdaconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_lambda_function" {
+			continue
+		}
+
+		_, err := conn.GetFunction(&lambda.GetFunctionInput{
+			FunctionName: aws.String(rs.Primary.ID),
+		})
+
+		if err == nil {
+			return fmt.Errorf("Lambda Function still exists")
+		}
+
+	}
+
+	return nil
+
+}
+
+func testAccCheckAwsLambdaFunctionExists(n string, function *lambda.GetFunctionOutput) resource.TestCheckFunc {
+	// Wait for IAM role
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Lambda function not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("Lambda function ID not set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).lambdaconn
+
+		params := &lambda.GetFunctionInput{
+			FunctionName: aws.String("example_lambda_name"),
+		}
+
+		getFunction, err := conn.GetFunction(params)
+		if err != nil {
+			return err
+		}
+
+		*function = *getFunction
+
+		return nil
+	}
+}
+
+func testAccCheckAWSLambdaAttributes(function *lambda.GetFunctionOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		c := function.Configuration
+		const expectedName = "example_lambda_name"
+		if *c.FunctionName != expectedName {
+			return fmt.Errorf("Expected function name %s, got %s", expectedName, *c.FunctionName)
+		}
+
+		if *c.FunctionARN == "" {
+			return fmt.Errorf("Could not read Lambda Function's ARN")
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSLambdaConfig = `
+resource "aws_iam_role" "iam_for_lambda" {
+    name = "iam_for_lambda"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_lambda_function" "lambda_function_test" {
+    filename = "test-fixtures/lambdatest.zip"
+    function_name = "example_lambda_name"
+    role = "${aws_iam_role.iam_for_lambda.arn}"
+    handler = "exports.example"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_launch_configuration.go b/builtin/providers/aws/resource_aws_launch_configuration.go
index 406362af2..ab6350b38 100644
--- a/builtin/providers/aws/resource_aws_launch_configuration.go
+++ b/builtin/providers/aws/resource_aws_launch_configuration.go
@@ -9,9 +9,10 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -29,6 +30,15 @@ func resourceAwsLaunchConfiguration() *schema.Resource {
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/9f322b1/botocore/data/autoscaling/2011-01-01/service-2.json#L1932-L1939
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"image_id": &schema.Schema{
@@ -105,6 +115,13 @@ func resourceAwsLaunchConfiguration() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"enable_monitoring": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+				Default:  true,
+			},
+
 			"ebs_block_device": &schema.Schema{
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -255,6 +272,10 @@ func resourceAwsLaunchConfigurationCreate(d *schema.ResourceData, meta interface
 		createLaunchConfigurationOpts.UserData = aws.String(userData)
 	}
 
+	createLaunchConfigurationOpts.InstanceMonitoring = &autoscaling.InstanceMonitoring{
+		Enabled: aws.Boolean(d.Get("enable_monitoring").(bool)),
+	}
+
 	if v, ok := d.GetOk("iam_instance_profile"); ok {
 		createLaunchConfigurationOpts.IAMInstanceProfile = aws.String(v.(string))
 	}
@@ -371,8 +392,25 @@ func resourceAwsLaunchConfigurationCreate(d *schema.ResourceData, meta interface
 	createLaunchConfigurationOpts.LaunchConfigurationName = aws.String(lcName)
 
 	log.Printf(
-		"[DEBUG] autoscaling create launch configuration: %#v", createLaunchConfigurationOpts)
-	_, err := autoscalingconn.CreateLaunchConfiguration(&createLaunchConfigurationOpts)
+		"[DEBUG] autoscaling create launch configuration: %s", createLaunchConfigurationOpts)
+
+	// IAM profiles can take ~10 seconds to propagate in AWS:
+	// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
+	err := resource.Retry(30*time.Second, func() error {
+		_, err := autoscalingconn.CreateLaunchConfiguration(&createLaunchConfigurationOpts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Message() == "Invalid IamInstanceProfile" {
+					return err
+				}
+			}
+			return &resource.RetryError{
+				Err: err,
+			}
+		}
+		return nil
+	})
+
 	if err != nil {
 		return fmt.Errorf("Error creating launch configuration: %s", err)
 	}
@@ -395,7 +433,7 @@ func resourceAwsLaunchConfigurationRead(d *schema.ResourceData, meta interface{}
 		LaunchConfigurationNames: []*string{aws.String(d.Id())},
 	}
 
-	log.Printf("[DEBUG] launch configuration describe configuration: %#v", describeOpts)
+	log.Printf("[DEBUG] launch configuration describe configuration: %s", describeOpts)
 	describConfs, err := autoscalingconn.DescribeLaunchConfigurations(&describeOpts)
 	if err != nil {
 		return fmt.Errorf("Error retrieving launch configuration: %s", err)
@@ -422,6 +460,7 @@ func resourceAwsLaunchConfigurationRead(d *schema.ResourceData, meta interface{}
 	d.Set("iam_instance_profile", lc.IAMInstanceProfile)
 	d.Set("ebs_optimized", lc.EBSOptimized)
 	d.Set("spot_price", lc.SpotPrice)
+	d.Set("enable_monitoring", lc.InstanceMonitoring.Enabled)
 	d.Set("security_groups", lc.SecurityGroups)
 
 	if err := readLCBlockDevices(d, lc, ec2conn); err != nil {
@@ -440,8 +479,8 @@ func resourceAwsLaunchConfigurationDelete(d *schema.ResourceData, meta interface
 			LaunchConfigurationName: aws.String(d.Id()),
 		})
 	if err != nil {
-		autoscalingerr, ok := err.(aws.APIError)
-		if ok && autoscalingerr.Code == "InvalidConfiguration.NotFound" {
+		autoscalingerr, ok := err.(awserr.Error)
+		if ok && autoscalingerr.Code() == "InvalidConfiguration.NotFound" {
 			return nil
 		}
 
@@ -487,6 +526,11 @@ func readBlockDevicesFromLaunchConfiguration(d *schema.ResourceData, lc *autosca
 	if err != nil {
 		return nil, err
 	}
+	if rootDeviceName == nil {
+		// We do this so the value is empty so we don't have to do nil checks later
+		var blank string
+		rootDeviceName = &blank
+	}
 	for _, bdm := range lc.BlockDeviceMappings {
 		bd := make(map[string]interface{})
 		if bdm.EBS != nil && bdm.EBS.DeleteOnTermination != nil {
diff --git a/builtin/providers/aws/resource_aws_launch_configuration_test.go b/builtin/providers/aws/resource_aws_launch_configuration_test.go
index 775288dba..bb008baaa 100644
--- a/builtin/providers/aws/resource_aws_launch_configuration_test.go
+++ b/builtin/providers/aws/resource_aws_launch_configuration_test.go
@@ -7,12 +7,33 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
+func TestAccAWSLaunchConfiguration_basic(t *testing.T) {
+	var conf autoscaling.LaunchConfiguration
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSLaunchConfigurationDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSLaunchConfigurationNoNameConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSLaunchConfigurationExists("aws_launch_configuration.bar", &conf),
+					testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
+						"aws_launch_configuration.bar", "terraform-"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSLaunchConfiguration_withBlockDevices(t *testing.T) {
 	var conf autoscaling.LaunchConfiguration
 
@@ -60,26 +81,6 @@ func TestAccAWSLaunchConfiguration_withSpotPrice(t *testing.T) {
 	})
 }
 
-func TestAccAWSLaunchConfiguration_withGeneratedName(t *testing.T) {
-	var conf autoscaling.LaunchConfiguration
-
-	resource.Test(t, resource.TestCase{
-		PreCheck:     func() { testAccPreCheck(t) },
-		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckAWSLaunchConfigurationDestroy,
-		Steps: []resource.TestStep{
-			resource.TestStep{
-				Config: testAccAWSLaunchConfigurationNoNameConfig,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSLaunchConfigurationExists("aws_launch_configuration.bar", &conf),
-					testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
-						"aws_launch_configuration.bar", "terraform-"),
-				),
-			},
-		},
-	})
-}
-
 func testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
 	resource, prefix string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -119,11 +120,11 @@ func testAccCheckAWSLaunchConfigurationDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error
-		providerErr, ok := err.(aws.APIError)
+		providerErr, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if providerErr.Code != "InvalidLaunchConfiguration.NotFound" {
+		if providerErr.Code() != "InvalidLaunchConfiguration.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
index cc3d89c76..fdc8ec303 100644
--- a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
+++ b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -90,7 +91,7 @@ func resourceAwsLBCookieStickinessPolicyRead(d *schema.ResourceData, meta interf
 
 	getResp, err := elbconn.DescribeLoadBalancerPolicies(request)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "PolicyNotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "PolicyNotFound" {
 			// The policy is gone.
 			d.SetId("")
 			return nil
diff --git a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
index 6a43496de..e1073e5e8 100644
--- a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
+++ b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsLBCookieStickinessPolicy(t *testing.T) {
+func TestAccAwsLBCookieStickinessPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_main_route_table_association.go b/builtin/providers/aws/resource_aws_main_route_table_association.go
index 097dc1888..48008c61a 100644
--- a/builtin/providers/aws/resource_aws_main_route_table_association.go
+++ b/builtin/providers/aws/resource_aws_main_route_table_association.go
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_main_route_table_association_test.go b/builtin/providers/aws/resource_aws_main_route_table_association_test.go
index 81f87a901..344df82f6 100644
--- a/builtin/providers/aws/resource_aws_main_route_table_association_test.go
+++ b/builtin/providers/aws/resource_aws_main_route_table_association_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSMainRouteTableAssociation(t *testing.T) {
+func TestAccAWSMainRouteTableAssociation_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_network_acl.go b/builtin/providers/aws/resource_aws_network_acl.go
index 0d44ff321..b689b9860 100644
--- a/builtin/providers/aws/resource_aws_network_acl.go
+++ b/builtin/providers/aws/resource_aws_network_acl.go
@@ -4,11 +4,13 @@ import (
 	"bytes"
 	"fmt"
 	"log"
+	"sort"
 	"strconv"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -30,10 +32,19 @@ func resourceAwsNetworkAcl() *schema.Resource {
 				Computed: false,
 			},
 			"subnet_id": &schema.Schema{
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Computed: false,
+				Type:       schema.TypeString,
+				Optional:   true,
+				ForceNew:   true,
+				Computed:   false,
+				Deprecated: "Attribute subnet_id is deprecated on network_acl resources. Use subnet_ids instead",
+			},
+			"subnet_ids": &schema.Schema{
+				Type:          schema.TypeSet,
+				Optional:      true,
+				Computed:      true,
+				ConflictsWith: []string{"subnet_id"},
+				Elem:          &schema.Schema{Type: schema.TypeString},
+				Set:           schema.HashString,
 			},
 			"ingress": &schema.Schema{
 				Type:     schema.TypeSet,
@@ -65,6 +76,14 @@ func resourceAwsNetworkAcl() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
+						"icmp_type": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"icmp_code": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
 					},
 				},
 				Set: resourceAwsNetworkAclEntryHash,
@@ -99,6 +118,14 @@ func resourceAwsNetworkAcl() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
+						"icmp_type": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"icmp_code": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
 					},
 				},
 				Set: resourceAwsNetworkAclEntryHash,
@@ -166,7 +193,16 @@ func resourceAwsNetworkAclRead(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	d.Set("vpc_id", networkAcl.VPCID)
-	d.Set("tags", tagsToMapSDK(networkAcl.Tags))
+	d.Set("tags", tagsToMap(networkAcl.Tags))
+
+	var s []string
+	for _, a := range networkAcl.Associations {
+		s = append(s, *a.SubnetID)
+	}
+	sort.Strings(s)
+	if err := d.Set("subnet_ids", s); err != nil {
+		return err
+	}
 
 	if err := d.Set("ingress", networkAclEntriesToMapList(ingressEntries)); err != nil {
 		return err
@@ -213,7 +249,62 @@ func resourceAwsNetworkAclUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if d.HasChange("subnet_ids") {
+		o, n := d.GetChange("subnet_ids")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+
+		remove := os.Difference(ns).List()
+		add := ns.Difference(os).List()
+
+		if len(remove) > 0 {
+			// A Network ACL is required for each subnet. In order to disassociate a
+			// subnet from this ACL, we must associate it with the default ACL.
+			defaultAcl, err := getDefaultNetworkAcl(d.Get("vpc_id").(string), conn)
+			if err != nil {
+				return fmt.Errorf("Failed to find Default ACL for VPC %s", d.Get("vpc_id").(string))
+			}
+			for _, r := range remove {
+				association, err := findNetworkAclAssociation(r.(string), conn)
+				if err != nil {
+					return fmt.Errorf("Failed to find acl association: acl %s with subnet %s: %s", d.Id(), r, err)
+				}
+				_, err = conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationInput{
+					AssociationID: association.NetworkACLAssociationID,
+					NetworkACLID:  defaultAcl.NetworkACLID,
+				})
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		if len(add) > 0 {
+			for _, a := range add {
+				association, err := findNetworkAclAssociation(a.(string), conn)
+				if err != nil {
+					return fmt.Errorf("Failed to find acl association: acl %s with subnet %s: %s", d.Id(), a, err)
+				}
+				_, err = conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationInput{
+					AssociationID: association.NetworkACLAssociationID,
+					NetworkACLID:  aws.String(d.Id()),
+				})
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+	}
+
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -302,9 +393,10 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, conn *ec2
 			Protocol:     add.Protocol,
 			RuleAction:   add.RuleAction,
 			RuleNumber:   add.RuleNumber,
+			ICMPTypeCode: add.ICMPTypeCode,
 		})
 		if connErr != nil {
-			return fmt.Errorf("Error creating %s entry: %s", entryType, err)
+			return fmt.Errorf("Error creating %s entry: %s", entryType, connErr)
 		}
 	}
 	return nil
@@ -319,25 +411,42 @@ func resourceAwsNetworkAclDelete(d *schema.ResourceData, meta interface{}) error
 			NetworkACLID: aws.String(d.Id()),
 		})
 		if err != nil {
-			ec2err := err.(aws.APIError)
-			switch ec2err.Code {
+			ec2err := err.(awserr.Error)
+			switch ec2err.Code() {
 			case "InvalidNetworkAclID.NotFound":
 				return nil
 			case "DependencyViolation":
 				// In case of dependency violation, we remove the association between subnet and network acl.
 				// This means the subnet is attached to default acl of vpc.
-				association, err := findNetworkAclAssociation(d.Get("subnet_id").(string), conn)
-				if err != nil {
-					return resource.RetryError{Err: fmt.Errorf("Dependency violation: Cannot delete acl %s: %s", d.Id(), err)}
+				var associations []*ec2.NetworkACLAssociation
+				if v, ok := d.GetOk("subnet_id"); ok {
+
+					a, err := findNetworkAclAssociation(v.(string), conn)
+					if err != nil {
+						return resource.RetryError{Err: fmt.Errorf("Dependency violation: Cannot find ACL %s: %s", d.Id(), err)}
+					}
+					associations = append(associations, a)
+				} else if v, ok := d.GetOk("subnet_ids"); ok {
+					ids := v.(*schema.Set).List()
+					for _, i := range ids {
+						a, err := findNetworkAclAssociation(i.(string), conn)
+						if err != nil {
+							return resource.RetryError{Err: fmt.Errorf("Dependency violation: Cannot delete acl %s: %s", d.Id(), err)}
+						}
+						associations = append(associations, a)
+					}
 				}
 				defaultAcl, err := getDefaultNetworkAcl(d.Get("vpc_id").(string), conn)
 				if err != nil {
 					return resource.RetryError{Err: fmt.Errorf("Dependency violation: Cannot delete acl %s: %s", d.Id(), err)}
 				}
-				_, err = conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationInput{
-					AssociationID: association.NetworkACLAssociationID,
-					NetworkACLID:  defaultAcl.NetworkACLID,
-				})
+
+				for _, a := range associations {
+					_, err = conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationInput{
+						AssociationID: a.NetworkACLAssociationID,
+						NetworkACLID:  defaultAcl.NetworkACLID,
+					})
+				}
 				return resource.RetryError{Err: err}
 			default:
 				// Any other error, we want to quit the retry loop immediately
@@ -374,6 +483,13 @@ func resourceAwsNetworkAclEntryHash(v interface{}) int {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
 	}
 
+	if v, ok := m["icmp_type"]; ok {
+		buf.WriteString(fmt.Sprintf("%d-", v.(int)))
+	}
+	if v, ok := m["icmp_code"]; ok {
+		buf.WriteString(fmt.Sprintf("%d-", v.(int)))
+	}
+
 	return hashcode.String(buf.String())
 }
 
@@ -417,7 +533,7 @@ func findNetworkAclAssociation(subnetId string, conn *ec2.EC2) (networkAclAssoci
 			}
 		}
 	}
-	return nil, fmt.Errorf("could not find association for subnet %s ", subnetId)
+	return nil, fmt.Errorf("could not find association for subnet: %s ", subnetId)
 }
 
 // networkAclEntriesToMapList turns ingress/egress rules read from AWS into a list
@@ -446,6 +562,11 @@ func networkAclEntriesToMapList(networkAcls []*ec2.NetworkACLEntry) []map[string
 			acl["to_port"] = *entry.PortRange.To
 		}
 
+		if entry.ICMPTypeCode != nil {
+			acl["icmp_type"] = *entry.ICMPTypeCode.Type
+			acl["icmp_code"] = *entry.ICMPTypeCode.Code
+		}
+
 		result = append(result, acl)
 	}
 
diff --git a/builtin/providers/aws/resource_aws_network_acl_test.go b/builtin/providers/aws/resource_aws_network_acl_test.go
index 7a57a0012..ad834cc66 100644
--- a/builtin/providers/aws/resource_aws_network_acl_test.go
+++ b/builtin/providers/aws/resource_aws_network_acl_test.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -23,36 +24,36 @@ func TestAccAWSNetworkAcl_EgressAndIngressRules(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.protocol", "6"),
+						"aws_network_acl.bar", "ingress.109047673.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.rule_no", "1"),
+						"aws_network_acl.bar", "ingress.109047673.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.from_port", "80"),
+						"aws_network_acl.bar", "ingress.109047673.from_port", "80"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.to_port", "80"),
+						"aws_network_acl.bar", "ingress.109047673.to_port", "80"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.action", "allow"),
+						"aws_network_acl.bar", "ingress.109047673.action", "allow"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.cidr_block", "10.3.0.0/18"),
+						"aws_network_acl.bar", "ingress.109047673.cidr_block", "10.3.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.protocol", "6"),
+						"aws_network_acl.bar", "egress.868403673.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.rule_no", "2"),
+						"aws_network_acl.bar", "egress.868403673.rule_no", "2"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.from_port", "443"),
+						"aws_network_acl.bar", "egress.868403673.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.to_port", "443"),
+						"aws_network_acl.bar", "egress.868403673.to_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.cidr_block", "10.3.0.0/18"),
+						"aws_network_acl.bar", "egress.868403673.cidr_block", "10.3.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.action", "allow"),
+						"aws_network_acl.bar", "egress.868403673.action", "allow"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccAWSNetworkAcl_OnlyIngressRules(t *testing.T) {
+func TestAccAWSNetworkAcl_OnlyIngressRules_basic(t *testing.T) {
 	var networkAcl ec2.NetworkACL
 
 	resource.Test(t, resource.TestCase{
@@ -66,24 +67,24 @@ func TestAccAWSNetworkAcl_OnlyIngressRules(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					// testAccCheckSubnetAssociation("aws_network_acl.foos", "aws_subnet.blob"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.protocol", "6"),
+						"aws_network_acl.foos", "ingress.1451312565.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.rule_no", "2"),
+						"aws_network_acl.foos", "ingress.1451312565.rule_no", "2"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.from_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.to_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.to_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.action", "deny"),
+						"aws_network_acl.foos", "ingress.1451312565.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.1451312565.cidr_block", "10.2.0.0/18"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccAWSNetworkAcl_OnlyIngressRulesChange(t *testing.T) {
+func TestAccAWSNetworkAcl_OnlyIngressRules_update(t *testing.T) {
 	var networkAcl ec2.NetworkACL
 
 	resource.Test(t, resource.TestCase{
@@ -97,21 +98,21 @@ func TestAccAWSNetworkAcl_OnlyIngressRulesChange(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					testIngressRuleLength(&networkAcl, 2),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.protocol", "6"),
+						"aws_network_acl.foos", "ingress.2048097841.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.rule_no", "1"),
+						"aws_network_acl.foos", "ingress.2048097841.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.from_port", "0"),
+						"aws_network_acl.foos", "ingress.2048097841.from_port", "0"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.to_port", "22"),
+						"aws_network_acl.foos", "ingress.2048097841.to_port", "22"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.action", "deny"),
+						"aws_network_acl.foos", "ingress.2048097841.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.1451312565.cidr_block", "10.2.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.from_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.rule_no", "2"),
+						"aws_network_acl.foos", "ingress.1451312565.rule_no", "2"),
 				),
 			},
 			resource.TestStep{
@@ -120,17 +121,17 @@ func TestAccAWSNetworkAcl_OnlyIngressRulesChange(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					testIngressRuleLength(&networkAcl, 1),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.protocol", "6"),
+						"aws_network_acl.foos", "ingress.2048097841.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.rule_no", "1"),
+						"aws_network_acl.foos", "ingress.2048097841.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.from_port", "0"),
+						"aws_network_acl.foos", "ingress.2048097841.from_port", "0"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.to_port", "22"),
+						"aws_network_acl.foos", "ingress.2048097841.to_port", "22"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.action", "deny"),
+						"aws_network_acl.foos", "ingress.2048097841.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.2048097841.cidr_block", "10.2.0.0/18"),
 				),
 			},
 		},
@@ -149,7 +150,7 @@ func TestAccAWSNetworkAcl_OnlyEgressRules(t *testing.T) {
 				Config: testAccAWSNetworkAclEgressConfig,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSNetworkAclExists("aws_network_acl.bond", &networkAcl),
-					testAccCheckTagsSDK(&networkAcl.Tags, "foo", "bar"),
+					testAccCheckTags(&networkAcl.Tags, "foo", "bar"),
 				),
 			},
 		},
@@ -181,6 +182,49 @@ func TestAccAWSNetworkAcl_SubnetChange(t *testing.T) {
 
 }
 
+func TestAccAWSNetworkAcl_Subnets(t *testing.T) {
+	var networkAcl ec2.NetworkACL
+
+	checkACLSubnets := func(acl *ec2.NetworkACL, count int) resource.TestCheckFunc {
+		return func(*terraform.State) (err error) {
+			if count != len(acl.Associations) {
+				return fmt.Errorf("ACL association count does not match, expected %d, got %d", count, len(acl.Associations))
+			}
+
+			return nil
+		}
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSNetworkAclDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSNetworkAclSubnet_SubnetIds,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl),
+					testAccCheckSubnetIsAssociatedWithAcl("aws_network_acl.bar", "aws_subnet.one"),
+					testAccCheckSubnetIsAssociatedWithAcl("aws_network_acl.bar", "aws_subnet.two"),
+					checkACLSubnets(&networkAcl, 2),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSNetworkAclSubnet_SubnetIdsUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl),
+					testAccCheckSubnetIsAssociatedWithAcl("aws_network_acl.bar", "aws_subnet.one"),
+					testAccCheckSubnetIsAssociatedWithAcl("aws_network_acl.bar", "aws_subnet.three"),
+					testAccCheckSubnetIsAssociatedWithAcl("aws_network_acl.bar", "aws_subnet.four"),
+					checkACLSubnets(&networkAcl, 3),
+				),
+			},
+		},
+	})
+
+}
+
 func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ec2conn
 
@@ -201,12 +245,12 @@ func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error {
 			return nil
 		}
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 		// Confirm error code is what we want
-		if ec2err.Code != "InvalidNetworkAclID.NotFound" {
+		if ec2err.Code() != "InvalidNetworkAclID.NotFound" {
 			return err
 		}
 	}
@@ -281,10 +325,6 @@ func testAccCheckSubnetIsAssociatedWithAcl(acl string, sub string) resource.Test
 			return nil
 		}
 
-		// r, _ := conn.NetworkACLs([]string{}, ec2.NewFilter())
-		// fmt.Printf("\n\nall acls\n %#v\n\n", r.NetworkAcls)
-		// conn.NetworkAcls([]string{}, filter)
-
 		return fmt.Errorf("Network Acl %s is not associated with subnet %s", acl, sub)
 	}
 }
@@ -494,3 +534,58 @@ resource "aws_network_acl" "bar" {
 	subnet_id = "${aws_subnet.new.id}"
 }
 `
+
+const testAccAWSNetworkAclSubnet_SubnetIds = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.1.0.0/16"
+	tags {
+		Name = "acl-subnets-test"
+	}
+}
+resource "aws_subnet" "one" {
+	cidr_block = "10.1.111.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+resource "aws_subnet" "two" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+resource "aws_network_acl" "bar" {
+	vpc_id = "${aws_vpc.foo.id}"
+	subnet_ids = ["${aws_subnet.one.id}", "${aws_subnet.two.id}"]
+}
+`
+
+const testAccAWSNetworkAclSubnet_SubnetIdsUpdate = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.1.0.0/16"
+	tags {
+		Name = "acl-subnets-test"
+	}
+}
+resource "aws_subnet" "one" {
+	cidr_block = "10.1.111.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+resource "aws_subnet" "two" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_subnet" "three" {
+	cidr_block = "10.1.222.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+resource "aws_subnet" "four" {
+	cidr_block = "10.1.4.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+resource "aws_network_acl" "bar" {
+	vpc_id = "${aws_vpc.foo.id}"
+	subnet_ids = [
+		"${aws_subnet.one.id}", 
+		"${aws_subnet.three.id}",
+		"${aws_subnet.four.id}",
+	]
+}
+`
diff --git a/builtin/providers/aws/resource_aws_network_interface.go b/builtin/providers/aws/resource_aws_network_interface.go
index 095bfb955..aee50f0aa 100644
--- a/builtin/providers/aws/resource_aws_network_interface.go
+++ b/builtin/providers/aws/resource_aws_network_interface.go
@@ -7,8 +7,9 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -77,9 +78,17 @@ func resourceAwsNetworkInterfaceCreate(d *schema.ResourceData, meta interface{})
 	conn := meta.(*AWSClient).ec2conn
 
 	request := &ec2.CreateNetworkInterfaceInput{
-		Groups:             expandStringList(d.Get("security_groups").(*schema.Set).List()),
-		SubnetID:           aws.String(d.Get("subnet_id").(string)),
-		PrivateIPAddresses: expandPrivateIPAddesses(d.Get("private_ips").(*schema.Set).List()),
+		SubnetID: aws.String(d.Get("subnet_id").(string)),
+	}
+
+	security_groups := d.Get("security_groups").(*schema.Set).List()
+	if len(security_groups) != 0 {
+		request.Groups = expandStringList(security_groups)
+	}
+
+	private_ips := d.Get("private_ips").(*schema.Set).List()
+	if len(private_ips) != 0 {
+		request.PrivateIPAddresses = expandPrivateIPAddesses(private_ips)
 	}
 
 	log.Printf("[DEBUG] Creating network interface")
@@ -102,7 +111,7 @@ func resourceAwsNetworkInterfaceRead(d *schema.ResourceData, meta interface{}) e
 	describeResp, err := conn.DescribeNetworkInterfaces(describe_network_interfaces_request)
 
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidNetworkInterfaceID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidNetworkInterfaceID.NotFound" {
 			// The ENI is gone now, so just remove it from the state
 			d.SetId("")
 			return nil
@@ -120,7 +129,7 @@ func resourceAwsNetworkInterfaceRead(d *schema.ResourceData, meta interface{}) e
 	d.Set("security_groups", flattenGroupIdentifiers(eni.Groups))
 
 	// Tags
-	d.Set("tags", tagsToMapSDK(eni.TagSet))
+	d.Set("tags", tagsToMap(eni.TagSet))
 
 	if eni.Attachment != nil {
 		attachment := []map[string]interface{}{flattenAttachment(eni.Attachment)}
@@ -226,7 +235,7 @@ func resourceAwsNetworkInterfaceUpdate(d *schema.ResourceData, meta interface{})
 		d.SetPartial("security_groups")
 	}
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
diff --git a/builtin/providers/aws/resource_aws_network_interface_test.go b/builtin/providers/aws/resource_aws_network_interface_test.go
index 6df6ded7a..f83698abf 100644
--- a/builtin/providers/aws/resource_aws_network_interface_test.go
+++ b/builtin/providers/aws/resource_aws_network_interface_test.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -155,7 +156,7 @@ func testAccCheckAWSENIDestroy(s *terraform.State) error {
 		_, err := conn.DescribeNetworkInterfaces(describe_network_interfaces_request)
 
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidNetworkInterfaceID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidNetworkInterfaceID.NotFound" {
 				return nil
 			}
 
diff --git a/builtin/providers/aws/resource_aws_proxy_protocol_policy.go b/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
index bdd5a8a5a..4f878e444 100644
--- a/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
+++ b/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
@@ -6,8 +6,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -165,6 +165,7 @@ func resourceAwsProxyProtocolPolicyDelete(d *schema.ResourceData, meta interface
 	req := &elb.DescribeLoadBalancersInput{
 		LoadBalancerNames: []*string{elbname},
 	}
+	var err error
 	resp, err := elbconn.DescribeLoadBalancers(req)
 	if err != nil {
 		if isLoadBalancerNotFound(err) {
diff --git a/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go b/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
index d03cfd7eb..945a62d48 100644
--- a/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
+++ b/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSProxyProtocolPolicy(t *testing.T) {
+func TestAccAWSProxyProtocolPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_route53_delegation_set.go b/builtin/providers/aws/resource_aws_route53_delegation_set.go
new file mode 100644
index 000000000..5669fe7e1
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_delegation_set.go
@@ -0,0 +1,108 @@
+package aws
+
+import (
+	"log"
+	"sort"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func resourceAwsRoute53DelegationSet() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsRoute53DelegationSetCreate,
+		Read:   resourceAwsRoute53DelegationSetRead,
+		Delete: resourceAwsRoute53DelegationSetDelete,
+
+		Schema: map[string]*schema.Schema{
+			"reference_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"name_servers": &schema.Schema{
+				Type:     schema.TypeList,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsRoute53DelegationSetCreate(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	callerRef := resource.UniqueId()
+	if v, ok := d.GetOk("reference_name"); ok {
+		callerRef = strings.Join([]string{
+			v.(string), "-", callerRef,
+		}, "")
+	}
+	input := &route53.CreateReusableDelegationSetInput{
+		CallerReference: aws.String(callerRef),
+	}
+
+	log.Printf("[DEBUG] Creating Route53 reusable delegation set: %#v", input)
+	out, err := r53.CreateReusableDelegationSet(input)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Route53 reusable delegation set created: %#v", out)
+
+	set := out.DelegationSet
+	d.SetId(cleanDelegationSetId(*set.ID))
+	d.Set("name_servers", expandNameServers(set.NameServers))
+	return nil
+}
+
+func resourceAwsRoute53DelegationSetRead(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	input := &route53.GetReusableDelegationSetInput{
+		ID: aws.String(cleanDelegationSetId(d.Id())),
+	}
+	log.Printf("[DEBUG] Reading Route53 reusable delegation set: %#v", input)
+	out, err := r53.GetReusableDelegationSet(input)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Route53 reusable delegation set received: %#v", out)
+
+	set := out.DelegationSet
+
+	d.SetId(cleanDelegationSetId(*set.ID))
+	d.Set("name_servers", expandNameServers(set.NameServers))
+
+	return nil
+}
+
+func resourceAwsRoute53DelegationSetDelete(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	input := &route53.DeleteReusableDelegationSetInput{
+		ID: aws.String(cleanDelegationSetId(d.Id())),
+	}
+	log.Printf("[DEBUG] Deleting Route53 reusable delegation set: %#v", input)
+	_, err := r53.DeleteReusableDelegationSet(input)
+	return err
+}
+
+func expandNameServers(name_servers []*string) []string {
+	log.Printf("[DEBUG] Processing %d name servers: %#v...", len(name_servers), name_servers)
+	ns := make([]string, len(name_servers))
+	for i, server := range name_servers {
+		ns[i] = *server
+	}
+	sort.Strings(ns)
+	log.Printf("[DEBUG] Returning processed name servers: %#v", ns)
+	return ns
+}
+
+func cleanDelegationSetId(id string) string {
+	return strings.TrimPrefix(id, "/delegationset/")
+}
diff --git a/builtin/providers/aws/resource_aws_route53_delegation_set_test.go b/builtin/providers/aws/resource_aws_route53_delegation_set_test.go
new file mode 100644
index 000000000..8de0e1b83
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_delegation_set_test.go
@@ -0,0 +1,153 @@
+package aws
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func TestAccRoute53DelegationSet_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53DelegationSetConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53DelegationSetExists("aws_route53_delegation_set.test"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53DelegationSet_withZones(t *testing.T) {
+	var zone route53.GetHostedZoneOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53DelegationSetWithZonesConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53DelegationSetExists("aws_route53_delegation_set.main"),
+					testAccCheckRoute53ZoneExists("aws_route53_zone.primary", &zone),
+					testAccCheckRoute53ZoneExists("aws_route53_zone.secondary", &zone),
+					testAccCheckRoute53NameServersMatch("aws_route53_delegation_set.main", "aws_route53_zone.primary"),
+					testAccCheckRoute53NameServersMatch("aws_route53_delegation_set.main", "aws_route53_zone.secondary"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckRoute53DelegationSetDestroy(s *terraform.State, provider *schema.Provider) error {
+	conn := provider.Meta().(*AWSClient).r53conn
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_route53_delegation_set" {
+			continue
+		}
+
+		_, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{ID: aws.String(rs.Primary.ID)})
+		if err == nil {
+			return fmt.Errorf("Delegation set still exists")
+		}
+	}
+	return nil
+}
+
+func testAccCheckRoute53DelegationSetExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No delegation set ID is set")
+		}
+
+		out, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{
+			ID: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", rs.Primary.ID)
+		}
+
+		setID := cleanDelegationSetId(*out.DelegationSet.ID)
+		if setID != rs.Primary.ID {
+			return fmt.Errorf("Delegation set ID does not match:\nExpected: %#v\nReturned: %#v", rs.Primary.ID, setID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckRoute53NameServersMatch(delegationSetName, zoneName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+		delegationSetLocal, ok := s.RootModule().Resources[delegationSetName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", delegationSetName)
+		}
+		delegationSet, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{
+			ID: aws.String(delegationSetLocal.Primary.ID),
+		})
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", delegationSetLocal.Primary.ID)
+		}
+
+		hostedZoneLocal, ok := s.RootModule().Resources[zoneName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", zoneName)
+		}
+		hostedZone, err := conn.GetHostedZone(&route53.GetHostedZoneInput{
+			ID: aws.String(hostedZoneLocal.Primary.ID),
+		})
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", hostedZoneLocal.Primary.ID)
+		}
+
+		if !reflect.DeepEqual(delegationSet.DelegationSet.NameServers, hostedZone.DelegationSet.NameServers) {
+			return fmt.Errorf("Name servers do not match:\nDelegation Set: %#v\nHosted Zone:%#v",
+				delegationSet.DelegationSet.NameServers, hostedZone.DelegationSet.NameServers)
+		}
+
+		return nil
+	}
+}
+
+const testAccRoute53DelegationSetConfig = `
+resource "aws_route53_delegation_set" "test" {
+	reference_name = "test"
+}
+`
+
+const testAccRoute53DelegationSetWithZonesConfig = `
+resource "aws_route53_delegation_set" "main" {
+    reference_name = "main"
+}
+
+resource "aws_route53_zone" "primary" {
+    name = "hashicorp.com"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+
+resource "aws_route53_zone" "secondary" {
+    name = "terraform.io"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route53_health_check.go b/builtin/providers/aws/resource_aws_route53_health_check.go
new file mode 100644
index 000000000..cd48a30b7
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_health_check.go
@@ -0,0 +1,211 @@
+package aws
+
+import (
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func resourceAwsRoute53HealthCheck() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsRoute53HealthCheckCreate,
+		Read:   resourceAwsRoute53HealthCheckRead,
+		Update: resourceAwsRoute53HealthCheckUpdate,
+		Delete: resourceAwsRoute53HealthCheckDelete,
+
+		Schema: map[string]*schema.Schema{
+			"type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"failure_threshold": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"request_interval": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true, // todo this should be updateable but the awslabs route53 service doesnt have the ability
+			},
+			"ip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+			"fqdn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"port": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"resource_path": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"search_string": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"tags": tagsSchema(),
+		},
+	}
+}
+
+func resourceAwsRoute53HealthCheckUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	updateHealthCheck := &route53.UpdateHealthCheckInput{
+		HealthCheckID: aws.String(d.Id()),
+	}
+
+	if d.HasChange("failure_threshold") {
+		updateHealthCheck.FailureThreshold = aws.Long(int64(d.Get("failure_threshold").(int)))
+	}
+
+	if d.HasChange("fqdn") {
+		updateHealthCheck.FullyQualifiedDomainName = aws.String(d.Get("fqdn").(string))
+	}
+
+	if d.HasChange("port") {
+		updateHealthCheck.Port = aws.Long(int64(d.Get("port").(int)))
+	}
+
+	if d.HasChange("resource_path") {
+		updateHealthCheck.ResourcePath = aws.String(d.Get("resource_path").(string))
+	}
+
+	if d.HasChange("search_string") {
+		updateHealthCheck.SearchString = aws.String(d.Get("search_string").(string))
+	}
+
+	_, err := conn.UpdateHealthCheck(updateHealthCheck)
+	if err != nil {
+		return err
+	}
+
+	if err := setTagsR53(conn, d, "healthcheck"); err != nil {
+		return err
+	}
+
+	return resourceAwsRoute53HealthCheckRead(d, meta)
+}
+
+func resourceAwsRoute53HealthCheckCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	healthConfig := &route53.HealthCheckConfig{
+		Type:             aws.String(d.Get("type").(string)),
+		FailureThreshold: aws.Long(int64(d.Get("failure_threshold").(int))),
+		RequestInterval:  aws.Long(int64(d.Get("request_interval").(int))),
+	}
+
+	if v, ok := d.GetOk("fqdn"); ok {
+		healthConfig.FullyQualifiedDomainName = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("search_string"); ok {
+		healthConfig.SearchString = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("ip_address"); ok {
+		healthConfig.IPAddress = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("port"); ok {
+		healthConfig.Port = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("resource_path"); ok {
+		healthConfig.ResourcePath = aws.String(v.(string))
+	}
+
+	input := &route53.CreateHealthCheckInput{
+		CallerReference:   aws.String(time.Now().Format(time.RFC3339Nano)),
+		HealthCheckConfig: healthConfig,
+	}
+
+	resp, err := conn.CreateHealthCheck(input)
+
+	if err != nil {
+		return err
+	}
+
+	d.SetId(*resp.HealthCheck.ID)
+
+	if err := setTagsR53(conn, d, "healthcheck"); err != nil {
+		return err
+	}
+
+	return resourceAwsRoute53HealthCheckRead(d, meta)
+}
+
+func resourceAwsRoute53HealthCheckRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	read, err := conn.GetHealthCheck(&route53.GetHealthCheckInput{HealthCheckID: aws.String(d.Id())})
+	if err != nil {
+		if r53err, ok := err.(awserr.Error); ok && r53err.Code() == "NoSuchHealthCheck" {
+			d.SetId("")
+			return nil
+
+		}
+		return err
+	}
+
+	if read == nil {
+		return nil
+	}
+
+	updated := read.HealthCheck.HealthCheckConfig
+	d.Set("type", updated.Type)
+	d.Set("failure_threshold", updated.FailureThreshold)
+	d.Set("request_interval", updated.RequestInterval)
+	d.Set("fqdn", updated.FullyQualifiedDomainName)
+	d.Set("search_string", updated.SearchString)
+	d.Set("ip_address", updated.IPAddress)
+	d.Set("port", updated.Port)
+	d.Set("resource_path", updated.ResourcePath)
+
+	// read the tags
+	req := &route53.ListTagsForResourceInput{
+		ResourceID:   aws.String(d.Id()),
+		ResourceType: aws.String("healthcheck"),
+	}
+
+	resp, err := conn.ListTagsForResource(req)
+	if err != nil {
+		return err
+	}
+
+	var tags []*route53.Tag
+	if resp.ResourceTagSet != nil {
+		tags = resp.ResourceTagSet.Tags
+	}
+
+	if err := d.Set("tags", tagsToMapR53(tags)); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceAwsRoute53HealthCheckDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	log.Printf("[DEBUG] Deleteing Route53 health check: %s", d.Id())
+	_, err := conn.DeleteHealthCheck(&route53.DeleteHealthCheckInput{HealthCheckID: aws.String(d.Id())})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_route53_health_check_test.go b/builtin/providers/aws/resource_aws_route53_health_check_test.go
new file mode 100644
index 000000000..32286cc41
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_health_check_test.go
@@ -0,0 +1,162 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func TestAccRoute53HealthCheck_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53HealthCheckDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.foo"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.foo"),
+					resource.TestCheckResourceAttr(
+						"aws_route53_health_check.foo", "failure_threshold", "5"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53HealthCheck_IpConfig(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53HealthCheckDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckIpConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.bar"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckRoute53HealthCheckDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_route53_health_check" {
+			continue
+		}
+
+		lopts := &route53.ListHealthChecksInput{}
+		resp, err := conn.ListHealthChecks(lopts)
+		if err != nil {
+			return err
+		}
+		if len(resp.HealthChecks) == 0 {
+			return nil
+		}
+
+		for _, check := range resp.HealthChecks {
+			if *check.ID == rs.Primary.ID {
+				return fmt.Errorf("Record still exists: %#v", check)
+			}
+
+		}
+
+	}
+	return nil
+}
+
+func testAccCheckRoute53HealthCheckExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		fmt.Print(rs.Primary.ID)
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No health check ID is set")
+		}
+
+		lopts := &route53.ListHealthChecksInput{}
+		resp, err := conn.ListHealthChecks(lopts)
+		if err != nil {
+			return err
+		}
+		if len(resp.HealthChecks) == 0 {
+			return fmt.Errorf("Health Check does not exist")
+		}
+
+		for _, check := range resp.HealthChecks {
+			if *check.ID == rs.Primary.ID {
+				return nil
+			}
+
+		}
+		return fmt.Errorf("Health Check does not exist")
+	}
+}
+
+func testUpdateHappened(n string) resource.TestCheckFunc {
+	return nil
+}
+
+const testAccRoute53HealthCheckConfig = `
+resource "aws_route53_health_check" "foo" {
+  fqdn = "dev.notexample.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "2"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
+
+const testAccRoute53HealthCheckConfigUpdate = `
+resource "aws_route53_health_check" "foo" {
+  fqdn = "dev.notexample.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "5"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
+
+const testAccRoute53HealthCheckIpConfig = `
+resource "aws_route53_health_check" "bar" {
+  ip_address = "1.2.3.4"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "2"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route53_record.go b/builtin/providers/aws/resource_aws_route53_record.go
index 268bf2d04..d4eeafe18 100644
--- a/builtin/providers/aws/resource_aws_route53_record.go
+++ b/builtin/providers/aws/resource_aws_route53_record.go
@@ -11,8 +11,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func resourceAwsRoute53Record() *schema.Resource {
@@ -88,6 +89,16 @@ func resourceAwsRoute53Record() *schema.Resource {
 				Set: resourceAwsRoute53AliasRecordHash,
 			},
 
+			"failover": &schema.Schema{ // PRIMARY | SECONDARY
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"health_check_id": &schema.Schema{ // ID of health check
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
 			"records": &schema.Schema{
 				Type:          schema.TypeSet,
 				ConflictsWith: []string{"alias"},
@@ -116,6 +127,7 @@ func resourceAwsRoute53RecordCreate(d *schema.ResourceData, meta interface{}) er
 	conn := meta.(*AWSClient).r53conn
 	zone := cleanZoneID(d.Get("zone_id").(string))
 
+	var err error
 	zoneRecord, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(zone)})
 	if err != nil {
 		return err
@@ -156,8 +168,8 @@ func resourceAwsRoute53RecordCreate(d *schema.ResourceData, meta interface{}) er
 		Refresh: func() (interface{}, string, error) {
 			resp, err := conn.ChangeResourceRecordSets(req)
 			if err != nil {
-				if r53err, ok := err.(aws.APIError); ok {
-					if r53err.Code == "PriorRequestNotComplete" {
+				if r53err, ok := err.(awserr.Error); ok {
+					if r53err.Code() == "PriorRequestNotComplete" {
 						// There is some pending operation, so just retry
 						// in a bit.
 						return nil, "rejected", nil
@@ -207,7 +219,7 @@ func resourceAwsRoute53RecordCreate(d *schema.ResourceData, meta interface{}) er
 		return err
 	}
 
-	return nil
+	return resourceAwsRoute53RecordRead(d, meta)
 }
 
 func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) error {
@@ -230,10 +242,6 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 		StartRecordType: aws.String(d.Get("type").(string)),
 	}
 
-	if v, ok := d.GetOk("set_identifier"); ok {
-		lopts.StartRecordIdentifier = aws.String(v.(string))
-	}
-
 	resp, err := conn.ListResourceRecordSets(lopts)
 	if err != nil {
 		return err
@@ -250,7 +258,7 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 			continue
 		}
 
-		if lopts.StartRecordIdentifier != nil && *record.SetIdentifier != *lopts.StartRecordIdentifier {
+		if record.SetIdentifier != nil && *record.SetIdentifier != d.Get("set_identifier") {
 			continue
 		}
 
@@ -260,9 +268,12 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 		if err != nil {
 			return fmt.Errorf("[DEBUG] Error setting records for: %s, error: %#v", en, err)
 		}
+
 		d.Set("ttl", record.TTL)
 		d.Set("weight", record.Weight)
 		d.Set("set_identifier", record.SetIdentifier)
+		d.Set("failover", record.Failover)
+		d.Set("health_check_id", record.HealthCheckID)
 
 		break
 	}
@@ -280,6 +291,7 @@ func resourceAwsRoute53RecordDelete(d *schema.ResourceData, meta interface{}) er
 	zone := cleanZoneID(d.Get("zone_id").(string))
 	log.Printf("[DEBUG] Deleting resource records for zone: %s, name: %s",
 		zone, d.Get("name").(string))
+	var err error
 	zoneRecord, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(zone)})
 	if err != nil {
 		return err
@@ -314,14 +326,14 @@ func resourceAwsRoute53RecordDelete(d *schema.ResourceData, meta interface{}) er
 		Refresh: func() (interface{}, string, error) {
 			_, err := conn.ChangeResourceRecordSets(req)
 			if err != nil {
-				if r53err, ok := err.(aws.APIError); ok {
-					if r53err.Code == "PriorRequestNotComplete" {
+				if r53err, ok := err.(awserr.Error); ok {
+					if r53err.Code() == "PriorRequestNotComplete" {
 						// There is some pending operation, so just retry
 						// in a bit.
 						return 42, "rejected", nil
 					}
 
-					if r53err.Code == "InvalidChangeBatch" {
+					if r53err.Code() == "InvalidChangeBatch" {
 						// This means that the record is already gone.
 						return 42, "accepted", nil
 					}
@@ -377,6 +389,22 @@ func resourceAwsRoute53RecordBuildSet(d *schema.ResourceData, zoneName string) (
 			HostedZoneID:         aws.String(alias["zone_id"].(string)),
 		}
 		log.Printf("[DEBUG] Creating alias: %#v", alias)
+	} else {
+		if _, ok := d.GetOk("ttl"); !ok {
+			return nil, fmt.Errorf(`provider.aws: aws_route53_record: %s: "ttl": required field is not set`, d.Get("name").(string))
+		}
+
+		if _, ok := d.GetOk("records"); !ok {
+			return nil, fmt.Errorf(`provider.aws: aws_route53_record: %s: "records": required field is not set`, d.Get("name").(string))
+		}
+	}
+
+	if v, ok := d.GetOk("failover"); ok {
+		rec.Failover = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("health_check_id"); ok {
+		rec.HealthCheckID = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("weight"); ok {
diff --git a/builtin/providers/aws/resource_aws_route53_record_test.go b/builtin/providers/aws/resource_aws_route53_record_test.go
index 724b452a8..eaa6abb7a 100644
--- a/builtin/providers/aws/resource_aws_route53_record_test.go
+++ b/builtin/providers/aws/resource_aws_route53_record_test.go
@@ -8,8 +8,8 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func TestCleanRecordName(t *testing.T) {
diff --git a/builtin/providers/aws/resource_aws_route53_zone.go b/builtin/providers/aws/resource_aws_route53_zone.go
index 59937fbc0..3cdd756c6 100644
--- a/builtin/providers/aws/resource_aws_route53_zone.go
+++ b/builtin/providers/aws/resource_aws_route53_zone.go
@@ -10,8 +10,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func resourceAwsRoute53Zone() *schema.Resource {
@@ -28,11 +29,36 @@ func resourceAwsRoute53Zone() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"comment": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "Managed by Terraform",
+			},
+
+			"vpc_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"vpc_region": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Computed: true,
+			},
+
 			"zone_id": &schema.Schema{
 				Type:     schema.TypeString,
 				Computed: true,
 			},
 
+			"delegation_set_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"name_servers": &schema.Schema{
 				Type:     schema.TypeList,
 				Elem:     &schema.Schema{Type: schema.TypeString},
@@ -47,14 +73,28 @@ func resourceAwsRoute53Zone() *schema.Resource {
 func resourceAwsRoute53ZoneCreate(d *schema.ResourceData, meta interface{}) error {
 	r53 := meta.(*AWSClient).r53conn
 
-	comment := &route53.HostedZoneConfig{Comment: aws.String("Managed by Terraform")}
 	req := &route53.CreateHostedZoneInput{
 		Name:             aws.String(d.Get("name").(string)),
-		HostedZoneConfig: comment,
+		HostedZoneConfig: &route53.HostedZoneConfig{Comment: aws.String(d.Get("comment").(string))},
 		CallerReference:  aws.String(time.Now().Format(time.RFC3339Nano)),
 	}
+	if v := d.Get("vpc_id"); v != "" {
+		req.VPC = &route53.VPC{
+			VPCID:     aws.String(v.(string)),
+			VPCRegion: aws.String(meta.(*AWSClient).region),
+		}
+		if w := d.Get("vpc_region"); w != "" {
+			req.VPC.VPCRegion = aws.String(w.(string))
+		}
+		d.Set("vpc_region", req.VPC.VPCRegion)
+	}
+
+	if v, ok := d.GetOk("delegation_set_id"); ok {
+		req.DelegationSetID = aws.String(v.(string))
+	}
 
 	log.Printf("[DEBUG] Creating Route53 hosted zone: %s", *req.Name)
+	var err error
 	resp, err := r53.CreateHostedZone(req)
 	if err != nil {
 		return err
@@ -91,20 +131,44 @@ func resourceAwsRoute53ZoneRead(d *schema.ResourceData, meta interface{}) error
 	zone, err := r53.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(d.Id())})
 	if err != nil {
 		// Handle a deleted zone
-		if r53err, ok := err.(aws.APIError); ok && r53err.Code == "NoSuchHostedZone" {
+		if r53err, ok := err.(awserr.Error); ok && r53err.Code() == "NoSuchHostedZone" {
 			d.SetId("")
 			return nil
 		}
 		return err
 	}
 
-	ns := make([]string, len(zone.DelegationSet.NameServers))
-	for i := range zone.DelegationSet.NameServers {
-		ns[i] = *zone.DelegationSet.NameServers[i]
+	if !*zone.HostedZone.Config.PrivateZone {
+		ns := make([]string, len(zone.DelegationSet.NameServers))
+		for i := range zone.DelegationSet.NameServers {
+			ns[i] = *zone.DelegationSet.NameServers[i]
+		}
+		sort.Strings(ns)
+		if err := d.Set("name_servers", ns); err != nil {
+			return fmt.Errorf("[DEBUG] Error setting name servers for: %s, error: %#v", d.Id(), err)
+		}
+	} else {
+		ns, err := getNameServers(d.Id(), d.Get("name").(string), r53)
+		if err != nil {
+			return err
+		}
+		if err := d.Set("name_servers", ns); err != nil {
+			return fmt.Errorf("[DEBUG] Error setting name servers for: %s, error: %#v", d.Id(), err)
+		}
+
+		var associatedVPC *route53.VPC
+		for _, vpc := range zone.VPCs {
+			if *vpc.VPCID == d.Get("vpc_id") {
+				associatedVPC = vpc
+			}
+		}
+		if associatedVPC == nil {
+			return fmt.Errorf("[DEBUG] VPC: %v is not associated with Zone: %v", d.Get("vpc_id"), d.Id())
+		}
 	}
-	sort.Strings(ns)
-	if err := d.Set("name_servers", ns); err != nil {
-		return fmt.Errorf("[DEBUG] Error setting name servers for: %s, error: %#v", d.Id(), err)
+
+	if zone.DelegationSet != nil && zone.DelegationSet.ID != nil {
+		d.Set("delegation_set_id", cleanDelegationSetId(*zone.DelegationSet.ID))
 	}
 
 	// get tags
@@ -133,7 +197,7 @@ func resourceAwsRoute53ZoneRead(d *schema.ResourceData, meta interface{}) error
 func resourceAwsRoute53ZoneUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).r53conn
 
-	if err := setTagsR53(conn, d); err != nil {
+	if err := setTagsR53(conn, d, "hostedzone"); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -181,3 +245,23 @@ func cleanPrefix(ID, prefix string) string {
 	}
 	return ID
 }
+
+func getNameServers(zoneId string, zoneName string, r53 *route53.Route53) ([]string, error) {
+	resp, err := r53.ListResourceRecordSets(&route53.ListResourceRecordSetsInput{
+		HostedZoneID:    aws.String(zoneId),
+		StartRecordName: aws.String(zoneName),
+		StartRecordType: aws.String("NS"),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if len(resp.ResourceRecordSets) == 0 {
+		return nil, nil
+	}
+	ns := make([]string, len(resp.ResourceRecordSets[0].ResourceRecords))
+	for i := range resp.ResourceRecordSets[0].ResourceRecords {
+		ns[i] = *resp.ResourceRecordSets[0].ResourceRecords[i].Value
+	}
+	sort.Strings(ns)
+	return ns, nil
+}
diff --git a/builtin/providers/aws/resource_aws_route53_zone_association.go b/builtin/providers/aws/resource_aws_route53_zone_association.go
new file mode 100644
index 000000000..1a0f86d7e
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_zone_association.go
@@ -0,0 +1,149 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func resourceAwsRoute53ZoneAssociation() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsRoute53ZoneAssociationCreate,
+		Read:   resourceAwsRoute53ZoneAssociationRead,
+		Update: resourceAwsRoute53ZoneAssociationUpdate,
+		Delete: resourceAwsRoute53ZoneAssociationDelete,
+
+		Schema: map[string]*schema.Schema{
+			"zone_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"vpc_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"vpc_region": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsRoute53ZoneAssociationCreate(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	req := &route53.AssociateVPCWithHostedZoneInput{
+		HostedZoneID: aws.String(d.Get("zone_id").(string)),
+		VPC: &route53.VPC{
+			VPCID:     aws.String(d.Get("vpc_id").(string)),
+			VPCRegion: aws.String(meta.(*AWSClient).region),
+		},
+		Comment: aws.String("Managed by Terraform"),
+	}
+	if w := d.Get("vpc_region"); w != "" {
+		req.VPC.VPCRegion = aws.String(w.(string))
+	}
+
+	log.Printf("[DEBUG] Associating Route53 Private Zone %s with VPC %s with region %s", *req.HostedZoneID, *req.VPC.VPCID, *req.VPC.VPCRegion)
+	var err error
+	resp, err := r53.AssociateVPCWithHostedZone(req)
+	if err != nil {
+		return err
+	}
+
+	// Store association id
+	d.SetId(fmt.Sprintf("%s:%s", *req.HostedZoneID, *req.VPC.VPCID))
+	d.Set("vpc_region", req.VPC.VPCRegion)
+
+	// Wait until we are done initializing
+	wait := resource.StateChangeConf{
+		Delay:      30 * time.Second,
+		Pending:    []string{"PENDING"},
+		Target:     "INSYNC",
+		Timeout:    10 * time.Minute,
+		MinTimeout: 2 * time.Second,
+		Refresh: func() (result interface{}, state string, err error) {
+			changeRequest := &route53.GetChangeInput{
+				ID: aws.String(cleanChangeID(*resp.ChangeInfo.ID)),
+			}
+			return resourceAwsGoRoute53Wait(r53, changeRequest)
+		},
+	}
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	return resourceAwsRoute53ZoneAssociationUpdate(d, meta)
+}
+
+func resourceAwsRoute53ZoneAssociationRead(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+	zone_id, vpc_id := resourceAwsRoute53ZoneAssociationParseId(d.Id())
+	zone, err := r53.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(zone_id)})
+	if err != nil {
+		// Handle a deleted zone
+		if r53err, ok := err.(awserr.Error); ok && r53err.Code() == "NoSuchHostedZone" {
+			d.SetId("")
+			return nil
+		}
+		return err
+	}
+
+	for _, vpc := range zone.VPCs {
+		if vpc_id == *vpc.VPCID {
+			// association is there, return
+			return nil
+		}
+	}
+
+	// no association found
+	d.SetId("")
+	return nil
+}
+
+func resourceAwsRoute53ZoneAssociationUpdate(d *schema.ResourceData, meta interface{}) error {
+	return resourceAwsRoute53ZoneAssociationRead(d, meta)
+}
+
+func resourceAwsRoute53ZoneAssociationDelete(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+	zone_id, vpc_id := resourceAwsRoute53ZoneAssociationParseId(d.Id())
+	log.Printf("[DEBUG] Deleting Route53 Private Zone (%s) association (VPC: %s)",
+		zone_id, vpc_id)
+
+	req := &route53.DisassociateVPCFromHostedZoneInput{
+		HostedZoneID: aws.String(zone_id),
+		VPC: &route53.VPC{
+			VPCID:     aws.String(vpc_id),
+			VPCRegion: aws.String(d.Get("vpc_region").(string)),
+		},
+		Comment: aws.String("Managed by Terraform"),
+	}
+
+	_, err := r53.DisassociateVPCFromHostedZone(req)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceAwsRoute53ZoneAssociationParseId(id string) (zone_id, vpc_id string) {
+	parts := strings.SplitN(id, ":", 2)
+	zone_id = parts[0]
+	vpc_id = parts[1]
+	return
+}
diff --git a/builtin/providers/aws/resource_aws_route53_zone_association_test.go b/builtin/providers/aws/resource_aws_route53_zone_association_test.go
new file mode 100644
index 000000000..e929d4d31
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_zone_association_test.go
@@ -0,0 +1,218 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func TestAccRoute53ZoneAssociation_basic(t *testing.T) {
+	var zone route53.HostedZone
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneAssociationDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53ZoneAssociationConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53ZoneAssociationExists("aws_route53_zone_association.foobar", &zone),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53ZoneAssociation_region(t *testing.T) {
+	var zone route53.HostedZone
+
+	// record the initialized providers so that we can use them to
+	// check for the instances in each region
+	var providers []*schema.Provider
+	providerFactories := map[string]terraform.ResourceProviderFactory{
+		"aws": func() (terraform.ResourceProvider, error) {
+			p := Provider()
+			providers = append(providers, p.(*schema.Provider))
+			return p, nil
+		},
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: providerFactories,
+		CheckDestroy:      testAccCheckRoute53ZoneAssociationDestroyWithProviders(&providers),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53ZoneAssociationRegionConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53ZoneAssociationExistsWithProviders("aws_route53_zone_association.foobar", &zone, &providers),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckRoute53ZoneAssociationDestroy(s *terraform.State) error {
+	return testAccCheckRoute53ZoneAssociationDestroyWithProvider(s, testAccProvider)
+}
+
+func testAccCheckRoute53ZoneAssociationDestroyWithProviders(providers *[]*schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, provider := range *providers {
+			if provider.Meta() == nil {
+				continue
+			}
+			if err := testAccCheckRoute53ZoneAssociationDestroyWithProvider(s, provider); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckRoute53ZoneAssociationDestroyWithProvider(s *terraform.State, provider *schema.Provider) error {
+	conn := provider.Meta().(*AWSClient).r53conn
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_route53_zone_association" {
+			continue
+		}
+
+		zone_id, vpc_id := resourceAwsRoute53ZoneAssociationParseId(rs.Primary.ID)
+
+		resp, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(zone_id)})
+		if err != nil {
+			exists := false
+			for _, vpc := range resp.VPCs {
+				if vpc_id == *vpc.VPCID {
+					exists = true
+				}
+			}
+			if exists {
+				return fmt.Errorf("VPC: %v is still associated to HostedZone: %v", vpc_id, zone_id)
+			}
+		}
+	}
+	return nil
+}
+
+func testAccCheckRoute53ZoneAssociationExists(n string, zone *route53.HostedZone) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		return testAccCheckRoute53ZoneAssociationExistsWithProvider(s, n, zone, testAccProvider)
+	}
+}
+
+func testAccCheckRoute53ZoneAssociationExistsWithProviders(n string, zone *route53.HostedZone, providers *[]*schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, provider := range *providers {
+			if provider.Meta() == nil {
+				continue
+			}
+			if err := testAccCheckRoute53ZoneAssociationExistsWithProvider(s, n, zone, provider); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckRoute53ZoneAssociationExistsWithProvider(s *terraform.State, n string, zone *route53.HostedZone, provider *schema.Provider) error {
+	rs, ok := s.RootModule().Resources[n]
+	if !ok {
+		return fmt.Errorf("Not found: %s", n)
+	}
+
+	if rs.Primary.ID == "" {
+		return fmt.Errorf("No zone association ID is set")
+	}
+
+	zone_id, vpc_id := resourceAwsRoute53ZoneAssociationParseId(rs.Primary.ID)
+
+	conn := provider.Meta().(*AWSClient).r53conn
+	resp, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(zone_id)})
+	if err != nil {
+		return fmt.Errorf("Hosted zone err: %v", err)
+	}
+
+	exists := false
+	for _, vpc := range resp.VPCs {
+		if vpc_id == *vpc.VPCID {
+			exists = true
+		}
+	}
+	if !exists {
+		return fmt.Errorf("Hosted zone association not found")
+	}
+
+	*zone = *resp.HostedZone
+	return nil
+}
+
+const testAccRoute53ZoneAssociationConfig = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.6.0.0/16"
+	enable_dns_hostnames = true
+	enable_dns_support = true
+}
+
+resource "aws_vpc" "bar" {
+	cidr_block = "10.7.0.0/16"
+	enable_dns_hostnames = true
+	enable_dns_support = true
+}
+
+resource "aws_route53_zone" "foo" {
+	name = "foo.com"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_route53_zone_association" "foobar" {
+	zone_id = "${aws_route53_zone.foo.id}"
+	vpc_id  = "${aws_vpc.bar.id}"
+}
+`
+
+const testAccRoute53ZoneAssociationRegionConfig = `
+provider "aws" {
+	alias = "west"
+	region = "us-west-2"
+}
+
+provider "aws" {
+	alias = "east"
+	region = "us-east-1"
+}
+
+resource "aws_vpc" "foo" {
+	provider = "aws.west"
+	cidr_block = "10.6.0.0/16"
+	enable_dns_hostnames = true
+	enable_dns_support = true
+}
+
+resource "aws_vpc" "bar" {
+	provider = "aws.east"
+	cidr_block = "10.7.0.0/16"
+	enable_dns_hostnames = true
+	enable_dns_support = true
+}
+
+resource "aws_route53_zone" "foo" {
+	provider = "aws.west"
+	name = "foo.com"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_route53_zone_association" "foobar" {
+	provider = "aws.west"
+	zone_id = "${aws_route53_zone.foo.id}"
+	vpc_id  = "${aws_vpc.bar.id}"
+	vpc_region = "us-east-1"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route53_zone_test.go b/builtin/providers/aws/resource_aws_route53_zone_test.go
index 0a32cb2cd..92ab8a217 100644
--- a/builtin/providers/aws/resource_aws_route53_zone_test.go
+++ b/builtin/providers/aws/resource_aws_route53_zone_test.go
@@ -6,10 +6,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func TestCleanPrefix(t *testing.T) {
@@ -63,8 +64,8 @@ func TestCleanChangeID(t *testing.T) {
 	}
 }
 
-func TestAccRoute53Zone(t *testing.T) {
-	var zone route53.HostedZone
+func TestAccRoute53Zone_basic(t *testing.T) {
+	var zone route53.GetHostedZoneOutput
 	var td route53.ResourceTagSet
 
 	resource.Test(t, resource.TestCase{
@@ -84,8 +85,75 @@ func TestAccRoute53Zone(t *testing.T) {
 	})
 }
 
+func TestAccRoute53Zone_private_basic(t *testing.T) {
+	var zone route53.GetHostedZoneOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53PrivateZoneConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53ZoneExists("aws_route53_zone.main", &zone),
+					testAccCheckRoute53ZoneAssociatesWithVpc("aws_vpc.main", &zone),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53Zone_private_region(t *testing.T) {
+	var zone route53.GetHostedZoneOutput
+
+	// record the initialized providers so that we can use them to
+	// check for the instances in each region
+	var providers []*schema.Provider
+	providerFactories := map[string]terraform.ResourceProviderFactory{
+		"aws": func() (terraform.ResourceProvider, error) {
+			p := Provider()
+			providers = append(providers, p.(*schema.Provider))
+			return p, nil
+		},
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: providerFactories,
+		CheckDestroy:      testAccCheckRoute53ZoneDestroyWithProviders(&providers),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53PrivateZoneRegionConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53ZoneExistsWithProviders("aws_route53_zone.main", &zone, &providers),
+					testAccCheckRoute53ZoneAssociatesWithVpc("aws_vpc.main", &zone),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckRoute53ZoneDestroy(s *terraform.State) error {
-	conn := testAccProvider.Meta().(*AWSClient).r53conn
+	return testAccCheckRoute53ZoneDestroyWithProvider(s, testAccProvider)
+}
+
+func testAccCheckRoute53ZoneDestroyWithProviders(providers *[]*schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, provider := range *providers {
+			if provider.Meta() == nil {
+				continue
+			}
+			if err := testAccCheckRoute53ZoneDestroyWithProvider(s, provider); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckRoute53ZoneDestroyWithProvider(s *terraform.State, provider *schema.Provider) error {
+	conn := provider.Meta().(*AWSClient).r53conn
 	for _, rs := range s.RootModule().Resources {
 		if rs.Type != "aws_route53_zone" {
 			continue
@@ -99,23 +167,49 @@ func testAccCheckRoute53ZoneDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccCheckRoute53ZoneExists(n string, zone *route53.HostedZone) resource.TestCheckFunc {
+func testAccCheckRoute53ZoneExists(n string, zone *route53.GetHostedZoneOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
+		return testAccCheckRoute53ZoneExistsWithProvider(s, n, zone, testAccProvider)
+	}
+}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No hosted zone ID is set")
+func testAccCheckRoute53ZoneExistsWithProviders(n string, zone *route53.GetHostedZoneOutput, providers *[]*schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, provider := range *providers {
+			if provider.Meta() == nil {
+				continue
+			}
+			if err := testAccCheckRoute53ZoneExistsWithProvider(s, n, zone, provider); err != nil {
+				return err
+			}
 		}
+		return nil
+	}
+}
 
-		conn := testAccProvider.Meta().(*AWSClient).r53conn
-		resp, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(rs.Primary.ID)})
-		if err != nil {
-			return fmt.Errorf("Hosted zone err: %v", err)
-		}
+func testAccCheckRoute53ZoneExistsWithProvider(s *terraform.State, n string, zone *route53.GetHostedZoneOutput, provider *schema.Provider) error {
+	rs, ok := s.RootModule().Resources[n]
+	if !ok {
+		return fmt.Errorf("Not found: %s", n)
+	}
 
+	if rs.Primary.ID == "" {
+		return fmt.Errorf("No hosted zone ID is set")
+	}
+
+	conn := provider.Meta().(*AWSClient).r53conn
+	resp, err := conn.GetHostedZone(&route53.GetHostedZoneInput{ID: aws.String(rs.Primary.ID)})
+	if err != nil {
+		return fmt.Errorf("Hosted zone err: %v", err)
+	}
+
+	aws_comment := *resp.HostedZone.Config.Comment
+	rs_comment := rs.Primary.Attributes["comment"]
+	if rs_comment != "" && rs_comment != aws_comment {
+		return fmt.Errorf("Hosted zone with comment '%s' found but does not match '%s'", aws_comment, rs_comment)
+	}
+
+	if !*resp.HostedZone.Config.PrivateZone {
 		sorted_ns := make([]string, len(resp.DelegationSet.NameServers))
 		for i, ns := range resp.DelegationSet.NameServers {
 			sorted_ns[i] = *ns
@@ -128,17 +222,41 @@ func testAccCheckRoute53ZoneExists(n string, zone *route53.HostedZone) resource.
 				return fmt.Errorf("Got: %v for %v, Expected: %v", dsns, attribute, ns)
 			}
 		}
+	}
 
-		*zone = *resp.HostedZone
+	*zone = *resp
+	return nil
+}
+
+func testAccCheckRoute53ZoneAssociatesWithVpc(n string, zone *route53.GetHostedZoneOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPC ID is set")
+		}
+
+		var associatedVPC *route53.VPC
+		for _, vpc := range zone.VPCs {
+			if *vpc.VPCID == rs.Primary.ID {
+				associatedVPC = vpc
+			}
+		}
+		if associatedVPC == nil {
+			return fmt.Errorf("VPC: %v is not associated to Zone: %v", n, cleanZoneID(*zone.HostedZone.ID))
+		}
 		return nil
 	}
 }
 
-func testAccLoadTagsR53(zone *route53.HostedZone, td *route53.ResourceTagSet) resource.TestCheckFunc {
+func testAccLoadTagsR53(zone *route53.GetHostedZoneOutput, td *route53.ResourceTagSet) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := testAccProvider.Meta().(*AWSClient).r53conn
 
-		zone := cleanZoneID(*zone.ID)
+		zone := cleanZoneID(*zone.HostedZone.ID)
 		req := &route53.ListTagsForResourceInput{
 			ResourceID:   aws.String(zone),
 			ResourceType: aws.String("hostedzone"),
@@ -160,6 +278,7 @@ func testAccLoadTagsR53(zone *route53.HostedZone, td *route53.ResourceTagSet) re
 const testAccRoute53ZoneConfig = `
 resource "aws_route53_zone" "main" {
 	name = "hashicorp.com"
+	comment = "Custom comment"
 
 	tags {
 		foo = "bar"
@@ -167,3 +286,44 @@ resource "aws_route53_zone" "main" {
 	}
 }
 `
+
+const testAccRoute53PrivateZoneConfig = `
+resource "aws_vpc" "main" {
+	cidr_block = "172.29.0.0/24"
+	instance_tenancy = "default"
+	enable_dns_support = true
+	enable_dns_hostnames = true
+}
+
+resource "aws_route53_zone" "main" {
+	name = "hashicorp.com"
+	vpc_id = "${aws_vpc.main.id}"
+}
+`
+
+const testAccRoute53PrivateZoneRegionConfig = `
+provider "aws" {
+	alias = "west"
+	region = "us-west-2"
+}
+
+provider "aws" {
+	alias = "east"
+	region = "us-east-1"
+}
+
+resource "aws_vpc" "main" {
+	provider = "aws.east"
+	cidr_block = "172.29.0.0/24"
+	instance_tenancy = "default"
+	enable_dns_support = true
+	enable_dns_hostnames = true
+}
+
+resource "aws_route53_zone" "main" {
+	provider = "aws.west"
+	name = "hashicorp.com"
+	vpc_id = "${aws_vpc.main.id}"
+	vpc_region = "us-east-1"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route_table.go b/builtin/providers/aws/resource_aws_route_table.go
index 402db8068..f6d6313ec 100644
--- a/builtin/providers/aws/resource_aws_route_table.go
+++ b/builtin/providers/aws/resource_aws_route_table.go
@@ -6,8 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -147,6 +148,12 @@ func resourceAwsRouteTableRead(d *schema.ResourceData, meta interface{}) error {
 			continue
 		}
 
+		if r.DestinationPrefixListID != nil {
+			// Skipping because VPC endpoint routes are handled separately
+			// See aws_vpc_endpoint
+			continue
+		}
+
 		m := make(map[string]interface{})
 
 		if r.DestinationCIDRBlock != nil {
@@ -170,7 +177,7 @@ func resourceAwsRouteTableRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("route", route)
 
 	// Tags
-	d.Set("tags", tagsToMapSDK(rt.Tags))
+	d.Set("tags", tagsToMap(rt.Tags))
 
 	return nil
 }
@@ -224,8 +231,8 @@ func resourceAwsRouteTableUpdate(d *schema.ResourceData, meta interface{}) error
 				// If we get a Gateway.NotAttached, it is usually some
 				// eventually consistency stuff. So we have to just wait a
 				// bit...
-				ec2err, ok := err.(aws.APIError)
-				if ok && ec2err.Code == "Gateway.NotAttached" {
+				ec2err, ok := err.(awserr.Error)
+				if ok && ec2err.Code() == "Gateway.NotAttached" {
 					time.Sleep(20 * time.Second)
 					continue
 				}
@@ -289,7 +296,7 @@ func resourceAwsRouteTableUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -329,8 +336,8 @@ func resourceAwsRouteTableDelete(d *schema.ResourceData, meta interface{}) error
 		RouteTableID: aws.String(d.Id()),
 	})
 	if err != nil {
-		ec2err, ok := err.(aws.APIError)
-		if ok && ec2err.Code == "InvalidRouteTableID.NotFound" {
+		ec2err, ok := err.(awserr.Error)
+		if ok && ec2err.Code() == "InvalidRouteTableID.NotFound" {
 			return nil
 		}
 
@@ -360,7 +367,10 @@ func resourceAwsRouteTableDelete(d *schema.ResourceData, meta interface{}) error
 func resourceAwsRouteTableHash(v interface{}) int {
 	var buf bytes.Buffer
 	m := v.(map[string]interface{})
-	buf.WriteString(fmt.Sprintf("%s-", m["cidr_block"].(string)))
+
+	if v, ok := m["cidr_block"]; ok {
+		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
+	}
 
 	if v, ok := m["gateway_id"]; ok {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
@@ -391,7 +401,7 @@ func resourceAwsRouteTableStateRefreshFunc(conn *ec2.EC2, id string) resource.St
 			RouteTableIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidRouteTableID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidRouteTableID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on RouteTableStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_route_table_association.go b/builtin/providers/aws/resource_aws_route_table_association.go
index eb9d9663a..6c63c9e23 100644
--- a/builtin/providers/aws/resource_aws_route_table_association.go
+++ b/builtin/providers/aws/resource_aws_route_table_association.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -102,8 +103,8 @@ func resourceAwsRouteTableAssociationUpdate(d *schema.ResourceData, meta interfa
 	resp, err := conn.ReplaceRouteTableAssociation(req)
 
 	if err != nil {
-		ec2err, ok := err.(aws.APIError)
-		if ok && ec2err.Code == "InvalidAssociationID.NotFound" {
+		ec2err, ok := err.(awserr.Error)
+		if ok && ec2err.Code() == "InvalidAssociationID.NotFound" {
 			// Not found, so just create a new one
 			return resourceAwsRouteTableAssociationCreate(d, meta)
 		}
@@ -126,8 +127,8 @@ func resourceAwsRouteTableAssociationDelete(d *schema.ResourceData, meta interfa
 		AssociationID: aws.String(d.Id()),
 	})
 	if err != nil {
-		ec2err, ok := err.(aws.APIError)
-		if ok && ec2err.Code == "InvalidAssociationID.NotFound" {
+		ec2err, ok := err.(awserr.Error)
+		if ok && ec2err.Code() == "InvalidAssociationID.NotFound" {
 			return nil
 		}
 
diff --git a/builtin/providers/aws/resource_aws_route_table_association_test.go b/builtin/providers/aws/resource_aws_route_table_association_test.go
index 2729bd1f0..368bc829f 100644
--- a/builtin/providers/aws/resource_aws_route_table_association_test.go
+++ b/builtin/providers/aws/resource_aws_route_table_association_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRouteTableAssociation(t *testing.T) {
+func TestAccAWSRouteTableAssociation_basic(t *testing.T) {
 	var v, v2 ec2.RouteTable
 
 	resource.Test(t, resource.TestCase{
@@ -51,11 +52,11 @@ func testAccCheckRouteTableAssociationDestroy(s *terraform.State) error {
 		})
 		if err != nil {
 			// Verify the error is what we want
-			ec2err, ok := err.(aws.APIError)
+			ec2err, ok := err.(awserr.Error)
 			if !ok {
 				return err
 			}
-			if ec2err.Code != "InvalidRouteTableID.NotFound" {
+			if ec2err.Code() != "InvalidRouteTableID.NotFound" {
 				return err
 			}
 			return nil
diff --git a/builtin/providers/aws/resource_aws_route_table_test.go b/builtin/providers/aws/resource_aws_route_table_test.go
index 10dd9d3fd..ff340ae0b 100644
--- a/builtin/providers/aws/resource_aws_route_table_test.go
+++ b/builtin/providers/aws/resource_aws_route_table_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRouteTable_normal(t *testing.T) {
+func TestAccAWSRouteTable_basic(t *testing.T) {
 	var v ec2.RouteTable
 
 	testCheck := func(*terraform.State) error {
@@ -134,7 +135,7 @@ func TestAccAWSRouteTable_tags(t *testing.T) {
 				Config: testAccRouteTableConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists("aws_route_table.foo", &route_table),
-					testAccCheckTagsSDK(&route_table.Tags, "foo", "bar"),
+					testAccCheckTags(&route_table.Tags, "foo", "bar"),
 				),
 			},
 
@@ -142,8 +143,8 @@ func TestAccAWSRouteTable_tags(t *testing.T) {
 				Config: testAccRouteTableConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists("aws_route_table.foo", &route_table),
-					testAccCheckTagsSDK(&route_table.Tags, "foo", ""),
-					testAccCheckTagsSDK(&route_table.Tags, "bar", "baz"),
+					testAccCheckTags(&route_table.Tags, "foo", ""),
+					testAccCheckTags(&route_table.Tags, "bar", "baz"),
 				),
 			},
 		},
@@ -171,11 +172,11 @@ func testAccCheckRouteTableDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidRouteTableID.NotFound" {
+		if ec2err.Code() != "InvalidRouteTableID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_s3_bucket.go b/builtin/providers/aws/resource_aws_s3_bucket.go
index d550124ef..93bf24390 100644
--- a/builtin/providers/aws/resource_aws_s3_bucket.go
+++ b/builtin/providers/aws/resource_aws_s3_bucket.go
@@ -1,13 +1,15 @@
 package aws
 
 import (
+	"encoding/json"
 	"fmt"
 	"log"
 
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func resourceAwsS3Bucket() *schema.Resource {
@@ -31,6 +33,12 @@ func resourceAwsS3Bucket() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"policy": &schema.Schema{
+				Type:      schema.TypeString,
+				Optional:  true,
+				StateFunc: normalizeJson,
+			},
+
 			"website": &schema.Schema{
 				Type:     schema.TypeList,
 				Optional: true,
@@ -38,13 +46,22 @@ func resourceAwsS3Bucket() *schema.Resource {
 					Schema: map[string]*schema.Schema{
 						"index_document": &schema.Schema{
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
 						},
 
 						"error_document": &schema.Schema{
 							Type:     schema.TypeString,
 							Optional: true,
 						},
+
+						"redirect_all_requests_to": &schema.Schema{
+							Type: schema.TypeString,
+							ConflictsWith: []string{
+								"website.0.index_document",
+								"website.0.error_document",
+							},
+							Optional: true,
+						},
 					},
 				},
 			},
@@ -68,6 +85,12 @@ func resourceAwsS3Bucket() *schema.Resource {
 			},
 
 			"tags": tagsSchema(),
+
+			"force_destroy": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 	}
 }
@@ -112,8 +135,16 @@ func resourceAwsS3BucketUpdate(d *schema.ResourceData, meta interface{}) error {
 		return err
 	}
 
-	if err := resourceAwsS3BucketWebsiteUpdate(s3conn, d); err != nil {
-		return err
+	if d.HasChange("policy") {
+		if err := resourceAwsS3BucketPolicyUpdate(s3conn, d); err != nil {
+			return err
+		}
+	}
+
+	if d.HasChange("website") {
+		if err := resourceAwsS3BucketWebsiteUpdate(s3conn, d); err != nil {
+			return err
+		}
 	}
 
 	return resourceAwsS3BucketRead(d, meta)
@@ -122,11 +153,12 @@ func resourceAwsS3BucketUpdate(d *schema.ResourceData, meta interface{}) error {
 func resourceAwsS3BucketRead(d *schema.ResourceData, meta interface{}) error {
 	s3conn := meta.(*AWSClient).s3conn
 
-	_, err := s3conn.HeadBucket(&s3.HeadBucketInput{
+	var err error
+	_, err = s3conn.HeadBucket(&s3.HeadBucketInput{
 		Bucket: aws.String(d.Id()),
 	})
 	if err != nil {
-		if awsError, ok := err.(aws.APIError); ok && awsError.StatusCode == 404 {
+		if awsError, ok := err.(awserr.RequestFailure); ok && awsError.StatusCode() == 404 {
 			d.SetId("")
 		} else {
 			// some of the AWS SDK's errors can be empty strings, so let's add
@@ -135,6 +167,25 @@ func resourceAwsS3BucketRead(d *schema.ResourceData, meta interface{}) error {
 		}
 	}
 
+	// Read the policy
+	pol, err := s3conn.GetBucketPolicy(&s3.GetBucketPolicyInput{
+		Bucket: aws.String(d.Id()),
+	})
+	log.Printf("[DEBUG] S3 bucket: %s, read policy: %v", d.Id(), pol)
+	if err != nil {
+		if err := d.Set("policy", ""); err != nil {
+			return err
+		}
+	} else {
+		if v := pol.Policy; v == nil {
+			if err := d.Set("policy", ""); err != nil {
+				return err
+			}
+		} else if err := d.Set("policy", normalizeJson(*v)); err != nil {
+			return err
+		}
+	}
+
 	// Read the website configuration
 	ws, err := s3conn.GetBucketWebsite(&s3.GetBucketWebsiteInput{
 		Bucket: aws.String(d.Id()),
@@ -143,12 +194,18 @@ func resourceAwsS3BucketRead(d *schema.ResourceData, meta interface{}) error {
 	if err == nil {
 		w := make(map[string]interface{})
 
-		w["index_document"] = *ws.IndexDocument.Suffix
+		if v := ws.IndexDocument; v != nil {
+			w["index_document"] = *v.Suffix
+		}
 
 		if v := ws.ErrorDocument; v != nil {
 			w["error_document"] = *v.Key
 		}
 
+		if v := ws.RedirectAllRequestsTo; v != nil {
+			w["redirect_all_requests_to"] = *v.HostName
+		}
+
 		websites = append(websites, w)
 	}
 	if err := d.Set("website", websites); err != nil {
@@ -208,16 +265,80 @@ func resourceAwsS3BucketDelete(d *schema.ResourceData, meta interface{}) error {
 		Bucket: aws.String(d.Id()),
 	})
 	if err != nil {
-		return err
+		ec2err, ok := err.(awserr.Error)
+		if ok && ec2err.Code() == "BucketNotEmpty" {
+			if d.Get("force_destroy").(bool) {
+				// bucket may have things delete them
+				log.Printf("[DEBUG] S3 Bucket attempting to forceDestroy %+v", err)
+
+				bucket := d.Get("bucket").(string)
+				resp, err := s3conn.ListObjects(
+					&s3.ListObjectsInput{
+						Bucket: aws.String(bucket),
+					},
+				)
+
+				if err != nil {
+					return fmt.Errorf("Error S3 Bucket list Objects err: %s", err)
+				}
+
+				objectsToDelete := make([]*s3.ObjectIdentifier, len(resp.Contents))
+				for i, v := range resp.Contents {
+					objectsToDelete[i] = &s3.ObjectIdentifier{
+						Key: v.Key,
+					}
+				}
+				_, err = s3conn.DeleteObjects(
+					&s3.DeleteObjectsInput{
+						Bucket: aws.String(bucket),
+						Delete: &s3.Delete{
+							Objects: objectsToDelete,
+						},
+					},
+				)
+				if err != nil {
+					return fmt.Errorf("Error S3 Bucket force_destroy error deleting: %s", err)
+				}
+
+				// this line recurses until all objects are deleted or an error is returned
+				return resourceAwsS3BucketDelete(d, meta)
+			}
+		}
+		return fmt.Errorf("Error deleting S3 Bucket: %s", err)
 	}
 	return nil
 }
 
-func resourceAwsS3BucketWebsiteUpdate(s3conn *s3.S3, d *schema.ResourceData) error {
-	if !d.HasChange("website") {
-		return nil
+func resourceAwsS3BucketPolicyUpdate(s3conn *s3.S3, d *schema.ResourceData) error {
+	bucket := d.Get("bucket").(string)
+	policy := d.Get("policy").(string)
+
+	if policy != "" {
+		log.Printf("[DEBUG] S3 bucket: %s, put policy: %s", bucket, policy)
+
+		_, err := s3conn.PutBucketPolicy(&s3.PutBucketPolicyInput{
+			Bucket: aws.String(bucket),
+			Policy: aws.String(policy),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error putting S3 policy: %s", err)
+		}
+	} else {
+		log.Printf("[DEBUG] S3 bucket: %s, delete policy: %s", bucket, policy)
+		_, err := s3conn.DeleteBucketPolicy(&s3.DeleteBucketPolicyInput{
+			Bucket: aws.String(bucket),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error deleting S3 policy: %s", err)
+		}
 	}
 
+	return nil
+}
+
+func resourceAwsS3BucketWebsiteUpdate(s3conn *s3.S3, d *schema.ResourceData) error {
 	ws := d.Get("website").([]interface{})
 
 	if len(ws) == 1 {
@@ -235,15 +356,26 @@ func resourceAwsS3BucketWebsitePut(s3conn *s3.S3, d *schema.ResourceData, websit
 
 	indexDocument := website["index_document"].(string)
 	errorDocument := website["error_document"].(string)
+	redirectAllRequestsTo := website["redirect_all_requests_to"].(string)
+
+	if indexDocument == "" && redirectAllRequestsTo == "" {
+		return fmt.Errorf("Must specify either index_document or redirect_all_requests_to.")
+	}
 
 	websiteConfiguration := &s3.WebsiteConfiguration{}
 
-	websiteConfiguration.IndexDocument = &s3.IndexDocument{Suffix: aws.String(indexDocument)}
+	if indexDocument != "" {
+		websiteConfiguration.IndexDocument = &s3.IndexDocument{Suffix: aws.String(indexDocument)}
+	}
 
 	if errorDocument != "" {
 		websiteConfiguration.ErrorDocument = &s3.ErrorDocument{Key: aws.String(errorDocument)}
 	}
 
+	if redirectAllRequestsTo != "" {
+		websiteConfiguration.RedirectAllRequestsTo = &s3.RedirectAllRequestsTo{HostName: aws.String(redirectAllRequestsTo)}
+	}
+
 	putInput := &s3.PutBucketWebsiteInput{
 		Bucket:               aws.String(bucket),
 		WebsiteConfiguration: websiteConfiguration,
@@ -301,9 +433,29 @@ func websiteEndpoint(s3conn *s3.S3, d *schema.ResourceData) (string, error) {
 
 func WebsiteEndpointUrl(bucket string, region string) string {
 	region = normalizeRegion(region)
+
+	// Frankfurt(and probably future) regions uses different syntax for website endpoints
+	// http://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteEndpoints.html
+	if region == "eu-central-1" {
+		return fmt.Sprintf("%s.s3-website.%s.amazonaws.com", bucket, region)
+	}
+
 	return fmt.Sprintf("%s.s3-website-%s.amazonaws.com", bucket, region)
 }
 
+func normalizeJson(jsonString interface{}) string {
+	if jsonString == nil {
+		return ""
+	}
+	j := make(map[string]interface{})
+	err := json.Unmarshal([]byte(jsonString.(string)), &j)
+	if err != nil {
+		return fmt.Sprintf("Error parsing JSON: %s", err)
+	}
+	b, _ := json.Marshal(j)
+	return string(b[:])
+}
+
 func normalizeRegion(region string) string {
 	// Default to us-east-1 if the bucket doesn't have a region:
 	// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETlocation.html
diff --git a/builtin/providers/aws/resource_aws_s3_bucket_test.go b/builtin/providers/aws/resource_aws_s3_bucket_test.go
index 1b41d76ea..171109559 100644
--- a/builtin/providers/aws/resource_aws_s3_bucket_test.go
+++ b/builtin/providers/aws/resource_aws_s3_bucket_test.go
@@ -1,16 +1,19 @@
 package aws
 
 import (
+	"encoding/json"
 	"fmt"
 	"math/rand"
+	"reflect"
+	"strconv"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func TestAccAWSS3Bucket_basic(t *testing.T) {
@@ -35,6 +38,32 @@ func TestAccAWSS3Bucket_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSS3Bucket_Policy(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSS3BucketDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSS3BucketConfigWithPolicy,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
+					testAccCheckAWSS3BucketPolicy(
+						"aws_s3_bucket.bucket", testAccAWSS3BucketPolicy),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSS3BucketConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
+					testAccCheckAWSS3BucketPolicy(
+						"aws_s3_bucket.bucket", ""),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSS3Bucket_Website(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -46,7 +75,7 @@ func TestAccAWSS3Bucket_Website(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
 					testAccCheckAWSS3BucketWebsite(
-						"aws_s3_bucket.bucket", "index.html", ""),
+						"aws_s3_bucket.bucket", "index.html", "", ""),
 					resource.TestCheckResourceAttr(
 						"aws_s3_bucket.bucket", "website_endpoint", testAccWebsiteEndpoint),
 				),
@@ -56,7 +85,7 @@ func TestAccAWSS3Bucket_Website(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
 					testAccCheckAWSS3BucketWebsite(
-						"aws_s3_bucket.bucket", "index.html", "error.html"),
+						"aws_s3_bucket.bucket", "index.html", "error.html", ""),
 					resource.TestCheckResourceAttr(
 						"aws_s3_bucket.bucket", "website_endpoint", testAccWebsiteEndpoint),
 				),
@@ -66,7 +95,37 @@ func TestAccAWSS3Bucket_Website(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
 					testAccCheckAWSS3BucketWebsite(
-						"aws_s3_bucket.bucket", "", ""),
+						"aws_s3_bucket.bucket", "", "", ""),
+					resource.TestCheckResourceAttr(
+						"aws_s3_bucket.bucket", "website_endpoint", ""),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSS3Bucket_WebsiteRedirect(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSS3BucketDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSS3BucketWebsiteConfigWithRedirect,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
+					testAccCheckAWSS3BucketWebsite(
+						"aws_s3_bucket.bucket", "", "", "hashicorp.com"),
+					resource.TestCheckResourceAttr(
+						"aws_s3_bucket.bucket", "website_endpoint", testAccWebsiteEndpoint),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSS3BucketConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSS3BucketExists("aws_s3_bucket.bucket"),
+					testAccCheckAWSS3BucketWebsite(
+						"aws_s3_bucket.bucket", "", "", ""),
 					resource.TestCheckResourceAttr(
 						"aws_s3_bucket.bucket", "website_endpoint", ""),
 				),
@@ -115,7 +174,47 @@ func testAccCheckAWSS3BucketExists(n string) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckAWSS3BucketWebsite(n string, indexDoc string, errorDoc string) resource.TestCheckFunc {
+func testAccCheckAWSS3BucketPolicy(n string, policy string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, _ := s.RootModule().Resources[n]
+		conn := testAccProvider.Meta().(*AWSClient).s3conn
+
+		out, err := conn.GetBucketPolicy(&s3.GetBucketPolicyInput{
+			Bucket: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			if policy == "" {
+				// expected
+				return nil
+			} else {
+				return fmt.Errorf("GetBucketPolicy error: %v, expected %s", err, policy)
+			}
+		}
+
+		if v := out.Policy; v == nil {
+			if policy != "" {
+				return fmt.Errorf("bad policy, found nil, expected: %s", policy)
+			}
+		} else {
+			expected := make(map[string]interface{})
+			if err := json.Unmarshal([]byte(policy), &expected); err != nil {
+				return err
+			}
+			actual := make(map[string]interface{})
+			if err := json.Unmarshal([]byte(*v), &actual); err != nil {
+				return err
+			}
+
+			if !reflect.DeepEqual(expected, actual) {
+				return fmt.Errorf("bad policy, expected: %#v, got %#v", expected, actual)
+			}
+		}
+
+		return nil
+	}
+}
+func testAccCheckAWSS3BucketWebsite(n string, indexDoc string, errorDoc string, redirectTo string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, _ := s.RootModule().Resources[n]
 		conn := testAccProvider.Meta().(*AWSClient).s3conn
@@ -134,11 +233,14 @@ func testAccCheckAWSS3BucketWebsite(n string, indexDoc string, errorDoc string)
 			}
 		}
 
-		if *out.IndexDocument.Suffix != indexDoc {
-			if out.IndexDocument.Suffix != nil {
-				return fmt.Errorf("bad index document suffix: %s", *out.IndexDocument.Suffix)
+		if v := out.IndexDocument; v == nil {
+			if indexDoc != "" {
+				return fmt.Errorf("bad index doc, found nil, expected: %s", indexDoc)
+			}
+		} else {
+			if *v.Suffix != indexDoc {
+				return fmt.Errorf("bad index doc, expected: %s, got %#v", indexDoc, out.IndexDocument)
 			}
-			return fmt.Errorf("bad index document suffix, is nil")
 		}
 
 		if v := out.ErrorDocument; v == nil {
@@ -151,6 +253,16 @@ func testAccCheckAWSS3BucketWebsite(n string, indexDoc string, errorDoc string)
 			}
 		}
 
+		if v := out.RedirectAllRequestsTo; v == nil {
+			if redirectTo != "" {
+				return fmt.Errorf("bad redirect to, found nil, expected: %s", redirectTo)
+			}
+		} else {
+			if *v.HostName != redirectTo {
+				return fmt.Errorf("bad redirect to, expected: %s, got %#v", redirectTo, out.RedirectAllRequestsTo)
+			}
+		}
+
 		return nil
 	}
 }
@@ -159,6 +271,8 @@ func testAccCheckAWSS3BucketWebsite(n string, indexDoc string, errorDoc string)
 // within AWS
 var randInt = rand.New(rand.NewSource(time.Now().UnixNano())).Int()
 var testAccWebsiteEndpoint = fmt.Sprintf("tf-test-bucket-%d.s3-website-us-west-2.amazonaws.com", randInt)
+var testAccAWSS3BucketPolicy = fmt.Sprintf(`{ "Version": "2008-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::tf-test-bucket-%d/*" } ] }`, randInt)
+
 var testAccAWSS3BucketConfig = fmt.Sprintf(`
 resource "aws_s3_bucket" "bucket" {
 	bucket = "tf-test-bucket-%d"
@@ -188,3 +302,22 @@ resource "aws_s3_bucket" "bucket" {
 	}
 }
 `, randInt)
+
+var testAccAWSS3BucketWebsiteConfigWithRedirect = fmt.Sprintf(`
+resource "aws_s3_bucket" "bucket" {
+	bucket = "tf-test-bucket-%d"
+	acl = "public-read"
+
+	website {
+		redirect_all_requests_to = "hashicorp.com"
+	}
+}
+`, randInt)
+
+var testAccAWSS3BucketConfigWithPolicy = fmt.Sprintf(`
+resource "aws_s3_bucket" "bucket" {
+	bucket = "tf-test-bucket-%d"
+	acl = "public-read"
+	policy = %s
+}
+`, randInt, strconv.Quote(testAccAWSS3BucketPolicy))
diff --git a/builtin/providers/aws/resource_aws_security_group.go b/builtin/providers/aws/resource_aws_security_group.go
index 703f8b560..b418a1759 100644
--- a/builtin/providers/aws/resource_aws_security_group.go
+++ b/builtin/providers/aws/resource_aws_security_group.go
@@ -7,8 +7,9 @@ import (
 	"sort"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -27,6 +28,14 @@ func resourceAwsSecurityGroup() *schema.Resource {
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"description": &schema.Schema{
@@ -34,6 +43,14 @@ func resourceAwsSecurityGroup() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 				Default:  "Managed by Terraform",
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"vpc_id": &schema.Schema{
@@ -166,6 +183,7 @@ func resourceAwsSecurityGroupCreate(d *schema.ResourceData, meta interface{}) er
 	}
 	securityGroupOpts.GroupName = aws.String(groupName)
 
+	var err error
 	log.Printf(
 		"[DEBUG] Security Group create configuration: %#v", securityGroupOpts)
 	createResp, err := conn.CreateSecurityGroup(securityGroupOpts)
@@ -251,7 +269,7 @@ func resourceAwsSecurityGroupRead(d *schema.ResourceData, meta interface{}) erro
 	d.Set("owner_id", sg.OwnerID)
 	d.Set("ingress", ingressRules)
 	d.Set("egress", egressRules)
-	d.Set("tags", tagsToMapSDK(sg.Tags))
+	d.Set("tags", tagsToMap(sg.Tags))
 	return nil
 }
 
@@ -281,7 +299,7 @@ func resourceAwsSecurityGroupUpdate(d *schema.ResourceData, meta interface{}) er
 		}
 	}
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -300,12 +318,12 @@ func resourceAwsSecurityGroupDelete(d *schema.ResourceData, meta interface{}) er
 			GroupID: aws.String(d.Id()),
 		})
 		if err != nil {
-			ec2err, ok := err.(aws.APIError)
+			ec2err, ok := err.(awserr.Error)
 			if !ok {
 				return err
 			}
 
-			switch ec2err.Code {
+			switch ec2err.Code() {
 			case "InvalidGroup.NotFound":
 				return nil
 			case "DependencyViolation":
@@ -530,9 +548,9 @@ func SGStateRefreshFunc(conn *ec2.EC2, id string) resource.StateRefreshFunc {
 		}
 		resp, err := conn.DescribeSecurityGroups(req)
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok {
-				if ec2err.Code == "InvalidSecurityGroupID.NotFound" ||
-					ec2err.Code == "InvalidGroup.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok {
+				if ec2err.Code() == "InvalidSecurityGroupID.NotFound" ||
+					ec2err.Code() == "InvalidGroup.NotFound" {
 					resp = nil
 					err = nil
 				}
diff --git a/builtin/providers/aws/resource_aws_security_group_rule.go b/builtin/providers/aws/resource_aws_security_group_rule.go
index b5fb3058f..927030b70 100644
--- a/builtin/providers/aws/resource_aws_security_group_rule.go
+++ b/builtin/providers/aws/resource_aws_security_group_rule.go
@@ -7,8 +7,10 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -19,6 +21,9 @@ func resourceAwsSecurityGroupRule() *schema.Resource {
 		Read:   resourceAwsSecurityGroupRuleRead,
 		Delete: resourceAwsSecurityGroupRuleDelete,
 
+		SchemaVersion: 1,
+		MigrateState:  resourceAwsSecurityGroupRuleMigrateState,
+
 		Schema: map[string]*schema.Schema{
 			"type": &schema.Schema{
 				Type:        schema.TypeString,
@@ -59,10 +64,11 @@ func resourceAwsSecurityGroupRule() *schema.Resource {
 			},
 
 			"source_security_group_id": &schema.Schema{
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Computed: true,
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				Computed:      true,
+				ConflictsWith: []string{"cidr_blocks"},
 			},
 
 			"self": &schema.Schema{
@@ -81,17 +87,18 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 	sg, err := findResourceSecurityGroup(conn, sg_id)
 
 	if err != nil {
-		return fmt.Errorf("sorry")
+		return err
 	}
 
 	perm := expandIPPerm(d, sg)
 
 	ruleType := d.Get("type").(string)
 
+	var autherr error
 	switch ruleType {
 	case "ingress":
-		log.Printf("[DEBUG] Authorizing security group %s %s rule: %#v",
-			sg_id, "Ingress", perm)
+		log.Printf("[DEBUG] Authorizing security group %s %s rule: %s",
+			sg_id, "Ingress", awsutil.StringValue(perm))
 
 		req := &ec2.AuthorizeSecurityGroupIngressInput{
 			GroupID:       sg.GroupID,
@@ -103,13 +110,7 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 			req.GroupName = sg.GroupName
 		}
 
-		_, err := conn.AuthorizeSecurityGroupIngress(req)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error authorizing security group %s rules: %s",
-				"rules", err)
-		}
+		_, autherr = conn.AuthorizeSecurityGroupIngress(req)
 
 	case "egress":
 		log.Printf("[DEBUG] Authorizing security group %s %s rule: %#v",
@@ -120,18 +121,28 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 			IPPermissions: []*ec2.IPPermission{perm},
 		}
 
-		_, err = conn.AuthorizeSecurityGroupEgress(req)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error authorizing security group %s rules: %s",
-				"rules", err)
-		}
+		_, autherr = conn.AuthorizeSecurityGroupEgress(req)
 
 	default:
 		return fmt.Errorf("Security Group Rule must be type 'ingress' or type 'egress'")
 	}
 
+	if autherr != nil {
+		if awsErr, ok := autherr.(awserr.Error); ok {
+			if awsErr.Code() == "InvalidPermission.Duplicate" {
+				return fmt.Errorf(`[WARN] A duplicate Security Group rule was found. This may be
+a side effect of a now-fixed Terraform issue causing two security groups with
+identical attributes but different source_security_group_ids to overwrite each
+other in the state. See https://github.com/hashicorp/terraform/pull/2376 for more
+information and instructions for recovery. Error message: %s`, awsErr.Message())
+			}
+		}
+
+		return fmt.Errorf(
+			"Error authorizing security group rule type %s: %s",
+			ruleType, autherr)
+	}
+
 	d.SetId(ipPermissionIDHash(ruleType, perm))
 
 	return resourceAwsSecurityGroupRuleRead(d, meta)
@@ -194,15 +205,15 @@ func resourceAwsSecurityGroupRuleDelete(d *schema.ResourceData, meta interface{}
 	sg, err := findResourceSecurityGroup(conn, sg_id)
 
 	if err != nil {
-		return fmt.Errorf("sorry")
+		return err
 	}
 
 	perm := expandIPPerm(d, sg)
 	ruleType := d.Get("type").(string)
 	switch ruleType {
 	case "ingress":
-		log.Printf("[DEBUG] Revoking security group %#v %s rule: %#v",
-			sg_id, "ingress", perm)
+		log.Printf("[DEBUG] Revoking rule (%s) from security group %s:\n%s",
+			"ingress", sg_id, awsutil.StringValue(perm))
 		req := &ec2.RevokeSecurityGroupIngressInput{
 			GroupID:       sg.GroupID,
 			IPPermissions: []*ec2.IPPermission{perm},
@@ -244,32 +255,43 @@ func findResourceSecurityGroup(conn *ec2.EC2, id string) (*ec2.SecurityGroup, er
 	}
 	resp, err := conn.DescribeSecurityGroups(req)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok {
-			if ec2err.Code == "InvalidSecurityGroupID.NotFound" ||
-				ec2err.Code == "InvalidGroup.NotFound" {
-				resp = nil
-				err = nil
-			}
-		}
-
-		if err != nil {
-			log.Printf("Error on findResourceSecurityGroup: %s", err)
-			return nil, err
-		}
+		return nil, err
+	}
+	if resp == nil || len(resp.SecurityGroups) != 1 || resp.SecurityGroups[0] == nil {
+		return nil, fmt.Errorf(
+			"Expected to find one security group with ID %q, got: %#v",
+			id, resp.SecurityGroups)
 	}
 
 	return resp.SecurityGroups[0], nil
 }
 
+// ByGroupPair implements sort.Interface for []*ec2.UserIDGroupPairs based on
+// GroupID or GroupName field (only one should be set).
+type ByGroupPair []*ec2.UserIDGroupPair
+
+func (b ByGroupPair) Len() int      { return len(b) }
+func (b ByGroupPair) Swap(i, j int) { b[i], b[j] = b[j], b[i] }
+func (b ByGroupPair) Less(i, j int) bool {
+	if b[i].GroupID != nil && b[j].GroupID != nil {
+		return *b[i].GroupID < *b[j].GroupID
+	}
+	if b[i].GroupName != nil && b[j].GroupName != nil {
+		return *b[i].GroupName < *b[j].GroupName
+	}
+
+	panic("mismatched security group rules, may be a terraform bug")
+}
+
 func ipPermissionIDHash(ruleType string, ip *ec2.IPPermission) string {
 	var buf bytes.Buffer
-	// for egress rules, an TCP rule of -1 is automatically added, in which case
-	// the to and from ports will be nil. We don't record this rule locally.
-	if ip.IPProtocol != nil && *ip.IPProtocol != "-1" {
+	if ip.FromPort != nil && *ip.FromPort > 0 {
 		buf.WriteString(fmt.Sprintf("%d-", *ip.FromPort))
-		buf.WriteString(fmt.Sprintf("%d-", *ip.ToPort))
-		buf.WriteString(fmt.Sprintf("%s-", *ip.IPProtocol))
 	}
+	if ip.ToPort != nil && *ip.ToPort > 0 {
+		buf.WriteString(fmt.Sprintf("%d-", *ip.ToPort))
+	}
+	buf.WriteString(fmt.Sprintf("%s-", *ip.IPProtocol))
 	buf.WriteString(fmt.Sprintf("%s-", ruleType))
 
 	// We need to make sure to sort the strings below so that we always
@@ -286,6 +308,22 @@ func ipPermissionIDHash(ruleType string, ip *ec2.IPPermission) string {
 		}
 	}
 
+	if len(ip.UserIDGroupPairs) > 0 {
+		sort.Sort(ByGroupPair(ip.UserIDGroupPairs))
+		for _, pair := range ip.UserIDGroupPairs {
+			if pair.GroupID != nil {
+				buf.WriteString(fmt.Sprintf("%s-", *pair.GroupID))
+			} else {
+				buf.WriteString("-")
+			}
+			if pair.GroupName != nil {
+				buf.WriteString(fmt.Sprintf("%s-", *pair.GroupName))
+			} else {
+				buf.WriteString("-")
+			}
+		}
+	}
+
 	return fmt.Sprintf("sg-%d", hashcode.String(buf.String()))
 }
 
@@ -296,22 +334,29 @@ func expandIPPerm(d *schema.ResourceData, sg *ec2.SecurityGroup) *ec2.IPPermissi
 	perm.ToPort = aws.Long(int64(d.Get("to_port").(int)))
 	perm.IPProtocol = aws.String(d.Get("protocol").(string))
 
-	var groups []string
+	// build a group map that behaves like a set
+	groups := make(map[string]bool)
 	if raw, ok := d.GetOk("source_security_group_id"); ok {
-		groups = append(groups, raw.(string))
+		groups[raw.(string)] = true
 	}
 
 	if v, ok := d.GetOk("self"); ok && v.(bool) {
 		if sg.VPCID != nil && *sg.VPCID != "" {
-			groups = append(groups, *sg.GroupID)
+			groups[*sg.GroupID] = true
 		} else {
-			groups = append(groups, *sg.GroupName)
+			groups[*sg.GroupName] = true
 		}
 	}
 
 	if len(groups) > 0 {
 		perm.UserIDGroupPairs = make([]*ec2.UserIDGroupPair, len(groups))
-		for i, name := range groups {
+		// build string list of group name/ids
+		var gl []string
+		for k, _ := range groups {
+			gl = append(gl, k)
+		}
+
+		for i, name := range gl {
 			ownerId, id := "", name
 			if items := strings.Split(id, "/"); len(items) > 1 {
 				ownerId, id = items[0], items[1]
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_migrate.go b/builtin/providers/aws/resource_aws_security_group_rule_migrate.go
new file mode 100644
index 000000000..30eb8c09f
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_security_group_rule_migrate.go
@@ -0,0 +1,101 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func resourceAwsSecurityGroupRuleMigrateState(
+	v int, is *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+	switch v {
+	case 0:
+		log.Println("[INFO] Found AWS Security Group State v0; migrating to v1")
+		return migrateSGRuleStateV0toV1(is)
+	default:
+		return is, fmt.Errorf("Unexpected schema version: %d", v)
+	}
+
+	return is, nil
+}
+
+func migrateSGRuleStateV0toV1(is *terraform.InstanceState) (*terraform.InstanceState, error) {
+	if is.Empty() {
+		log.Println("[DEBUG] Empty InstanceState; nothing to migrate.")
+		return is, nil
+	}
+
+	perm, err := migrateExpandIPPerm(is.Attributes)
+
+	if err != nil {
+		return nil, fmt.Errorf("[WARN] Error making new IP Permission in Security Group migration")
+	}
+
+	log.Printf("[DEBUG] Attributes before migration: %#v", is.Attributes)
+	newID := ipPermissionIDHash(is.Attributes["type"], perm)
+	is.Attributes["id"] = newID
+	is.ID = newID
+	log.Printf("[DEBUG] Attributes after migration: %#v, new id: %s", is.Attributes, newID)
+	return is, nil
+}
+
+func migrateExpandIPPerm(attrs map[string]string) (*ec2.IPPermission, error) {
+	var perm ec2.IPPermission
+	tp, err := strconv.Atoi(attrs["to_port"])
+	if err != nil {
+		return nil, fmt.Errorf("Error converting to_port in Security Group migration")
+	}
+
+	fp, err := strconv.Atoi(attrs["from_port"])
+	if err != nil {
+		return nil, fmt.Errorf("Error converting from_port in Security Group migration")
+	}
+
+	perm.ToPort = aws.Long(int64(tp))
+	perm.FromPort = aws.Long(int64(fp))
+	perm.IPProtocol = aws.String(attrs["protocol"])
+
+	groups := make(map[string]bool)
+	if attrs["self"] == "true" {
+		groups[attrs["security_group_id"]] = true
+	}
+
+	if attrs["source_security_group_id"] != "" {
+		groups[attrs["source_security_group_id"]] = true
+	}
+
+	if len(groups) > 0 {
+		perm.UserIDGroupPairs = make([]*ec2.UserIDGroupPair, len(groups))
+		// build string list of group name/ids
+		var gl []string
+		for k, _ := range groups {
+			gl = append(gl, k)
+		}
+
+		for i, name := range gl {
+			perm.UserIDGroupPairs[i] = &ec2.UserIDGroupPair{
+				GroupID: aws.String(name),
+			}
+		}
+	}
+
+	var cb []string
+	for k, v := range attrs {
+		if k != "cidr_blocks.#" && strings.HasPrefix(k, "cidr_blocks") {
+			cb = append(cb, v)
+		}
+	}
+	if len(cb) > 0 {
+		perm.IPRanges = make([]*ec2.IPRange, len(cb))
+		for i, v := range cb {
+			perm.IPRanges[i] = &ec2.IPRange{CIDRIP: aws.String(v)}
+		}
+	}
+
+	return &perm, nil
+}
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go b/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go
new file mode 100644
index 000000000..664f05039
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go
@@ -0,0 +1,67 @@
+package aws
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAWSSecurityGroupRuleMigrateState(t *testing.T) {
+	cases := map[string]struct {
+		StateVersion int
+		ID           string
+		Attributes   map[string]string
+		Expected     string
+		Meta         interface{}
+	}{
+		"v0_1": {
+			StateVersion: 0,
+			ID:           "sg-4235098228",
+			Attributes: map[string]string{
+				"self":                     "false",
+				"to_port":                  "0",
+				"security_group_id":        "sg-13877277",
+				"cidr_blocks.#":            "0",
+				"type":                     "ingress",
+				"protocol":                 "-1",
+				"from_port":                "0",
+				"source_security_group_id": "sg-11877275",
+			},
+			Expected: "sg-3766347571",
+		},
+		"v0_2": {
+			StateVersion: 0,
+			ID:           "sg-1021609891",
+			Attributes: map[string]string{
+				"security_group_id": "sg-0981746d",
+				"from_port":         "0",
+				"to_port":           "0",
+				"type":              "ingress",
+				"self":              "false",
+				"protocol":          "-1",
+				"cidr_blocks.0":     "172.16.1.0/24",
+				"cidr_blocks.1":     "172.16.2.0/24",
+				"cidr_blocks.2":     "172.16.3.0/24",
+				"cidr_blocks.3":     "172.16.4.0/24",
+				"cidr_blocks.#":     "4"},
+			Expected: "sg-4100229787",
+		},
+	}
+
+	for tn, tc := range cases {
+		is := &terraform.InstanceState{
+			ID:         tc.ID,
+			Attributes: tc.Attributes,
+		}
+		is, err := resourceAwsSecurityGroupRuleMigrateState(
+			tc.StateVersion, is, tc.Meta)
+
+		if err != nil {
+			t.Fatalf("bad: %s, err: %#v", tn, err)
+		}
+
+		if is.ID != tc.Expected {
+			t.Fatalf("bad sg rule id: %s\n\n expected: %s", is.ID, tc.Expected)
+		}
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_test.go b/builtin/providers/aws/resource_aws_security_group_rule_test.go
index ff75b4431..595886e18 100644
--- a/builtin/providers/aws/resource_aws_security_group_rule_test.go
+++ b/builtin/providers/aws/resource_aws_security_group_rule_test.go
@@ -5,8 +5,10 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -43,6 +45,46 @@ func TestIpPermissionIDHash(t *testing.T) {
 		},
 	}
 
+	vpc_security_group_source := &ec2.IPPermission{
+		IPProtocol: aws.String("tcp"),
+		FromPort:   aws.Long(int64(80)),
+		ToPort:     aws.Long(int64(8000)),
+		UserIDGroupPairs: []*ec2.UserIDGroupPair{
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("987654321"),
+				GroupID: aws.String("sg-12345678"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("123456789"),
+				GroupID: aws.String("sg-987654321"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("123456789"),
+				GroupID: aws.String("sg-12345678"),
+			},
+		},
+	}
+
+	security_group_source := &ec2.IPPermission{
+		IPProtocol: aws.String("tcp"),
+		FromPort:   aws.Long(int64(80)),
+		ToPort:     aws.Long(int64(8000)),
+		UserIDGroupPairs: []*ec2.UserIDGroupPair{
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("987654321"),
+				GroupName: aws.String("my-security-group"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("123456789"),
+				GroupName: aws.String("my-security-group"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("123456789"),
+				GroupName: aws.String("my-other-security-group"),
+			},
+		},
+	}
+
 	// hardcoded hashes, to detect future change
 	cases := []struct {
 		Input  *ec2.IPPermission
@@ -51,13 +93,15 @@ func TestIpPermissionIDHash(t *testing.T) {
 	}{
 		{simple, "ingress", "sg-82613597"},
 		{egress, "egress", "sg-363054720"},
-		{egress_all, "egress", "sg-857124156"},
+		{egress_all, "egress", "sg-2766285362"},
+		{vpc_security_group_source, "egress", "sg-2661404947"},
+		{security_group_source, "egress", "sg-1841245863"},
 	}
 
 	for _, tc := range cases {
 		actual := ipPermissionIDHash(tc.Type, tc.Input)
 		if actual != tc.Output {
-			t.Fatalf("input: %s - %#v\noutput: %s", tc.Type, tc.Input, actual)
+			t.Errorf("input: %s - %s\noutput: %s", tc.Type, awsutil.StringValue(tc.Input), actual)
 		}
 	}
 }
@@ -140,9 +184,9 @@ func TestAccAWSSecurityGroupRule_MultiIngress(t *testing.T) {
 	var group ec2.SecurityGroup
 
 	testMultiRuleCount := func(*terraform.State) error {
-		if len(group.IPPermissions) != 3 {
+		if len(group.IPPermissions) != 2 {
 			return fmt.Errorf("Wrong Security Group rule count, expected %d, got %d",
-				3, len(group.IPPermissions))
+				2, len(group.IPPermissions))
 		}
 
 		var rule *ec2.IPPermission
@@ -195,6 +239,24 @@ func TestAccAWSSecurityGroupRule_Egress(t *testing.T) {
 	})
 }
 
+func TestAccAWSSecurityGroupRule_SelfReference(t *testing.T) {
+	var group ec2.SecurityGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSecurityGroupRuleConfigSelfReference,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSSecurityGroupRuleDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ec2conn
 
@@ -216,12 +278,12 @@ func testAccCheckAWSSecurityGroupRuleDestroy(s *terraform.State) error {
 			return nil
 		}
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 		// Confirm error code is what we want
-		if ec2err.Code != "InvalidGroup.NotFound" {
+		if ec2err.Code() != "InvalidGroup.NotFound" {
 			return err
 		}
 	}
@@ -376,7 +438,6 @@ resource "aws_security_group_rule" "ingress_1" {
   cidr_blocks = ["10.0.0.0/8"]
 
   security_group_id = "${aws_security_group.web.id}"
-        source_security_group_id = "${aws_security_group.worker.id}"
 }
 
 resource "aws_security_group_rule" "ingress_2" {
@@ -389,3 +450,34 @@ resource "aws_security_group_rule" "ingress_2" {
   security_group_id = "${aws_security_group.web.id}"
 }
 `
+
+// check for GH-1985 regression
+const testAccAWSSecurityGroupRuleConfigSelfReference = `
+provider "aws" {
+  region = "us-west-2"
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+  tags {
+    Name = "sg-self-test"
+  }
+}
+
+resource "aws_security_group" "web" {
+  name = "main"
+  vpc_id = "${aws_vpc.main.id}"
+  tags {
+    Name = "sg-self-test"
+  }
+}
+
+resource "aws_security_group_rule" "self" {
+  type = "ingress"
+  protocol = "-1"
+  from_port = 0
+  to_port = 0
+  self = true
+  security_group_id = "${aws_security_group.web.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_security_group_test.go b/builtin/providers/aws/resource_aws_security_group_test.go
index 35f0d55da..d3a55da5a 100644
--- a/builtin/providers/aws/resource_aws_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_security_group_test.go
@@ -6,13 +6,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSSecurityGroup_normal(t *testing.T) {
+func TestAccAWSSecurityGroup_basic(t *testing.T) {
 	var group ec2.SecurityGroup
 
 	resource.Test(t, resource.TestCase{
@@ -310,12 +311,12 @@ func testAccCheckAWSSecurityGroupDestroy(s *terraform.State) error {
 			return nil
 		}
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 		// Confirm error code is what we want
-		if ec2err.Code != "InvalidGroup.NotFound" {
+		if ec2err.Code() != "InvalidGroup.NotFound" {
 			return err
 		}
 	}
@@ -428,7 +429,7 @@ func TestAccAWSSecurityGroup_tags(t *testing.T) {
 				Config: testAccAWSSecurityGroupConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSecurityGroupExists("aws_security_group.foo", &group),
-					testAccCheckTagsSDK(&group.Tags, "foo", "bar"),
+					testAccCheckTags(&group.Tags, "foo", "bar"),
 				),
 			},
 
@@ -436,8 +437,8 @@ func TestAccAWSSecurityGroup_tags(t *testing.T) {
 				Config: testAccAWSSecurityGroupConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSecurityGroupExists("aws_security_group.foo", &group),
-					testAccCheckTagsSDK(&group.Tags, "foo", ""),
-					testAccCheckTagsSDK(&group.Tags, "bar", "baz"),
+					testAccCheckTags(&group.Tags, "foo", ""),
+					testAccCheckTags(&group.Tags, "bar", "baz"),
 				),
 			},
 		},
diff --git a/builtin/providers/aws/resource_aws_sns_topic.go b/builtin/providers/aws/resource_aws_sns_topic.go
new file mode 100644
index 000000000..33be03058
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic.go
@@ -0,0 +1,152 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sns"
+)
+
+// Mutable attributes
+var SNSAttributeMap = map[string]string{
+	"display_name":    "DisplayName",
+	"policy":          "Policy",
+	"delivery_policy": "DeliveryPolicy",
+}
+
+func resourceAwsSnsTopic() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSnsTopicCreate,
+		Read:   resourceAwsSnsTopicRead,
+		Update: resourceAwsSnsTopicUpdate,
+		Delete: resourceAwsSnsTopicDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"display_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+				Computed: true,
+			},
+			"delivery_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSnsTopicCreate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	name := d.Get("name").(string)
+
+	log.Printf("[DEBUG] SNS create topic: %s", name)
+
+	req := &sns.CreateTopicInput{
+		Name: aws.String(name),
+	}
+
+	output, err := snsconn.CreateTopic(req)
+	if err != nil {
+		return fmt.Errorf("Error creating SNS topic: %s", err)
+	}
+
+	d.SetId(*output.TopicARN)
+
+	// Write the ARN to the 'arn' field for export
+	d.Set("arn", *output.TopicARN)
+
+	return resourceAwsSnsTopicUpdate(d, meta)
+}
+
+func resourceAwsSnsTopicUpdate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	resource := *resourceAwsSnsTopic()
+
+	for k, _ := range resource.Schema {
+		if attrKey, ok := SNSAttributeMap[k]; ok {
+			if d.HasChange(k) {
+				log.Printf("[DEBUG] Updating %s", attrKey)
+				_, n := d.GetChange(k)
+				// Ignore an empty policy
+				if !(k == "policy" && n == "") {
+					// Make API call to update attributes
+					req := &sns.SetTopicAttributesInput{
+						TopicARN:       aws.String(d.Id()),
+						AttributeName:  aws.String(attrKey),
+						AttributeValue: aws.String(n.(string)),
+					}
+					snsconn.SetTopicAttributes(req)
+				}
+			}
+		}
+	}
+
+	return resourceAwsSnsTopicRead(d, meta)
+}
+
+func resourceAwsSnsTopicRead(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	attributeOutput, err := snsconn.GetTopicAttributes(&sns.GetTopicAttributesInput{
+		TopicARN: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrmap := attributeOutput.Attributes
+		resource := *resourceAwsSnsTopic()
+		// iKey = internal struct key, oKey = AWS Attribute Map key
+		for iKey, oKey := range SNSAttributeMap {
+			log.Printf("[DEBUG] Updating %s => %s", iKey, oKey)
+
+			if attrmap[oKey] != nil {
+				// Some of the fetched attributes are stateful properties such as
+				// the number of subscriptions, the owner, etc. skip those
+				if resource.Schema[iKey] != nil {
+					value := *attrmap[oKey]
+					log.Printf("[DEBUG] Updating %s => %s -> %s", iKey, oKey, value)
+					d.Set(iKey, *attrmap[oKey])
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func resourceAwsSnsTopicDelete(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] SNS Delete Topic: %s", d.Id())
+	_, err := snsconn.DeleteTopic(&sns.DeleteTopicInput{
+		TopicARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_sns_topic_subscription.go b/builtin/providers/aws/resource_aws_sns_topic_subscription.go
new file mode 100644
index 000000000..01926e895
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_subscription.go
@@ -0,0 +1,180 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sns"
+)
+
+func resourceAwsSnsTopicSubscription() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSnsTopicSubscriptionCreate,
+		Read:   resourceAwsSnsTopicSubscriptionRead,
+		Update: resourceAwsSnsTopicSubscriptionUpdate,
+		Delete: resourceAwsSnsTopicSubscriptionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"protocol": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"endpoint": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"topic_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"delivery_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"raw_message_delivery": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: false,
+				Default:  false,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSnsTopicSubscriptionCreate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	if d.Get("protocol") == "email" {
+		return fmt.Errorf("Email endpoints are not supported!")
+	}
+
+	output, err := subscribeToSNSTopic(d, snsconn)
+
+	if err != nil {
+		return err
+	}
+
+	log.Printf("New subscription ARN: %s", *output.SubscriptionARN)
+	d.SetId(*output.SubscriptionARN)
+
+	// Write the ARN to the 'arn' field for export
+	d.Set("arn", *output.SubscriptionARN)
+
+	return resourceAwsSnsTopicSubscriptionUpdate(d, meta)
+}
+
+func resourceAwsSnsTopicSubscriptionUpdate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	// If any changes happened, un-subscribe and re-subscribe
+	if d.HasChange("protocol") || d.HasChange("endpoint") || d.HasChange("topic_arn") {
+		log.Printf("[DEBUG] Updating subscription %s", d.Id())
+		// Unsubscribe
+		_, err := snsconn.Unsubscribe(&sns.UnsubscribeInput{
+			SubscriptionARN: aws.String(d.Id()),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error unsubscribing from SNS topic: %s", err)
+		}
+
+		// Re-subscribe and set id
+		output, err := subscribeToSNSTopic(d, snsconn)
+		d.SetId(*output.SubscriptionARN)
+
+	}
+
+	if d.HasChange("raw_message_delivery") {
+		_, n := d.GetChange("raw_message_delivery")
+
+		attrValue := "false"
+
+		if n.(bool) {
+			attrValue = "true"
+		}
+
+		req := &sns.SetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(d.Id()),
+			AttributeName:   aws.String("RawMessageDelivery"),
+			AttributeValue:  aws.String(attrValue),
+		}
+		_, err := snsconn.SetSubscriptionAttributes(req)
+
+		if err != nil {
+			return fmt.Errorf("Unable to set raw message delivery attribute on subscription")
+		}
+	}
+
+	return resourceAwsSnsTopicSubscriptionRead(d, meta)
+}
+
+func resourceAwsSnsTopicSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] Loading subscription %s", d.Id())
+
+	attributeOutput, err := snsconn.GetSubscriptionAttributes(&sns.GetSubscriptionAttributesInput{
+		SubscriptionARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrHash := attributeOutput.Attributes
+		log.Printf("[DEBUG] raw message delivery: %s", *attrHash["RawMessageDelivery"])
+		if *attrHash["RawMessageDelivery"] == "true" {
+			d.Set("raw_message_delivery", true)
+		} else {
+			d.Set("raw_message_delivery", false)
+		}
+	}
+
+	return nil
+}
+
+func resourceAwsSnsTopicSubscriptionDelete(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] SNS delete topic subscription: %s", d.Id())
+	_, err := snsconn.Unsubscribe(&sns.UnsubscribeInput{
+		SubscriptionARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func subscribeToSNSTopic(d *schema.ResourceData, snsconn *sns.SNS) (output *sns.SubscribeOutput, err error) {
+	protocol := d.Get("protocol").(string)
+	endpoint := d.Get("endpoint").(string)
+	topic_arn := d.Get("topic_arn").(string)
+
+	log.Printf("[DEBUG] SNS create topic subscription: %s (%s) @ '%s'", endpoint, protocol, topic_arn)
+
+	req := &sns.SubscribeInput{
+		Protocol: aws.String(protocol),
+		Endpoint: aws.String(endpoint),
+		TopicARN: aws.String(topic_arn),
+	}
+
+	output, err = snsconn.Subscribe(req)
+	if err != nil {
+		return nil, fmt.Errorf("Error creating SNS topic: %s", err)
+	}
+
+	log.Printf("[DEBUG] Created new subscription!")
+	return output, nil
+}
diff --git a/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go b/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go
new file mode 100644
index 000000000..fce5485fe
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go
@@ -0,0 +1,100 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSNSTopicSubscription_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSNSTopicSubscriptionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSNSTopicSubscriptionConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSNSTopicExists("aws_sns_topic.test_topic"),
+					testAccCheckAWSSNSTopicSubscriptionExists("aws_sns_topic_subscription.test_subscription"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSNSTopicSubscriptionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sns_topic" {
+			continue
+		}
+
+		// Try to find key pair
+		req := &sns.GetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(rs.Primary.ID),
+		}
+
+		_, err := conn.GetSubscriptionAttributes(req)
+
+		if err == nil {
+			return fmt.Errorf("Subscription still exists, can't continue.")
+		}
+
+		// Verify the error is an API error, not something else
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSNSTopicSubscriptionExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS subscription with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+		params := &sns.GetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetSubscriptionAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSSNSTopicSubscriptionConfig = `
+resource "aws_sns_topic" "test_topic" {
+    name = "terraform-test-topic"
+}
+
+resource "aws_sqs_queue" "test_queue" {
+	name = "terraform-subscription-test-queue"
+}
+
+resource "aws_sns_topic_subscription" "test_subscription" {
+    topic_arn = "${aws_sns_topic.test_topic.arn}"
+    protocol = "sqs"
+    endpoint = "${aws_sqs_queue.test_queue.arn}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_sns_topic_test.go b/builtin/providers/aws/resource_aws_sns_topic_test.go
new file mode 100644
index 000000000..3cbe324f3
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_test.go
@@ -0,0 +1,87 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSNSTopic_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSNSTopicDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSNSTopicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSNSTopicExists("aws_sns_topic.test_topic"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSNSTopicDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sns_topic" {
+			continue
+		}
+
+		// Check if the topic exists by fetching its attributes
+		params := &sns.GetTopicAttributesInput{
+			TopicARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetTopicAttributes(params)
+		if err == nil {
+			return fmt.Errorf("Topic exists when it should be destroyed!")
+		}
+
+		// Verify the error is an API error, not something else
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSNSTopicExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS topic with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+		params := &sns.GetTopicAttributesInput{
+			TopicARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetTopicAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSSNSTopicConfig = `
+resource "aws_sns_topic" "test_topic" {
+    name = "terraform-test-topic"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_spot_instance_request.go b/builtin/providers/aws/resource_aws_spot_instance_request.go
new file mode 100644
index 000000000..464a3de0c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_spot_instance_request.go
@@ -0,0 +1,245 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsSpotInstanceRequest() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSpotInstanceRequestCreate,
+		Read:   resourceAwsSpotInstanceRequestRead,
+		Delete: resourceAwsSpotInstanceRequestDelete,
+		Update: resourceAwsSpotInstanceRequestUpdate,
+
+		Schema: func() map[string]*schema.Schema {
+			// The Spot Instance Request Schema is based on the AWS Instance schema.
+			s := resourceAwsInstance().Schema
+
+			// Everything on a spot instance is ForceNew except tags
+			for k, v := range s {
+				if k == "tags" {
+					continue
+				}
+				v.ForceNew = true
+			}
+
+			s["spot_price"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			}
+			s["wait_for_fulfillment"] = &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			}
+			s["spot_bid_status"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+			s["spot_request_state"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+			s["spot_instance_id"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+
+			return s
+		}(),
+	}
+}
+
+func resourceAwsSpotInstanceRequestCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	instanceOpts, err := buildAwsInstanceOpts(d, meta)
+	if err != nil {
+		return err
+	}
+
+	spotOpts := &ec2.RequestSpotInstancesInput{
+		SpotPrice: aws.String(d.Get("spot_price").(string)),
+
+		// We always set the type to "persistent", since the imperative-like
+		// behavior of "one-time" does not map well to TF's declarative domain.
+		Type: aws.String("persistent"),
+
+		// Though the AWS API supports creating spot instance requests for multiple
+		// instances, for TF purposes we fix this to one instance per request.
+		// Users can get equivalent behavior out of TF's "count" meta-parameter.
+		InstanceCount: aws.Long(1),
+
+		LaunchSpecification: &ec2.RequestSpotLaunchSpecification{
+			BlockDeviceMappings: instanceOpts.BlockDeviceMappings,
+			EBSOptimized:        instanceOpts.EBSOptimized,
+			Monitoring:          instanceOpts.Monitoring,
+			IAMInstanceProfile:  instanceOpts.IAMInstanceProfile,
+			ImageID:             instanceOpts.ImageID,
+			InstanceType:        instanceOpts.InstanceType,
+			Placement:           instanceOpts.SpotPlacement,
+			SecurityGroupIDs:    instanceOpts.SecurityGroupIDs,
+			SecurityGroups:      instanceOpts.SecurityGroups,
+			UserData:            instanceOpts.UserData64,
+		},
+	}
+
+	// Make the spot instance request
+	log.Printf("[DEBUG] Requesting spot bid opts: %s", awsutil.StringValue(spotOpts))
+	resp, err := conn.RequestSpotInstances(spotOpts)
+	if err != nil {
+		return fmt.Errorf("Error requesting spot instances: %s", err)
+	}
+	if len(resp.SpotInstanceRequests) != 1 {
+		return fmt.Errorf(
+			"Expected response with length 1, got: %s", awsutil.StringValue(resp))
+	}
+
+	sir := *resp.SpotInstanceRequests[0]
+	d.SetId(*sir.SpotInstanceRequestID)
+
+	if d.Get("wait_for_fulfillment").(bool) {
+		spotStateConf := &resource.StateChangeConf{
+			// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html
+			Pending:    []string{"start", "pending-evaluation", "pending-fulfillment"},
+			Target:     "fulfilled",
+			Refresh:    SpotInstanceStateRefreshFunc(conn, sir),
+			Timeout:    10 * time.Minute,
+			Delay:      10 * time.Second,
+			MinTimeout: 3 * time.Second,
+		}
+
+		log.Printf("[DEBUG] waiting for spot bid to resolve... this may take several minutes.")
+		_, err = spotStateConf.WaitForState()
+
+		if err != nil {
+			return fmt.Errorf("Error while waiting for spot request (%s) to resolve: %s", awsutil.StringValue(sir), err)
+		}
+	}
+
+	return resourceAwsSpotInstanceRequestUpdate(d, meta)
+}
+
+// Update spot state, etc
+func resourceAwsSpotInstanceRequestRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	req := &ec2.DescribeSpotInstanceRequestsInput{
+		SpotInstanceRequestIDs: []*string{aws.String(d.Id())},
+	}
+	resp, err := conn.DescribeSpotInstanceRequests(req)
+
+	if err != nil {
+		// If the spot request was not found, return nil so that we can show
+		// that it is gone.
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSpotInstanceRequestID.NotFound" {
+			d.SetId("")
+			return nil
+		}
+
+		// Some other error, report it
+		return err
+	}
+
+	// If nothing was found, then return no state
+	if len(resp.SpotInstanceRequests) == 0 {
+		d.SetId("")
+		return nil
+	}
+
+	request := resp.SpotInstanceRequests[0]
+
+	// if the request is cancelled, then it is gone
+	if *request.State == "canceled" {
+		d.SetId("")
+		return nil
+	}
+
+	d.Set("spot_bid_status", *request.Status.Code)
+	// Instance ID is not set if the request is still pending
+	if request.InstanceID != nil {
+		d.Set("spot_instance_id", *request.InstanceID)
+	}
+	d.Set("spot_request_state", *request.State)
+	d.Set("tags", tagsToMap(request.Tags))
+
+	return nil
+}
+
+func resourceAwsSpotInstanceRequestUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	d.Partial(true)
+	if err := setTags(conn, d); err != nil {
+		return err
+	} else {
+		d.SetPartial("tags")
+	}
+
+	d.Partial(false)
+
+	return resourceAwsSpotInstanceRequestRead(d, meta)
+}
+
+func resourceAwsSpotInstanceRequestDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	log.Printf("[INFO] Cancelling spot request: %s", d.Id())
+	_, err := conn.CancelSpotInstanceRequests(&ec2.CancelSpotInstanceRequestsInput{
+		SpotInstanceRequestIDs: []*string{aws.String(d.Id())},
+	})
+
+	if err != nil {
+		return fmt.Errorf("Error cancelling spot request (%s): %s", d.Id(), err)
+	}
+
+	if instanceId := d.Get("spot_instance_id").(string); instanceId != "" {
+		log.Printf("[INFO] Terminating instance: %s", instanceId)
+		if err := awsTerminateInstance(conn, instanceId); err != nil {
+			return fmt.Errorf("Error terminating spot instance: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// SpotInstanceStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
+// an EC2 spot instance request
+func SpotInstanceStateRefreshFunc(
+	conn *ec2.EC2, sir ec2.SpotInstanceRequest) resource.StateRefreshFunc {
+
+	return func() (interface{}, string, error) {
+		resp, err := conn.DescribeSpotInstanceRequests(&ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{sir.SpotInstanceRequestID},
+		})
+
+		if err != nil {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSpotInstanceRequestID.NotFound" {
+				// Set this to nil as if we didn't find anything.
+				resp = nil
+			} else {
+				log.Printf("Error on StateRefresh: %s", err)
+				return nil, "", err
+			}
+		}
+
+		if resp == nil || len(resp.SpotInstanceRequests) == 0 {
+			// Sometimes AWS just has consistency issues and doesn't see
+			// our request yet. Return an empty state.
+			return nil, "", nil
+		}
+
+		req := resp.SpotInstanceRequests[0]
+		return req, *req.Status.Code, nil
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_spot_instance_request_test.go b/builtin/providers/aws/resource_aws_spot_instance_request_test.go
new file mode 100644
index 000000000..0524f3257
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_spot_instance_request_test.go
@@ -0,0 +1,158 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSpotInstanceRequest_basic(t *testing.T) {
+	var sir ec2.SpotInstanceRequest
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSpotInstanceRequestDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSpotInstanceRequestConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSpotInstanceRequestExists(
+						"aws_spot_instance_request.foo", &sir),
+					testAccCheckAWSSpotInstanceRequestAttributes(&sir),
+					resource.TestCheckResourceAttr(
+						"aws_spot_instance_request.foo", "spot_bid_status", "fulfilled"),
+					resource.TestCheckResourceAttr(
+						"aws_spot_instance_request.foo", "spot_request_state", "active"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSpotInstanceRequestDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_spot_instance_request" {
+			continue
+		}
+
+		req := &ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribeSpotInstanceRequests(req)
+		if err == nil {
+			if len(resp.SpotInstanceRequests) > 0 {
+				return fmt.Errorf("Spot instance request is still here.")
+			}
+		}
+
+		// Verify the error is what we expect
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if ec2err.Code() != "InvalidSpotInstanceRequestID.NotFound" {
+			return err
+		}
+
+		// Now check if the associated Spot Instance was also destroyed
+		instId := rs.Primary.Attributes["spot_instance_id"]
+		instResp, instErr := conn.DescribeInstances(&ec2.DescribeInstancesInput{
+			InstanceIDs: []*string{aws.String(instId)},
+		})
+		if instErr == nil {
+			if len(instResp.Reservations) > 0 {
+				return fmt.Errorf("Instance still exists.")
+			}
+
+			return nil
+		}
+
+		// Verify the error is what we expect
+		ec2err, ok = err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if ec2err.Code() != "InvalidInstanceID.NotFound" {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSpotInstanceRequestExists(
+	n string, sir *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS subscription with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+		params := &ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{&rs.Primary.ID},
+		}
+		resp, err := conn.DescribeSpotInstanceRequests(params)
+
+		if err != nil {
+			return err
+		}
+
+		if v := len(resp.SpotInstanceRequests); v != 1 {
+			return fmt.Errorf("Expected 1 request returned, got %d", v)
+		}
+
+		*sir = *resp.SpotInstanceRequests[0]
+
+		return nil
+	}
+}
+
+func testAccCheckAWSSpotInstanceRequestAttributes(
+	sir *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if *sir.SpotPrice != "0.050000" {
+			return fmt.Errorf("Unexpected spot price: %s", *sir.SpotPrice)
+		}
+		if *sir.State != "active" {
+			return fmt.Errorf("Unexpected request state: %s", *sir.State)
+		}
+		if *sir.Status.Code != "fulfilled" {
+			return fmt.Errorf("Unexpected bid status: %s", *sir.State)
+		}
+		return nil
+	}
+}
+
+const testAccAWSSpotInstanceRequestConfig = `
+resource "aws_spot_instance_request" "foo" {
+	ami = "ami-4fccb37f"
+	instance_type = "m1.small"
+
+	// base price is $0.044 hourly, so bidding above that should theoretically
+	// always fulfill
+	spot_price = "0.05"
+
+	// we wait for fulfillment because we want to inspect the launched instance
+	// and verify termination behavior
+	wait_for_fulfillment = true
+
+	tags {
+		Name = "terraform-test"
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_sqs_queue.go b/builtin/providers/aws/resource_aws_sqs_queue.go
new file mode 100644
index 000000000..0e85f7cbe
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sqs_queue.go
@@ -0,0 +1,200 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"strconv"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sqs"
+)
+
+var AttributeMap = map[string]string{
+	"delay_seconds":              "DelaySeconds",
+	"max_message_size":           "MaximumMessageSize",
+	"message_retention_seconds":  "MessageRetentionPeriod",
+	"receive_wait_time_seconds":  "ReceiveMessageWaitTimeSeconds",
+	"visibility_timeout_seconds": "VisibilityTimeout",
+	"policy":                     "Policy",
+	"redrive_policy":             "RedrivePolicy",
+	"arn":                        "QueueArn",
+}
+
+// A number of these are marked as computed because if you don't
+// provide a value, SQS will provide you with defaults (which are the
+// default values specified below)
+func resourceAwsSqsQueue() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSqsQueueCreate,
+		Read:   resourceAwsSqsQueueRead,
+		Update: resourceAwsSqsQueueUpdate,
+		Delete: resourceAwsSqsQueueDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"delay_seconds": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"max_message_size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"message_retention_seconds": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"receive_wait_time_seconds": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"visibility_timeout_seconds": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"redrive_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSqsQueueCreate(d *schema.ResourceData, meta interface{}) error {
+	sqsconn := meta.(*AWSClient).sqsconn
+
+	name := d.Get("name").(string)
+
+	log.Printf("[DEBUG] SQS queue create: %s", name)
+
+	req := &sqs.CreateQueueInput{
+		QueueName: aws.String(name),
+	}
+
+	attributes := make(map[string]*string)
+
+	resource := *resourceAwsSqsQueue()
+
+	for k, s := range resource.Schema {
+		if attrKey, ok := AttributeMap[k]; ok {
+			if value, ok := d.GetOk(k); ok {
+				if s.Type == schema.TypeInt {
+					attributes[attrKey] = aws.String(strconv.Itoa(value.(int)))
+				} else {
+					attributes[attrKey] = aws.String(value.(string))
+				}
+			}
+
+		}
+	}
+
+	if len(attributes) > 0 {
+		req.Attributes = attributes
+	}
+
+	output, err := sqsconn.CreateQueue(req)
+	if err != nil {
+		return fmt.Errorf("Error creating SQS queue: %s", err)
+	}
+
+	d.SetId(*output.QueueURL)
+
+	return resourceAwsSqsQueueUpdate(d, meta)
+}
+
+func resourceAwsSqsQueueUpdate(d *schema.ResourceData, meta interface{}) error {
+	sqsconn := meta.(*AWSClient).sqsconn
+	attributes := make(map[string]*string)
+
+	resource := *resourceAwsSqsQueue()
+
+	for k, s := range resource.Schema {
+		if attrKey, ok := AttributeMap[k]; ok {
+			if d.HasChange(k) {
+				log.Printf("[DEBUG] Updating %s", attrKey)
+				_, n := d.GetChange(k)
+				if s.Type == schema.TypeInt {
+					attributes[attrKey] = aws.String(strconv.Itoa(n.(int)))
+				} else {
+					attributes[attrKey] = aws.String(n.(string))
+				}
+			}
+		}
+	}
+
+	if len(attributes) > 0 {
+		req := &sqs.SetQueueAttributesInput{
+			QueueURL:   aws.String(d.Id()),
+			Attributes: attributes,
+		}
+		sqsconn.SetQueueAttributes(req)
+	}
+
+	return resourceAwsSqsQueueRead(d, meta)
+}
+
+func resourceAwsSqsQueueRead(d *schema.ResourceData, meta interface{}) error {
+	sqsconn := meta.(*AWSClient).sqsconn
+
+	attributeOutput, err := sqsconn.GetQueueAttributes(&sqs.GetQueueAttributesInput{
+		QueueURL:       aws.String(d.Id()),
+		AttributeNames: []*string{aws.String("All")},
+	})
+
+	if err != nil {
+		return err
+	}
+
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrmap := attributeOutput.Attributes
+		resource := *resourceAwsSqsQueue()
+		// iKey = internal struct key, oKey = AWS Attribute Map key
+		for iKey, oKey := range AttributeMap {
+			if attrmap[oKey] != nil {
+				if resource.Schema[iKey].Type == schema.TypeInt {
+					value, err := strconv.Atoi(*attrmap[oKey])
+					if err != nil {
+						return err
+					}
+					d.Set(iKey, value)
+				} else {
+					d.Set(iKey, *attrmap[oKey])
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func resourceAwsSqsQueueDelete(d *schema.ResourceData, meta interface{}) error {
+	sqsconn := meta.(*AWSClient).sqsconn
+
+	log.Printf("[DEBUG] SQS Delete Queue: %s", d.Id())
+	_, err := sqsconn.DeleteQueue(&sqs.DeleteQueueInput{
+		QueueURL: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_sqs_queue_test.go b/builtin/providers/aws/resource_aws_sqs_queue_test.go
new file mode 100644
index 000000000..e340a05b9
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sqs_queue_test.go
@@ -0,0 +1,178 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sqs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSQSQueue_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSQSQueueDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSQSConfigWithDefaults,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSQSExistsWithDefaults("aws_sqs_queue.queue-with-defaults"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSSQSConfigWithOverrides,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSQSExistsWithOverrides("aws_sqs_queue.queue-with-overrides"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSQSQueueDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).sqsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sqs_queue" {
+			continue
+		}
+
+		// Check if queue exists by checking for its attributes
+		params := &sqs.GetQueueAttributesInput{
+			QueueURL: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetQueueAttributes(params)
+		if err == nil {
+			return fmt.Errorf("Queue %s still exists. Failing!", rs.Primary.ID)
+		}
+
+		// Verify the error is what we want
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSQSExistsWithDefaults(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Queue URL specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).sqsconn
+
+		params := &sqs.GetQueueAttributesInput{
+			QueueURL:       aws.String(rs.Primary.ID),
+			AttributeNames: []*string{aws.String("All")},
+		}
+		resp, err := conn.GetQueueAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		// checking if attributes are defaults
+		for k, v := range resp.Attributes {
+			if k == "VisibilityTimeout" && *v != "30" {
+				return fmt.Errorf("VisibilityTimeout (%s) was not set to 30", *v)
+			}
+
+			if k == "MessageRetentionPeriod" && *v != "345600" {
+				return fmt.Errorf("MessageRetentionPeriod (%s) was not set to 345600", *v)
+			}
+
+			if k == "MaximumMessageSize" && *v != "262144" {
+				return fmt.Errorf("MaximumMessageSize (%s) was not set to 262144", *v)
+			}
+
+			if k == "DelaySeconds" && *v != "0" {
+				return fmt.Errorf("DelaySeconds (%s) was not set to 0", *v)
+			}
+
+			if k == "ReceiveMessageWaitTimeSeconds" && *v != "0" {
+				return fmt.Errorf("ReceiveMessageWaitTimeSeconds (%s) was not set to 0", *v)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAWSSQSExistsWithOverrides(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Queue URL specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).sqsconn
+
+		params := &sqs.GetQueueAttributesInput{
+			QueueURL:       aws.String(rs.Primary.ID),
+			AttributeNames: []*string{aws.String("All")},
+		}
+		resp, err := conn.GetQueueAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		// checking if attributes match our overrides
+		for k, v := range resp.Attributes {
+			if k == "VisibilityTimeout" && *v != "60" {
+				return fmt.Errorf("VisibilityTimeout (%s) was not set to 60", *v)
+			}
+
+			if k == "MessageRetentionPeriod" && *v != "86400" {
+				return fmt.Errorf("MessageRetentionPeriod (%s) was not set to 86400", *v)
+			}
+
+			if k == "MaximumMessageSize" && *v != "2048" {
+				return fmt.Errorf("MaximumMessageSize (%s) was not set to 2048", *v)
+			}
+
+			if k == "DelaySeconds" && *v != "90" {
+				return fmt.Errorf("DelaySeconds (%s) was not set to 90", *v)
+			}
+
+			if k == "ReceiveMessageWaitTimeSeconds" && *v != "10" {
+				return fmt.Errorf("ReceiveMessageWaitTimeSeconds (%s) was not set to 10", *v)
+			}
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSSQSConfigWithDefaults = `
+resource "aws_sqs_queue" "queue-with-defaults" {
+    name = "test-sqs-queue-with-defaults"
+}
+`
+
+const testAccAWSSQSConfigWithOverrides = `
+resource "aws_sqs_queue" "queue-with-overrides" {
+	name = "test-sqs-queue-with-overrides"
+	delay_seconds = 90
+  	max_message_size = 2048
+  	message_retention_seconds = 86400
+  	receive_wait_time_seconds = 10
+  	visibility_timeout_seconds = 60
+}
+`
diff --git a/builtin/providers/aws/resource_aws_subnet.go b/builtin/providers/aws/resource_aws_subnet.go
index cc0ddec19..326ddc28d 100644
--- a/builtin/providers/aws/resource_aws_subnet.go
+++ b/builtin/providers/aws/resource_aws_subnet.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -59,6 +60,7 @@ func resourceAwsSubnetCreate(d *schema.ResourceData, meta interface{}) error {
 		VPCID:            aws.String(d.Get("vpc_id").(string)),
 	}
 
+	var err error
 	resp, err := conn.CreateSubnet(createOpts)
 
 	if err != nil {
@@ -98,7 +100,7 @@ func resourceAwsSubnetRead(d *schema.ResourceData, meta interface{}) error {
 	})
 
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidSubnetID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSubnetID.NotFound" {
 			// Update state to indicate the subnet no longer exists.
 			d.SetId("")
 			return nil
@@ -115,7 +117,7 @@ func resourceAwsSubnetRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("availability_zone", subnet.AvailabilityZone)
 	d.Set("cidr_block", subnet.CIDRBlock)
 	d.Set("map_public_ip_on_launch", subnet.MapPublicIPOnLaunch)
-	d.Set("tags", tagsToMapSDK(subnet.Tags))
+	d.Set("tags", tagsToMap(subnet.Tags))
 
 	return nil
 }
@@ -125,7 +127,7 @@ func resourceAwsSubnetUpdate(d *schema.ResourceData, meta interface{}) error {
 
 	d.Partial(true)
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -171,14 +173,14 @@ func resourceAwsSubnetDelete(d *schema.ResourceData, meta interface{}) error {
 		Refresh: func() (interface{}, string, error) {
 			_, err := conn.DeleteSubnet(req)
 			if err != nil {
-				if apiErr, ok := err.(aws.APIError); ok {
-					if apiErr.Code == "DependencyViolation" {
+				if apiErr, ok := err.(awserr.Error); ok {
+					if apiErr.Code() == "DependencyViolation" {
 						// There is some pending operation, so just retry
 						// in a bit.
 						return 42, "pending", nil
 					}
 
-					if apiErr.Code == "InvalidSubnetID.NotFound" {
+					if apiErr.Code() == "InvalidSubnetID.NotFound" {
 						return 42, "destroyed", nil
 					}
 				}
@@ -204,7 +206,7 @@ func SubnetStateRefreshFunc(conn *ec2.EC2, id string) resource.StateRefreshFunc
 			SubnetIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidSubnetID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSubnetID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on SubnetStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_subnet_test.go b/builtin/providers/aws/resource_aws_subnet_test.go
index fbf1f4a92..78dbf2d9f 100644
--- a/builtin/providers/aws/resource_aws_subnet_test.go
+++ b/builtin/providers/aws/resource_aws_subnet_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSSubnet(t *testing.T) {
+func TestAccAWSSubnet_basic(t *testing.T) {
 	var v ec2.Subnet
 
 	testCheck := func(*terraform.State) error {
@@ -63,11 +64,11 @@ func testAccCheckSubnetDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidSubnetID.NotFound" {
+		if ec2err.Code() != "InvalidSubnetID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_volume_attachment.go b/builtin/providers/aws/resource_aws_volume_attachment.go
new file mode 100644
index 000000000..6822ebd28
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_volume_attachment.go
@@ -0,0 +1,191 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsVolumeAttachment() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsVolumeAttachmentCreate,
+		Read:   resourceAwsVolumeAttachmentRead,
+		Delete: resourceAwsVolumeAttachmentDelete,
+
+		Schema: map[string]*schema.Schema{
+			"device_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"instance_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"volume_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"force_detach": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsVolumeAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	name := d.Get("device_name").(string)
+	iID := d.Get("instance_id").(string)
+	vID := d.Get("volume_id").(string)
+
+	opts := &ec2.AttachVolumeInput{
+		Device:     aws.String(name),
+		InstanceID: aws.String(iID),
+		VolumeID:   aws.String(vID),
+	}
+
+	log.Printf("[DEBUG] Attaching Volume (%s) to Instance (%s)", vID, iID)
+	_, err := conn.AttachVolume(opts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error attaching volume (%s) to instance (%s), message: \"%s\", code: \"%s\"",
+				vID, iID, awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"attaching"},
+		Target:     "attached",
+		Refresh:    volumeAttachmentStateRefreshFunc(conn, vID, iID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to attach to Instance: %s, error: %s",
+			vID, iID, err)
+	}
+
+	d.SetId(volumeAttachmentID(name, vID, iID))
+	return resourceAwsVolumeAttachmentRead(d, meta)
+}
+
+func volumeAttachmentStateRefreshFunc(conn *ec2.EC2, volumeID, instanceID string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+
+		request := &ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(volumeID)},
+			Filters: []*ec2.Filter{
+				&ec2.Filter{
+					Name:   aws.String("attachment.instance-id"),
+					Values: []*string{aws.String(instanceID)},
+				},
+			},
+		}
+
+		resp, err := conn.DescribeVolumes(request)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				return nil, "failed", fmt.Errorf("code: %s, message: %s", awsErr.Code(), awsErr.Message())
+			}
+			return nil, "failed", err
+		}
+
+		if len(resp.Volumes) > 0 {
+			v := resp.Volumes[0]
+			for _, a := range v.Attachments {
+				if a.InstanceID != nil && *a.InstanceID == instanceID {
+					return a, *a.State, nil
+				}
+			}
+		}
+		// assume detached if volume count is 0
+		return 42, "detached", nil
+	}
+}
+func resourceAwsVolumeAttachmentRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	request := &ec2.DescribeVolumesInput{
+		VolumeIDs: []*string{aws.String(d.Get("volume_id").(string))},
+		Filters: []*ec2.Filter{
+			&ec2.Filter{
+				Name:   aws.String("attachment.instance-id"),
+				Values: []*string{aws.String(d.Get("instance_id").(string))},
+			},
+		},
+	}
+
+	_, err := conn.DescribeVolumes(request)
+	if err != nil {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVolume.NotFound" {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error reading EC2 volume %s for instance: %s: %#v", d.Get("volume_id").(string), d.Get("instance_id").(string), err)
+	}
+	return nil
+}
+
+func resourceAwsVolumeAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	vID := d.Get("volume_id").(string)
+	iID := d.Get("instance_id").(string)
+
+	opts := &ec2.DetachVolumeInput{
+		Device:     aws.String(d.Get("device_name").(string)),
+		InstanceID: aws.String(iID),
+		VolumeID:   aws.String(vID),
+		Force:      aws.Boolean(d.Get("force_detach").(bool)),
+	}
+
+	_, err := conn.DetachVolume(opts)
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"detaching"},
+		Target:     "detached",
+		Refresh:    volumeAttachmentStateRefreshFunc(conn, vID, iID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	log.Printf("[DEBUG] Detaching Volume (%s) from Instance (%s)", vID, iID)
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to detach from Instance: %s",
+			vID, iID)
+	}
+	d.SetId("")
+	return nil
+}
+
+func volumeAttachmentID(name, volumeID, instanceID string) string {
+	var buf bytes.Buffer
+	buf.WriteString(fmt.Sprintf("%s-", name))
+	buf.WriteString(fmt.Sprintf("%s-", instanceID))
+	buf.WriteString(fmt.Sprintf("%s-", volumeID))
+
+	return fmt.Sprintf("vai-%d", hashcode.String(buf.String()))
+}
diff --git a/builtin/providers/aws/resource_aws_volume_attachment_test.go b/builtin/providers/aws/resource_aws_volume_attachment_test.go
new file mode 100644
index 000000000..66807884f
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_volume_attachment_test.go
@@ -0,0 +1,93 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSVolumeAttachment_basic(t *testing.T) {
+	var i ec2.Instance
+	var v ec2.Volume
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckVolumeAttachmentDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccVolumeAttachmentConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(
+						"aws_volume_attachment.ebs_att", "device_name", "/dev/sdh"),
+					testAccCheckInstanceExists(
+						"aws_instance.web", &i),
+					testAccCheckVolumeExists(
+						"aws_ebs_volume.example", &v),
+					testAccCheckVolumeAttachmentExists(
+						"aws_volume_attachment.ebs_att", &i, &v),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVolumeAttachmentExists(n string, i *ec2.Instance, v *ec2.Volume) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		for _, b := range i.BlockDeviceMappings {
+			if rs.Primary.Attributes["device_name"] == *b.DeviceName {
+				if b.EBS.VolumeID != nil && rs.Primary.Attributes["volume_id"] == *b.EBS.VolumeID {
+					// pass
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Error finding instance/volume")
+	}
+}
+
+func testAccCheckVolumeAttachmentDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		log.Printf("\n\n----- This is never called")
+		if rs.Type != "aws_volume_attachment" {
+			continue
+		}
+	}
+	return nil
+}
+
+const testAccVolumeAttachmentConfig = `
+resource "aws_instance" "web" {
+	ami = "ami-21f78e11"
+  availability_zone = "us-west-2a"
+	instance_type = "t1.micro"
+	tags {
+		Name = "HelloWorld"
+	}
+}
+
+resource "aws_ebs_volume" "example" {
+  availability_zone = "us-west-2a"
+	size = 1
+}
+
+resource "aws_volume_attachment" "ebs_att" {
+  device_name = "/dev/sdh"
+	volume_id = "${aws_ebs_volume.example.id}"
+	instance_id = "${aws_instance.web.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_vpc.go b/builtin/providers/aws/resource_aws_vpc.go
index d27bde533..dfb67172e 100644
--- a/builtin/providers/aws/resource_aws_vpc.go
+++ b/builtin/providers/aws/resource_aws_vpc.go
@@ -3,10 +3,12 @@ package aws
 import (
 	"fmt"
 	"log"
+	"net"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -23,6 +25,16 @@ func resourceAwsVpc() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					_, ipnet, err := net.ParseCIDR(value)
+
+					if err != nil || ipnet == nil || value != ipnet.String() {
+						errors = append(errors, fmt.Errorf(
+							"%q must contain a valid CIDR", k))
+					}
+					return
+				},
 			},
 
 			"instance_tenancy": &schema.Schema{
@@ -134,7 +146,7 @@ func resourceAwsVpcRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("dhcp_options_id", vpc.DHCPOptionsID)
 
 	// Tags
-	d.Set("tags", tagsToMapSDK(vpc.Tags))
+	d.Set("tags", tagsToMap(vpc.Tags))
 
 	// Attributes
 	attribute := "enableDnsSupport"
@@ -229,7 +241,7 @@ func resourceAwsVpcUpdate(d *schema.ResourceData, meta interface{}) error {
 		d.SetPartial("enable_dns_support")
 	}
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -246,16 +258,29 @@ func resourceAwsVpcDelete(d *schema.ResourceData, meta interface{}) error {
 		VPCID: &vpcID,
 	}
 	log.Printf("[INFO] Deleting VPC: %s", d.Id())
-	if _, err := conn.DeleteVPC(DeleteVpcOpts); err != nil {
-		ec2err, ok := err.(aws.APIError)
-		if ok && ec2err.Code == "InvalidVpcID.NotFound" {
+
+	return resource.Retry(5*time.Minute, func() error {
+		_, err := conn.DeleteVPC(DeleteVpcOpts)
+		if err == nil {
 			return nil
 		}
 
-		return fmt.Errorf("Error deleting VPC: %s", err)
-	}
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return &resource.RetryError{Err: err}
+		}
 
-	return nil
+		switch ec2err.Code() {
+		case "InvalidVpcID.NotFound":
+			return nil
+		case "DependencyViolation":
+			return err
+		}
+
+		return &resource.RetryError{
+			Err: fmt.Errorf("Error deleting VPC: %s", err),
+		}
+	})
 }
 
 // VPCStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
@@ -267,7 +292,7 @@ func VPCStateRefreshFunc(conn *ec2.EC2, id string) resource.StateRefreshFunc {
 		}
 		resp, err := conn.DescribeVPCs(DescribeVpcOpts)
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpcID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpcID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on VPCStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
index c496b1eb8..540c62802 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
@@ -6,8 +6,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -151,7 +152,7 @@ func resourceAwsVpcDhcpOptionsRead(d *schema.ResourceData, meta interface{}) err
 	}
 
 	opts := resp.DHCPOptions[0]
-	d.Set("tags", tagsToMapSDK(opts.Tags))
+	d.Set("tags", tagsToMap(opts.Tags))
 
 	for _, cfg := range opts.DHCPConfigurations {
 		tfKey := strings.Replace(*cfg.Key, "-", "_", -1)
@@ -173,7 +174,7 @@ func resourceAwsVpcDhcpOptionsRead(d *schema.ResourceData, meta interface{}) err
 
 func resourceAwsVpcDhcpOptionsUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
-	return setTagsSDK(conn, d)
+	return setTags(conn, d)
 }
 
 func resourceAwsVpcDhcpOptionsDelete(d *schema.ResourceData, meta interface{}) error {
@@ -191,12 +192,12 @@ func resourceAwsVpcDhcpOptionsDelete(d *schema.ResourceData, meta interface{}) e
 
 		log.Printf("[WARN] %s", err)
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 
-		switch ec2err.Code {
+		switch ec2err.Code() {
 		case "InvalidDhcpOptionsID.NotFound":
 			return nil
 		case "DependencyViolation":
@@ -241,7 +242,7 @@ func findVPCsByDHCPOptionsID(conn *ec2.EC2, id string) ([]*ec2.VPC, error) {
 
 	resp, err := conn.DescribeVPCs(req)
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpcID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpcID.NotFound" {
 			return nil, nil
 		}
 		return nil, err
@@ -260,7 +261,7 @@ func DHCPOptionsStateRefreshFunc(conn *ec2.EC2, id string) resource.StateRefresh
 
 		resp, err := conn.DescribeDHCPOptions(DescribeDhcpOpts)
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidDhcpOptionsID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidDhcpOptionsID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on DHCPOptionsStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
index 46c447213..93ac4494e 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
index 1b00ce3dc..f40f1a06e 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDHCPOptionsAssociation(t *testing.T) {
+func TestAccAWSDHCPOptionsAssociation_basic(t *testing.T) {
 	var v ec2.VPC
 	var d ec2.DHCPOptions
 
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
index 74ab93953..988c8b3c4 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
@@ -4,13 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccDHCPOptions(t *testing.T) {
+func TestAccDHCPOptions_basic(t *testing.T) {
 	var d ec2.DHCPOptions
 
 	resource.Test(t, resource.TestCase{
@@ -58,11 +59,11 @@ func testAccCheckDHCPOptionsDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidDhcpOptionsID.NotFound" {
+		if ec2err.Code() != "InvalidDhcpOptionsID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_vpc_endpoint.go b/builtin/providers/aws/resource_aws_vpc_endpoint.go
new file mode 100644
index 000000000..5617faa41
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_vpc_endpoint.go
@@ -0,0 +1,174 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsVpcEndpoint() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsVPCEndpointCreate,
+		Read:   resourceAwsVPCEndpointRead,
+		Update: resourceAwsVPCEndpointUpdate,
+		Delete: resourceAwsVPCEndpointDelete,
+		Schema: map[string]*schema.Schema{
+			"policy": &schema.Schema{
+				Type:      schema.TypeString,
+				Optional:  true,
+				Computed:  true,
+				StateFunc: normalizeJson,
+			},
+			"vpc_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"route_table_ids": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+		},
+	}
+}
+
+func resourceAwsVPCEndpointCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	input := &ec2.CreateVPCEndpointInput{
+		VPCID:         aws.String(d.Get("vpc_id").(string)),
+		RouteTableIDs: expandStringList(d.Get("route_table_ids").(*schema.Set).List()),
+		ServiceName:   aws.String(d.Get("service_name").(string)),
+	}
+
+	if v, ok := d.GetOk("policy"); ok {
+		policy := normalizeJson(v)
+		input.PolicyDocument = aws.String(policy)
+	}
+
+	log.Printf("[DEBUG] Creating VPC Endpoint: %#v", input)
+	output, err := conn.CreateVPCEndpoint(input)
+	if err != nil {
+		return fmt.Errorf("Error creating VPC Endpoint: %s", err)
+	}
+	log.Printf("[DEBUG] VPC Endpoint %q created.", *output.VPCEndpoint.VPCEndpointID)
+
+	d.SetId(*output.VPCEndpoint.VPCEndpointID)
+
+	return resourceAwsVPCEndpointRead(d, meta)
+}
+
+func resourceAwsVPCEndpointRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	input := &ec2.DescribeVPCEndpointsInput{
+		VPCEndpointIDs: []*string{aws.String(d.Id())},
+	}
+
+	log.Printf("[DEBUG] Reading VPC Endpoint: %q", d.Id())
+	output, err := conn.DescribeVPCEndpoints(input)
+
+	if err != nil {
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return fmt.Errorf("Error reading VPC Endpoint: %s", err.Error())
+		}
+
+		if ec2err.Code() == "InvalidVpcEndpointId.NotFound" {
+			return nil
+		}
+
+		return fmt.Errorf("Error reading VPC Endpoint: %s", err.Error())
+	}
+
+	if len(output.VPCEndpoints) != 1 {
+		return fmt.Errorf("There's no unique VPC Endpoint, but %d endpoints: %#v",
+			len(output.VPCEndpoints), output.VPCEndpoints)
+	}
+
+	vpce := output.VPCEndpoints[0]
+
+	d.Set("vpc_id", vpce.VPCID)
+	d.Set("policy", normalizeJson(*vpce.PolicyDocument))
+	d.Set("service_name", vpce.ServiceName)
+	d.Set("route_table_ids", vpce.RouteTableIDs)
+
+	return nil
+}
+
+func resourceAwsVPCEndpointUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	input := &ec2.ModifyVPCEndpointInput{
+		VPCEndpointID: aws.String(d.Id()),
+	}
+
+	if d.HasChange("route_table_ids") {
+		o, n := d.GetChange("route_table_ids")
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+
+		add := expandStringList(os.Difference(ns).List())
+		if len(add) > 0 {
+			input.AddRouteTableIDs = add
+		}
+
+		remove := expandStringList(ns.Difference(os).List())
+		if len(remove) > 0 {
+			input.RemoveRouteTableIDs = remove
+		}
+	}
+
+	if d.HasChange("policy") {
+		policy := normalizeJson(d.Get("policy"))
+		input.PolicyDocument = aws.String(policy)
+	}
+
+	log.Printf("[DEBUG] Updating VPC Endpoint: %#v", input)
+	_, err := conn.ModifyVPCEndpoint(input)
+	if err != nil {
+		return fmt.Errorf("Error updating VPC Endpoint: %s", err)
+	}
+	log.Printf("[DEBUG] VPC Endpoint %q updated", input.VPCEndpointID)
+
+	return nil
+}
+
+func resourceAwsVPCEndpointDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	input := &ec2.DeleteVPCEndpointsInput{
+		VPCEndpointIDs: []*string{aws.String(d.Id())},
+	}
+
+	log.Printf("[DEBUG] Deleting VPC Endpoint: %#v", input)
+	_, err := conn.DeleteVPCEndpoints(input)
+
+	if err != nil {
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return fmt.Errorf("Error deleting VPC Endpoint: %s", err.Error())
+		}
+
+		if ec2err.Code() == "InvalidVpcEndpointId.NotFound" {
+			log.Printf("[DEBUG] VPC Endpoint %q is already gone", d.Id())
+		} else {
+			return fmt.Errorf("Error deleting VPC Endpoint: %s", err.Error())
+		}
+	}
+
+	log.Printf("[DEBUG] VPC Endpoint %q deleted", d.Id())
+	d.SetId("")
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_vpc_endpoint_test.go b/builtin/providers/aws/resource_aws_vpc_endpoint_test.go
new file mode 100644
index 000000000..6a29b688e
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_vpc_endpoint_test.go
@@ -0,0 +1,210 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccVpcEndpoint_basic(t *testing.T) {
+	var endpoint ec2.VPCEndpoint
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckVpcEndpointDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccVpcEndpointConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVpcEndpointExists("aws_vpc_endpoint.private-s3", &endpoint),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVpcEndpoint_withRouteTableAndPolicy(t *testing.T) {
+	var endpoint ec2.VPCEndpoint
+	var routeTable ec2.RouteTable
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckVpcEndpointDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccVpcEndpointWithRouteTableAndPolicyConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVpcEndpointExists("aws_vpc_endpoint.second-private-s3", &endpoint),
+					testAccCheckRouteTableExists("aws_route_table.default", &routeTable),
+				),
+			},
+			resource.TestStep{
+				Config: testAccVpcEndpointWithRouteTableAndPolicyConfigModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVpcEndpointExists("aws_vpc_endpoint.second-private-s3", &endpoint),
+					testAccCheckRouteTableExists("aws_route_table.default", &routeTable),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVpcEndpointDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_vpc_endpoint" {
+			continue
+		}
+
+		// Try to find the VPC
+		input := &ec2.DescribeVPCEndpointsInput{
+			VPCEndpointIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeVPCEndpoints(input)
+
+		if len(resp.VPCEndpoints) > 0 {
+			return fmt.Errorf("VPC Endpoints still exist.")
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckVpcEndpointExists(n string, endpoint *ec2.VPCEndpoint) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPC Endpoint ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+		input := &ec2.DescribeVPCEndpointsInput{
+			VPCEndpointIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeVPCEndpoints(input)
+		if err != nil {
+			return err
+		}
+		if len(resp.VPCEndpoints) == 0 {
+			return fmt.Errorf("VPC Endpoint not found")
+		}
+
+		*endpoint = *resp.VPCEndpoints[0]
+
+		return nil
+	}
+}
+
+const testAccVpcEndpointConfig = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.1.0.0/16"
+}
+
+resource "aws_vpc_endpoint" "private-s3" {
+    vpc_id = "${aws_vpc.foo.id}"
+    service_name = "com.amazonaws.us-west-2.s3"
+}
+`
+
+const testAccVpcEndpointWithRouteTableAndPolicyConfig = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+}
+
+resource "aws_subnet" "foo" {
+	vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+}
+
+resource "aws_vpc_endpoint" "second-private-s3" {
+    vpc_id = "${aws_vpc.foo.id}"
+    service_name = "com.amazonaws.us-west-2.s3"
+    route_table_ids = ["${aws_route_table.default.id}"]
+    policy = <<POLICY
+{
+	"Version": "2008-10-17",
+	"Statement": [
+		{
+			"Sid":"AllowAll",
+			"Effect":"Allow",
+			"Principal":"*",
+			"Action":"*",
+			"Resource":"*"
+		}
+	]
+}
+POLICY
+}
+
+resource "aws_route_table" "default" {
+    vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_route_table_association" "main" {
+    subnet_id = "${aws_subnet.foo.id}"
+    route_table_id = "${aws_route_table.default.id}"
+}
+`
+
+const testAccVpcEndpointWithRouteTableAndPolicyConfigModified = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+}
+
+resource "aws_subnet" "foo" {
+	vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+}
+
+resource "aws_vpc_endpoint" "second-private-s3" {
+    vpc_id = "${aws_vpc.foo.id}"
+    service_name = "com.amazonaws.us-west-2.s3"
+    route_table_ids = ["${aws_route_table.default.id}"]
+    policy = <<POLICY
+{
+	"Version": "2008-10-17",
+	"Statement": [
+		{
+			"Sid":"AllowAll",
+			"Effect":"Allow",
+			"Principal":"*",
+			"Action":"*",
+			"Resource":"*"
+		}
+	]
+}
+POLICY
+}
+
+resource "aws_internet_gateway" "gw" {
+    vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_route_table" "default" {
+    vpc_id = "${aws_vpc.foo.id}"
+
+    route {
+        cidr_block = "0.0.0.0/0"
+        gateway_id = "${aws_internet_gateway.gw.id}"
+    }
+}
+
+resource "aws_route_table_association" "main" {
+    subnet_id = "${aws_subnet.foo.id}"
+    route_table_id = "${aws_route_table.default.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_vpc_peering_connection.go b/builtin/providers/aws/resource_aws_vpc_peering_connection.go
index 73d6c8879..3d768577b 100644
--- a/builtin/providers/aws/resource_aws_vpc_peering_connection.go
+++ b/builtin/providers/aws/resource_aws_vpc_peering_connection.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -100,11 +101,19 @@ func resourceAwsVPCPeeringRead(d *schema.ResourceData, meta interface{}) error {
 
 	pc := pcRaw.(*ec2.VPCPeeringConnection)
 
+	// The failed status is a status that we can assume just means the
+	// connection is gone. Destruction isn't allowed, and it eventually
+	// just "falls off" the console. See GH-2322
+	if *pc.Status.Code == "failed" {
+		d.SetId("")
+		return nil
+	}
+
 	d.Set("accept_status", *pc.Status.Code)
 	d.Set("peer_owner_id", pc.AccepterVPCInfo.OwnerID)
 	d.Set("peer_vpc_id", pc.AccepterVPCInfo.VPCID)
 	d.Set("vpc_id", pc.RequesterVPCInfo.VPCID)
-	d.Set("tags", tagsToMapSDK(pc.Tags))
+	d.Set("tags", tagsToMap(pc.Tags))
 
 	return nil
 }
@@ -125,7 +134,7 @@ func resourceVPCPeeringConnectionAccept(conn *ec2.EC2, id string) (string, error
 func resourceAwsVPCPeeringUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
@@ -179,7 +188,7 @@ func resourceAwsVPCPeeringConnectionStateRefreshFunc(conn *ec2.EC2, id string) r
 			VPCPeeringConnectionIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpcPeeringConnectionID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpcPeeringConnectionID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on VPCPeeringConnectionStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go b/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
index 30823b35f..3b7896e40 100644
--- a/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
@@ -5,13 +5,13 @@ import (
 	"os"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSVPCPeeringConnection_normal(t *testing.T) {
+func TestAccAWSVPCPeeringConnection_basic(t *testing.T) {
 	var connection ec2.VPCPeeringConnection
 
 	resource.Test(t, resource.TestCase{
@@ -46,7 +46,7 @@ func TestAccAWSVPCPeeringConnection_tags(t *testing.T) {
 				Config: testAccVpcPeeringConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSVpcPeeringConnectionExists("aws_vpc_peering_connection.foo", &connection),
-					testAccCheckTagsSDK(&connection.Tags, "foo", "bar"),
+					testAccCheckTags(&connection.Tags, "foo", "bar"),
 				),
 			},
 		},
diff --git a/builtin/providers/aws/resource_aws_vpc_test.go b/builtin/providers/aws/resource_aws_vpc_test.go
index 780fcbd3c..95121ec6f 100644
--- a/builtin/providers/aws/resource_aws_vpc_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_test.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -66,7 +67,7 @@ func TestAccVpc_tags(t *testing.T) {
 					testAccCheckVpcCidr(&vpc, "10.1.0.0/16"),
 					resource.TestCheckResourceAttr(
 						"aws_vpc.foo", "cidr_block", "10.1.0.0/16"),
-					testAccCheckTagsSDK(&vpc.Tags, "foo", "bar"),
+					testAccCheckTags(&vpc.Tags, "foo", "bar"),
 				),
 			},
 
@@ -74,8 +75,8 @@ func TestAccVpc_tags(t *testing.T) {
 				Config: testAccVpcConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVpcExists("aws_vpc.foo", &vpc),
-					testAccCheckTagsSDK(&vpc.Tags, "foo", ""),
-					testAccCheckTagsSDK(&vpc.Tags, "bar", "baz"),
+					testAccCheckTags(&vpc.Tags, "foo", ""),
+					testAccCheckTags(&vpc.Tags, "bar", "baz"),
 				),
 			},
 		},
@@ -133,11 +134,11 @@ func testAccCheckVpcDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidVpcID.NotFound" {
+		if ec2err.Code() != "InvalidVpcID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_aws_vpn_connection.go b/builtin/providers/aws/resource_aws_vpn_connection.go
index e44b2a5d5..a97cd7559 100644
--- a/builtin/providers/aws/resource_aws_vpn_connection.go
+++ b/builtin/providers/aws/resource_aws_vpn_connection.go
@@ -6,8 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
@@ -185,7 +186,7 @@ func resourceAwsVpnConnectionCreate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	// Create tags.
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -200,7 +201,7 @@ func vpnConnectionRefreshFunc(conn *ec2.EC2, connectionId string) resource.State
 		})
 
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnConnectionID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnConnectionID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("Error on VPNConnectionRefresh: %s", err)
@@ -224,7 +225,7 @@ func resourceAwsVpnConnectionRead(d *schema.ResourceData, meta interface{}) erro
 		VPNConnectionIDs: []*string{aws.String(d.Id())},
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnConnectionID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnConnectionID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
@@ -243,7 +244,7 @@ func resourceAwsVpnConnectionRead(d *schema.ResourceData, meta interface{}) erro
 	d.Set("vpn_gateway_id", vpnConnection.VPNGatewayID)
 	d.Set("customer_gateway_id", vpnConnection.CustomerGatewayID)
 	d.Set("type", vpnConnection.Type)
-	d.Set("tags", tagsToMapSDK(vpnConnection.Tags))
+	d.Set("tags", tagsToMap(vpnConnection.Tags))
 
 	if vpnConnection.Options != nil {
 		if err := d.Set("static_routes_only", vpnConnection.Options.StaticRoutesOnly); err != nil {
@@ -269,7 +270,7 @@ func resourceAwsVpnConnectionUpdate(d *schema.ResourceData, meta interface{}) er
 	conn := meta.(*AWSClient).ec2conn
 
 	// Update tags if required.
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -285,7 +286,7 @@ func resourceAwsVpnConnectionDelete(d *schema.ResourceData, meta interface{}) er
 		VPNConnectionID: aws.String(d.Id()),
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnConnectionID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnConnectionID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
diff --git a/builtin/providers/aws/resource_aws_vpn_connection_test.go b/builtin/providers/aws/resource_aws_vpn_connection_test.go
index 6b61d97e4..55dbb447c 100644
--- a/builtin/providers/aws/resource_aws_vpn_connection_test.go
+++ b/builtin/providers/aws/resource_aws_vpn_connection_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsVpnConnection(t *testing.T) {
+func TestAccAwsVpnConnection_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_vpn_gateway.go b/builtin/providers/aws/resource_aws_vpn_gateway.go
index 88fb8d00a..1a331e946 100644
--- a/builtin/providers/aws/resource_aws_vpn_gateway.go
+++ b/builtin/providers/aws/resource_aws_vpn_gateway.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -66,7 +67,7 @@ func resourceAwsVpnGatewayRead(d *schema.ResourceData, meta interface{}) error {
 		VPNGatewayIDs: []*string{aws.String(d.Id())},
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnGatewayID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnGatewayID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
@@ -89,7 +90,7 @@ func resourceAwsVpnGatewayRead(d *schema.ResourceData, meta interface{}) error {
 		d.Set("vpc_id", vpnGateway.VPCAttachments[0].VPCID)
 	}
 	d.Set("availability_zone", vpnGateway.AvailabilityZone)
-	d.Set("tags", tagsToMapSDK(vpnGateway.Tags))
+	d.Set("tags", tagsToMap(vpnGateway.Tags))
 
 	return nil
 }
@@ -109,7 +110,7 @@ func resourceAwsVpnGatewayUpdate(d *schema.ResourceData, meta interface{}) error
 
 	conn := meta.(*AWSClient).ec2conn
 
-	if err := setTagsSDK(conn, d); err != nil {
+	if err := setTags(conn, d); err != nil {
 		return err
 	}
 
@@ -136,12 +137,12 @@ func resourceAwsVpnGatewayDelete(d *schema.ResourceData, meta interface{}) error
 			return nil
 		}
 
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
 
-		switch ec2err.Code {
+		switch ec2err.Code() {
 		case "InvalidVpnGatewayID.NotFound":
 			return nil
 		case "IncorrectState":
@@ -221,12 +222,12 @@ func resourceAwsVpnGatewayDetach(d *schema.ResourceData, meta interface{}) error
 		VPCID:        aws.String(vpcID.(string)),
 	})
 	if err != nil {
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if ok {
-			if ec2err.Code == "InvalidVpnGatewayID.NotFound" {
+			if ec2err.Code() == "InvalidVpnGatewayID.NotFound" {
 				err = nil
 				wait = false
-			} else if ec2err.Code == "InvalidVpnGatewayAttachment.NotFound" {
+			} else if ec2err.Code() == "InvalidVpnGatewayAttachment.NotFound" {
 				err = nil
 				wait = false
 			}
@@ -271,7 +272,7 @@ func vpnGatewayAttachStateRefreshFunc(conn *ec2.EC2, id string, expected string)
 			VPNGatewayIDs: []*string{aws.String(id)},
 		})
 		if err != nil {
-			if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnGatewayID.NotFound" {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnGatewayID.NotFound" {
 				resp = nil
 			} else {
 				log.Printf("[ERROR] Error on VpnGatewayStateRefresh: %s", err)
diff --git a/builtin/providers/aws/resource_aws_vpn_gateway_test.go b/builtin/providers/aws/resource_aws_vpn_gateway_test.go
index 4b36a50c2..6b1d3fc48 100644
--- a/builtin/providers/aws/resource_aws_vpn_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_vpn_gateway_test.go
@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -98,7 +99,7 @@ func TestAccVpnGateway_tags(t *testing.T) {
 				Config: testAccCheckVpnGatewayConfigTags,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVpnGatewayExists("aws_vpn_gateway.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", "bar"),
+					testAccCheckTags(&v.Tags, "foo", "bar"),
 				),
 			},
 
@@ -106,8 +107,8 @@ func TestAccVpnGateway_tags(t *testing.T) {
 				Config: testAccCheckVpnGatewayConfigTagsUpdate,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVpnGatewayExists("aws_vpn_gateway.foo", &v),
-					testAccCheckTagsSDK(&v.Tags, "foo", ""),
-					testAccCheckTagsSDK(&v.Tags, "bar", "baz"),
+					testAccCheckTags(&v.Tags, "foo", ""),
+					testAccCheckTags(&v.Tags, "bar", "baz"),
 				),
 			},
 		},
@@ -135,11 +136,11 @@ func testAccCheckVpnGatewayDestroy(s *terraform.State) error {
 		}
 
 		// Verify the error is what we want
-		ec2err, ok := err.(aws.APIError)
+		ec2err, ok := err.(awserr.Error)
 		if !ok {
 			return err
 		}
-		if ec2err.Code != "InvalidVpnGatewayID.NotFound" {
+		if ec2err.Code() != "InvalidVpnGatewayID.NotFound" {
 			return err
 		}
 	}
diff --git a/builtin/providers/aws/resource_vpn_connection_route.go b/builtin/providers/aws/resource_vpn_connection_route.go
index 863a891e7..062fa32b0 100644
--- a/builtin/providers/aws/resource_vpn_connection_route.go
+++ b/builtin/providers/aws/resource_vpn_connection_route.go
@@ -5,8 +5,9 @@ import (
 	"log"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -82,7 +83,7 @@ func resourceAwsVpnConnectionRouteRead(d *schema.ResourceData, meta interface{})
 		Filters: routeFilters,
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnConnectionID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnConnectionID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
@@ -90,6 +91,12 @@ func resourceAwsVpnConnectionRouteRead(d *schema.ResourceData, meta interface{})
 			return err
 		}
 	}
+	if resp == nil || len(resp.VPNConnections) == 0 {
+		// This is kind of a weird edge case. I'd rather return an error
+		// instead of just blindly setting the ID to ""... since I don't know
+		// what might cause this.
+		return fmt.Errorf("No VPN connections returned")
+	}
 
 	vpnConnection := resp.VPNConnections[0]
 
@@ -117,7 +124,7 @@ func resourceAwsVpnConnectionRouteDelete(d *schema.ResourceData, meta interface{
 		VPNConnectionID:      aws.String(d.Get("vpn_connection_id").(string)),
 	})
 	if err != nil {
-		if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "InvalidVpnConnectionID.NotFound" {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVpnConnectionID.NotFound" {
 			d.SetId("")
 			return nil
 		} else {
diff --git a/builtin/providers/aws/resource_vpn_connection_route_test.go b/builtin/providers/aws/resource_vpn_connection_route_test.go
index 55779898c..955aa5f1a 100644
--- a/builtin/providers/aws/resource_vpn_connection_route_test.go
+++ b/builtin/providers/aws/resource_vpn_connection_route_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsVpnConnectionRoute(t *testing.T) {
+func TestAccAwsVpnConnectionRoute_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/s3_tags.go b/builtin/providers/aws/s3_tags.go
index 388a2df7a..5d620b132 100644
--- a/builtin/providers/aws/s3_tags.go
+++ b/builtin/providers/aws/s3_tags.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -101,7 +102,7 @@ func getTagSetS3(s3conn *s3.S3, bucket string) ([]*s3.Tag, error) {
 	}
 
 	response, err := s3conn.GetBucketTagging(request)
-	if ec2err, ok := err.(aws.APIError); ok && ec2err.Code == "NoSuchTagSet" {
+	if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "NoSuchTagSet" {
 		// There is no tag set associated with the bucket.
 		return []*s3.Tag{}, nil
 	} else if err != nil {
diff --git a/builtin/providers/aws/s3_tags_test.go b/builtin/providers/aws/s3_tags_test.go
index 70c76cf0d..3d4188c5f 100644
--- a/builtin/providers/aws/s3_tags_test.go
+++ b/builtin/providers/aws/s3_tags_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/structure.go b/builtin/providers/aws/structure.go
index 269734aa7..59bc61b14 100644
--- a/builtin/providers/aws/structure.go
+++ b/builtin/providers/aws/structure.go
@@ -1,15 +1,19 @@
 package aws
 
 import (
+	"bytes"
+	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -42,6 +46,64 @@ func expandListeners(configured []interface{}) ([]*elb.Listener, error) {
 	return listeners, nil
 }
 
+// Takes the result of flatmap. Expand for an array of listeners and
+// returns ECS Volume compatible objects
+func expandEcsVolumes(configured []interface{}) ([]*ecs.Volume, error) {
+	volumes := make([]*ecs.Volume, 0, len(configured))
+
+	// Loop over our configured volumes and create
+	// an array of aws-sdk-go compatible objects
+	for _, lRaw := range configured {
+		data := lRaw.(map[string]interface{})
+
+		l := &ecs.Volume{
+			Name: aws.String(data["name"].(string)),
+			Host: &ecs.HostVolumeProperties{
+				SourcePath: aws.String(data["host_path"].(string)),
+			},
+		}
+
+		volumes = append(volumes, l)
+	}
+
+	return volumes, nil
+}
+
+// Takes JSON in a string. Decodes JSON into
+// an array of ecs.ContainerDefinition compatible objects
+func expandEcsContainerDefinitions(rawDefinitions string) ([]*ecs.ContainerDefinition, error) {
+	var definitions []*ecs.ContainerDefinition
+
+	err := json.Unmarshal([]byte(rawDefinitions), &definitions)
+	if err != nil {
+		return nil, fmt.Errorf("Error decoding JSON: %s", err)
+	}
+
+	return definitions, nil
+}
+
+// Takes the result of flatmap. Expand for an array of load balancers and
+// returns ecs.LoadBalancer compatible objects
+func expandEcsLoadBalancers(configured []interface{}) []*ecs.LoadBalancer {
+	loadBalancers := make([]*ecs.LoadBalancer, 0, len(configured))
+
+	// Loop over our configured load balancers and create
+	// an array of aws-sdk-go compatible objects
+	for _, lRaw := range configured {
+		data := lRaw.(map[string]interface{})
+
+		l := &ecs.LoadBalancer{
+			ContainerName:    aws.String(data["container_name"].(string)),
+			ContainerPort:    aws.Long(int64(data["container_port"].(int))),
+			LoadBalancerName: aws.String(data["elb_name"].(string)),
+		}
+
+		loadBalancers = append(loadBalancers, l)
+	}
+
+	return loadBalancers
+}
+
 // Takes the result of flatmap.Expand for an array of ingress/egress security
 // group rules and returns EC2 API compatible objects. This function will error
 // if it finds invalid permissions input, namely a protocol of "-1" with either
@@ -95,12 +157,15 @@ func expandIPPerms(
 
 				perm.UserIDGroupPairs[i] = &ec2.UserIDGroupPair{
 					GroupID: aws.String(id),
-					UserID:  aws.String(ownerId),
 				}
+
+				if ownerId != "" {
+					perm.UserIDGroupPairs[i].UserID = aws.String(ownerId)
+				}
+
 				if !vpc {
 					perm.UserIDGroupPairs[i].GroupID = nil
 					perm.UserIDGroupPairs[i].GroupName = aws.String(id)
-					perm.UserIDGroupPairs[i].UserID = nil
 				}
 			}
 		}
@@ -140,6 +205,27 @@ func expandParameters(configured []interface{}) ([]*rds.Parameter, error) {
 	return parameters, nil
 }
 
+// Takes the result of flatmap.Expand for an array of parameters and
+// returns Parameter API compatible objects
+func expandElastiCacheParameters(configured []interface{}) ([]*elasticache.ParameterNameValue, error) {
+	parameters := make([]*elasticache.ParameterNameValue, 0, len(configured))
+
+	// Loop over our configured parameters and create
+	// an array of aws-sdk-go compatabile objects
+	for _, pRaw := range configured {
+		data := pRaw.(map[string]interface{})
+
+		p := &elasticache.ParameterNameValue{
+			ParameterName:  aws.String(data["name"].(string)),
+			ParameterValue: aws.String(data["value"].(string)),
+		}
+
+		parameters = append(parameters, p)
+	}
+
+	return parameters, nil
+}
+
 // Flattens a health check into something that flatmap.Flatten()
 // can handle
 func flattenHealthCheck(check *elb.HealthCheck) []map[string]interface{} {
@@ -215,6 +301,44 @@ func flattenListeners(list []*elb.ListenerDescription) []map[string]interface{}
 	return result
 }
 
+// Flattens an array of Volumes into a []map[string]interface{}
+func flattenEcsVolumes(list []*ecs.Volume) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, volume := range list {
+		l := map[string]interface{}{
+			"name":      *volume.Name,
+			"host_path": *volume.Host.SourcePath,
+		}
+		result = append(result, l)
+	}
+	return result
+}
+
+// Flattens an array of ECS LoadBalancers into a []map[string]interface{}
+func flattenEcsLoadBalancers(list []*ecs.LoadBalancer) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, loadBalancer := range list {
+		l := map[string]interface{}{
+			"elb_name":       *loadBalancer.LoadBalancerName,
+			"container_name": *loadBalancer.ContainerName,
+			"container_port": *loadBalancer.ContainerPort,
+		}
+		result = append(result, l)
+	}
+	return result
+}
+
+// Encodes an array of ecs.ContainerDefinitions into a JSON string
+func flattenEcsContainerDefinitions(definitions []*ecs.ContainerDefinition) (string, error) {
+	byteArray, err := json.Marshal(definitions)
+	if err != nil {
+		return "", fmt.Errorf("Error encoding to JSON: %s", err)
+	}
+
+	n := bytes.Index(byteArray, []byte{0})
+	return string(byteArray[:n]), nil
+}
+
 // Flattens an array of Parameters into a []map[string]interface{}
 func flattenParameters(list []*rds.Parameter) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, len(list))
@@ -227,6 +351,18 @@ func flattenParameters(list []*rds.Parameter) []map[string]interface{} {
 	return result
 }
 
+// Flattens an array of Parameters into a []map[string]interface{}
+func flattenElastiCacheParameters(list []*elasticache.Parameter) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, i := range list {
+		result = append(result, map[string]interface{}{
+			"name":  strings.ToLower(*i.ParameterName),
+			"value": strings.ToLower(*i.ParameterValue),
+		})
+	}
+	return result
+}
+
 // Takes the result of flatmap.Expand for an array of strings
 // and returns a []string
 func expandStringList(configured []interface{}) []*string {
diff --git a/builtin/providers/aws/structure_test.go b/builtin/providers/aws/structure_test.go
index ace216e6b..64bf8c52c 100644
--- a/builtin/providers/aws/structure_test.go
+++ b/builtin/providers/aws/structure_test.go
@@ -4,11 +4,12 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/flatmap"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -393,6 +394,32 @@ func TestexpandParameters(t *testing.T) {
 	}
 }
 
+func TestexpandElasticacheParameters(t *testing.T) {
+	expanded := []interface{}{
+		map[string]interface{}{
+			"name":         "character_set_client",
+			"value":        "utf8",
+			"apply_method": "immediate",
+		},
+	}
+	parameters, err := expandElastiCacheParameters(expanded)
+	if err != nil {
+		t.Fatalf("bad: %#v", err)
+	}
+
+	expected := &elasticache.Parameter{
+		ParameterName:  aws.String("activerehashing"),
+		ParameterValue: aws.String("yes"),
+	}
+
+	if !reflect.DeepEqual(parameters[0], expected) {
+		t.Fatalf(
+			"Got:\n\n%#v\n\nExpected:\n\n%#v\n",
+			parameters[0],
+			expected)
+	}
+}
+
 func TestflattenParameters(t *testing.T) {
 	cases := []struct {
 		Input  []*rds.Parameter
@@ -422,6 +449,35 @@ func TestflattenParameters(t *testing.T) {
 	}
 }
 
+func TestflattenElasticacheParameters(t *testing.T) {
+	cases := []struct {
+		Input  []*elasticache.Parameter
+		Output []map[string]interface{}
+	}{
+		{
+			Input: []*elasticache.Parameter{
+				&elasticache.Parameter{
+					ParameterName:  aws.String("activerehashing"),
+					ParameterValue: aws.String("yes"),
+				},
+			},
+			Output: []map[string]interface{}{
+				map[string]interface{}{
+					"name":  "activerehashing",
+					"value": "yes",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		output := flattenElastiCacheParameters(tc.Input)
+		if !reflect.DeepEqual(output, tc.Output) {
+			t.Fatalf("Got:\n\n%#v\n\nExpected:\n\n%#v", output, tc.Output)
+		}
+	}
+}
+
 func TestexpandInstanceString(t *testing.T) {
 
 	expected := []*elb.Instance{
diff --git a/builtin/providers/aws/tags.go b/builtin/providers/aws/tags.go
index b3f80819e..3d7aff9b8 100644
--- a/builtin/providers/aws/tags.go
+++ b/builtin/providers/aws/tags.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -19,16 +20,16 @@ func tagsSchema() *schema.Schema {
 
 // setTags is a helper to set the tags for a resource. It expects the
 // tags field to be named "tags"
-func setTagsSDK(conn *ec2.EC2, d *schema.ResourceData) error {
+func setTags(conn *ec2.EC2, d *schema.ResourceData) error {
 	if d.HasChange("tags") {
 		oraw, nraw := d.GetChange("tags")
 		o := oraw.(map[string]interface{})
 		n := nraw.(map[string]interface{})
-		create, remove := diffTagsSDK(tagsFromMapSDK(o), tagsFromMapSDK(n))
+		create, remove := diffTags(tagsFromMap(o), tagsFromMap(n))
 
 		// Set tags
 		if len(remove) > 0 {
-			log.Printf("[DEBUG] Removing tags: %#v", remove)
+			log.Printf("[DEBUG] Removing tags: %#v from %s", remove, d.Id())
 			_, err := conn.DeleteTags(&ec2.DeleteTagsInput{
 				Resources: []*string{aws.String(d.Id())},
 				Tags:      remove,
@@ -38,7 +39,7 @@ func setTagsSDK(conn *ec2.EC2, d *schema.ResourceData) error {
 			}
 		}
 		if len(create) > 0 {
-			log.Printf("[DEBUG] Creating tags: %#v", create)
+			log.Printf("[DEBUG] Creating tags: %s for %s", awsutil.StringValue(create), d.Id())
 			_, err := conn.CreateTags(&ec2.CreateTagsInput{
 				Resources: []*string{aws.String(d.Id())},
 				Tags:      create,
@@ -55,7 +56,7 @@ func setTagsSDK(conn *ec2.EC2, d *schema.ResourceData) error {
 // diffTags takes our tags locally and the ones remotely and returns
 // the set of tags that must be created, and the set of tags that must
 // be destroyed.
-func diffTagsSDK(oldTags, newTags []*ec2.Tag) ([]*ec2.Tag, []*ec2.Tag) {
+func diffTags(oldTags, newTags []*ec2.Tag) ([]*ec2.Tag, []*ec2.Tag) {
 	// First, we're creating everything we have
 	create := make(map[string]interface{})
 	for _, t := range newTags {
@@ -72,11 +73,11 @@ func diffTagsSDK(oldTags, newTags []*ec2.Tag) ([]*ec2.Tag, []*ec2.Tag) {
 		}
 	}
 
-	return tagsFromMapSDK(create), remove
+	return tagsFromMap(create), remove
 }
 
 // tagsFromMap returns the tags for the given map of data.
-func tagsFromMapSDK(m map[string]interface{}) []*ec2.Tag {
+func tagsFromMap(m map[string]interface{}) []*ec2.Tag {
 	result := make([]*ec2.Tag, 0, len(m))
 	for k, v := range m {
 		result = append(result, &ec2.Tag{
@@ -89,7 +90,7 @@ func tagsFromMapSDK(m map[string]interface{}) []*ec2.Tag {
 }
 
 // tagsToMap turns the list of tags into a map.
-func tagsToMapSDK(ts []*ec2.Tag) map[string]string {
+func tagsToMap(ts []*ec2.Tag) map[string]string {
 	result := make(map[string]string)
 	for _, t := range ts {
 		result[*t.Key] = *t.Value
diff --git a/builtin/providers/aws/tagsEC.go b/builtin/providers/aws/tagsEC.go
new file mode 100644
index 000000000..3a5ba1acf
--- /dev/null
+++ b/builtin/providers/aws/tagsEC.go
@@ -0,0 +1,95 @@
+package aws
+
+import (
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// setTags is a helper to set the tags for a resource. It expects the
+// tags field to be named "tags"
+func setTagsEC(conn *elasticache.ElastiCache, d *schema.ResourceData, arn string) error {
+	if d.HasChange("tags") {
+		oraw, nraw := d.GetChange("tags")
+		o := oraw.(map[string]interface{})
+		n := nraw.(map[string]interface{})
+		create, remove := diffTagsEC(tagsFromMapEC(o), tagsFromMapEC(n))
+
+		// Set tags
+		if len(remove) > 0 {
+			log.Printf("[DEBUG] Removing tags: %#v", remove)
+			k := make([]*string, len(remove), len(remove))
+			for i, t := range remove {
+				k[i] = t.Key
+			}
+
+			_, err := conn.RemoveTagsFromResource(&elasticache.RemoveTagsFromResourceInput{
+				ResourceName: aws.String(arn),
+				TagKeys:      k,
+			})
+			if err != nil {
+				return err
+			}
+		}
+		if len(create) > 0 {
+			log.Printf("[DEBUG] Creating tags: %#v", create)
+			_, err := conn.AddTagsToResource(&elasticache.AddTagsToResourceInput{
+				ResourceName: aws.String(arn),
+				Tags:         create,
+			})
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// diffTags takes our tags locally and the ones remotely and returns
+// the set of tags that must be created, and the set of tags that must
+// be destroyed.
+func diffTagsEC(oldTags, newTags []*elasticache.Tag) ([]*elasticache.Tag, []*elasticache.Tag) {
+	// First, we're creating everything we have
+	create := make(map[string]interface{})
+	for _, t := range newTags {
+		create[*t.Key] = *t.Value
+	}
+
+	// Build the list of what to remove
+	var remove []*elasticache.Tag
+	for _, t := range oldTags {
+		old, ok := create[*t.Key]
+		if !ok || old != *t.Value {
+			// Delete it!
+			remove = append(remove, t)
+		}
+	}
+
+	return tagsFromMapEC(create), remove
+}
+
+// tagsFromMap returns the tags for the given map of data.
+func tagsFromMapEC(m map[string]interface{}) []*elasticache.Tag {
+	result := make([]*elasticache.Tag, 0, len(m))
+	for k, v := range m {
+		result = append(result, &elasticache.Tag{
+			Key:   aws.String(k),
+			Value: aws.String(v.(string)),
+		})
+	}
+
+	return result
+}
+
+// tagsToMap turns the list of tags into a map.
+func tagsToMapEC(ts []*elasticache.Tag) map[string]string {
+	result := make(map[string]string)
+	for _, t := range ts {
+		result[*t.Key] = *t.Value
+	}
+
+	return result
+}
diff --git a/builtin/providers/aws/tagsEC_test.go b/builtin/providers/aws/tagsEC_test.go
new file mode 100644
index 000000000..11737ecea
--- /dev/null
+++ b/builtin/providers/aws/tagsEC_test.go
@@ -0,0 +1,85 @@
+package aws
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestDiffelasticacheTags(t *testing.T) {
+	cases := []struct {
+		Old, New       map[string]interface{}
+		Create, Remove map[string]string
+	}{
+		// Basic add/remove
+		{
+			Old: map[string]interface{}{
+				"foo": "bar",
+			},
+			New: map[string]interface{}{
+				"bar": "baz",
+			},
+			Create: map[string]string{
+				"bar": "baz",
+			},
+			Remove: map[string]string{
+				"foo": "bar",
+			},
+		},
+
+		// Modify
+		{
+			Old: map[string]interface{}{
+				"foo": "bar",
+			},
+			New: map[string]interface{}{
+				"foo": "baz",
+			},
+			Create: map[string]string{
+				"foo": "baz",
+			},
+			Remove: map[string]string{
+				"foo": "bar",
+			},
+		},
+	}
+
+	for i, tc := range cases {
+		c, r := diffTagsEC(tagsFromMapEC(tc.Old), tagsFromMapEC(tc.New))
+		cm := tagsToMapEC(c)
+		rm := tagsToMapEC(r)
+		if !reflect.DeepEqual(cm, tc.Create) {
+			t.Fatalf("%d: bad create: %#v", i, cm)
+		}
+		if !reflect.DeepEqual(rm, tc.Remove) {
+			t.Fatalf("%d: bad remove: %#v", i, rm)
+		}
+	}
+}
+
+// testAccCheckTags can be used to check the tags on a resource.
+func testAccCheckelasticacheTags(
+	ts []*elasticache.Tag, key string, value string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		m := tagsToMapEC(ts)
+		v, ok := m[key]
+		if value != "" && !ok {
+			return fmt.Errorf("Missing tag: %s", key)
+		} else if value == "" && ok {
+			return fmt.Errorf("Extra tag: %s", key)
+		}
+		if value == "" {
+			return nil
+		}
+
+		if v != value {
+			return fmt.Errorf("%s: bad value: %s", key, v)
+		}
+
+		return nil
+	}
+}
diff --git a/builtin/providers/aws/tagsELB.go b/builtin/providers/aws/tagsELB.go
index 0513848cc..1b1a93488 100644
--- a/builtin/providers/aws/tagsELB.go
+++ b/builtin/providers/aws/tagsELB.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/tagsELB_test.go b/builtin/providers/aws/tagsELB_test.go
index b2078a8d9..9ec6dd8db 100644
--- a/builtin/providers/aws/tagsELB_test.go
+++ b/builtin/providers/aws/tagsELB_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tagsRDS.go b/builtin/providers/aws/tagsRDS.go
index 0a1a39670..3e4e0c700 100644
--- a/builtin/providers/aws/tagsRDS.go
+++ b/builtin/providers/aws/tagsRDS.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/tagsRDS_test.go b/builtin/providers/aws/tagsRDS_test.go
index 764f23e23..2aa0a05b3 100644
--- a/builtin/providers/aws/tagsRDS_test.go
+++ b/builtin/providers/aws/tagsRDS_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tags_route53.go b/builtin/providers/aws/tags_route53.go
index 66936d1f9..864ce3350 100644
--- a/builtin/providers/aws/tags_route53.go
+++ b/builtin/providers/aws/tags_route53.go
@@ -3,14 +3,14 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
 // setTags is a helper to set the tags for a resource. It expects the
 // tags field to be named "tags"
-func setTagsR53(conn *route53.Route53, d *schema.ResourceData) error {
+func setTagsR53(conn *route53.Route53, d *schema.ResourceData, resourceType string) error {
 	if d.HasChange("tags") {
 		oraw, nraw := d.GetChange("tags")
 		o := oraw.(map[string]interface{})
@@ -25,7 +25,7 @@ func setTagsR53(conn *route53.Route53, d *schema.ResourceData) error {
 		log.Printf("[DEBUG] Changing tags: \n\tadding: %#v\n\tremoving:%#v", create, remove)
 		req := &route53.ChangeTagsForResourceInput{
 			ResourceID:   aws.String(d.Id()),
-			ResourceType: aws.String("hostedzone"),
+			ResourceType: aws.String(resourceType),
 		}
 
 		if len(create) > 0 {
diff --git a/builtin/providers/aws/tags_route53_test.go b/builtin/providers/aws/tags_route53_test.go
index 428629076..a0b2c6410 100644
--- a/builtin/providers/aws/tags_route53_test.go
+++ b/builtin/providers/aws/tags_route53_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tags_test.go b/builtin/providers/aws/tags_test.go
index 272957f6b..8aac147fc 100644
--- a/builtin/providers/aws/tags_test.go
+++ b/builtin/providers/aws/tags_test.go
@@ -5,12 +5,12 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestDiffTagsSDK(t *testing.T) {
+func TestDiffTags(t *testing.T) {
 	cases := []struct {
 		Old, New       map[string]interface{}
 		Create, Remove map[string]string
@@ -49,9 +49,9 @@ func TestDiffTagsSDK(t *testing.T) {
 	}
 
 	for i, tc := range cases {
-		c, r := diffTagsSDK(tagsFromMapSDK(tc.Old), tagsFromMapSDK(tc.New))
-		cm := tagsToMapSDK(c)
-		rm := tagsToMapSDK(r)
+		c, r := diffTags(tagsFromMap(tc.Old), tagsFromMap(tc.New))
+		cm := tagsToMap(c)
+		rm := tagsToMap(r)
 		if !reflect.DeepEqual(cm, tc.Create) {
 			t.Fatalf("%d: bad create: %#v", i, cm)
 		}
@@ -62,10 +62,10 @@ func TestDiffTagsSDK(t *testing.T) {
 }
 
 // testAccCheckTags can be used to check the tags on a resource.
-func testAccCheckTagsSDK(
+func testAccCheckTags(
 	ts *[]*ec2.Tag, key string, value string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		m := tagsToMapSDK(*ts)
+		m := tagsToMap(*ts)
 		v, ok := m[key]
 		if value != "" && !ok {
 			return fmt.Errorf("Missing tag: %s", key)
diff --git a/builtin/providers/aws/test-fixtures/lambdatest.zip b/builtin/providers/aws/test-fixtures/lambdatest.zip
new file mode 100644
index 000000000..5c636e955
Binary files /dev/null and b/builtin/providers/aws/test-fixtures/lambdatest.zip differ
diff --git a/builtin/providers/aws/website_endpoint_url_test.go b/builtin/providers/aws/website_endpoint_url_test.go
index 38b11d329..2f4ce5249 100644
--- a/builtin/providers/aws/website_endpoint_url_test.go
+++ b/builtin/providers/aws/website_endpoint_url_test.go
@@ -2,16 +2,27 @@ package aws
 
 import "testing"
 
-func TestWebsiteEndpointUrl_withoutRegion(t *testing.T) {
-	u := WebsiteEndpointUrl("buck.et", "")
-	if u != "buck.et.s3-website-us-east-1.amazonaws.com" {
-		t.Fatalf("bad: %s", u)
-	}
+// http://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteEndpoints.html
+var websiteEndpoints = []struct {
+	in  string
+	out string
+}{
+	{"", "bucket-name.s3-website-us-east-1.amazonaws.com"},
+	{"us-west-2", "bucket-name.s3-website-us-west-2.amazonaws.com"},
+	{"us-west-1", "bucket-name.s3-website-us-west-1.amazonaws.com"},
+	{"eu-west-1", "bucket-name.s3-website-eu-west-1.amazonaws.com"},
+	{"eu-central-1", "bucket-name.s3-website.eu-central-1.amazonaws.com"},
+	{"ap-southeast-1", "bucket-name.s3-website-ap-southeast-1.amazonaws.com"},
+	{"ap-northeast-1", "bucket-name.s3-website-ap-northeast-1.amazonaws.com"},
+	{"ap-southeast-2", "bucket-name.s3-website-ap-southeast-2.amazonaws.com"},
+	{"sa-east-1", "bucket-name.s3-website-sa-east-1.amazonaws.com"},
 }
 
-func TestWebsiteEndpointUrl_withRegion(t *testing.T) {
-	u := WebsiteEndpointUrl("buck.et", "us-west-1")
-	if u != "buck.et.s3-website-us-west-1.amazonaws.com" {
-		t.Fatalf("bad: %s", u)
+func TestWebsiteEndpointUrl(t *testing.T) {
+	for _, tt := range websiteEndpoints {
+		s := WebsiteEndpointUrl("bucket-name", tt.in)
+		if s != tt.out {
+			t.Errorf("WebsiteEndpointUrl(\"bucket-name\", %q) => %q, want %q", tt.in, s, tt.out)
+		}
 	}
 }
diff --git a/builtin/providers/azure/config.go b/builtin/providers/azure/config.go
new file mode 100644
index 000000000..fff31853d
--- /dev/null
+++ b/builtin/providers/azure/config.go
@@ -0,0 +1,149 @@
+package azure
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/affinitygroup"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/Azure/azure-sdk-for-go/management/osimage"
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/Azure/azure-sdk-for-go/management/storageservice"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachineimage"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/Azure/azure-sdk-for-go/storage"
+)
+
+// Config is the configuration structure used to instantiate a
+// new Azure management client.
+type Config struct {
+	SettingsFile   string
+	SubscriptionID string
+	Certificate    []byte
+	ManagementURL  string
+}
+
+// Client contains all the handles required for managing Azure services.
+type Client struct {
+	mgmtClient management.Client
+
+	affinityGroupClient affinitygroup.AffinityGroupClient
+
+	hostedServiceClient hostedservice.HostedServiceClient
+
+	secGroupClient networksecuritygroup.SecurityGroupClient
+
+	osImageClient osimage.OSImageClient
+
+	sqlClient sql.SQLDatabaseClient
+
+	storageServiceClient storageservice.StorageServiceClient
+
+	vmClient virtualmachine.VirtualMachineClient
+
+	vmDiskClient virtualmachinedisk.DiskClient
+
+	vmImageClient virtualmachineimage.Client
+
+	// unfortunately; because of how Azure's network API works; doing networking operations
+	// concurrently is very hazardous, and we need a mutex to guard the VirtualNetworkClient.
+	vnetClient virtualnetwork.VirtualNetworkClient
+	mutex      *sync.Mutex
+}
+
+// getStorageClientForStorageService is helper method which returns the
+// storage.Client associated to the given storage service name.
+func (c Client) getStorageClientForStorageService(serviceName string) (storage.Client, error) {
+	var storageClient storage.Client
+
+	keys, err := c.storageServiceClient.GetStorageServiceKeys(serviceName)
+	if err != nil {
+		return storageClient, fmt.Errorf("Failed getting Storage Service keys for %s: %s", serviceName, err)
+	}
+
+	storageClient, err = storage.NewBasicClient(serviceName, keys.PrimaryKey)
+	if err != nil {
+		return storageClient, fmt.Errorf("Failed creating Storage Service client for %s: %s", serviceName, err)
+	}
+
+	return storageClient, err
+}
+
+// getStorageServiceBlobClient is a helper method which returns the
+// storage.BlobStorageClient associated to the given storage service name.
+func (c Client) getStorageServiceBlobClient(serviceName string) (storage.BlobStorageClient, error) {
+	storageClient, err := c.getStorageClientForStorageService(serviceName)
+	if err != nil {
+		return storage.BlobStorageClient{}, err
+	}
+
+	return storageClient.GetBlobService(), nil
+}
+
+// getStorageServiceQueueClient is a helper method which returns the
+// storage.QueueServiceClient associated to the given storage service name.
+func (c Client) getStorageServiceQueueClient(serviceName string) (storage.QueueServiceClient, error) {
+	storageClient, err := c.getStorageClientForStorageService(serviceName)
+	if err != nil {
+		return storage.QueueServiceClient{}, err
+	}
+
+	return storageClient.GetQueueService(), err
+}
+
+// NewClientFromSettingsFile returns a new Azure management
+// client created using a publish settings file.
+func (c *Config) NewClientFromSettingsFile() (*Client, error) {
+	if _, err := os.Stat(c.SettingsFile); os.IsNotExist(err) {
+		return nil, fmt.Errorf("Publish Settings file %q does not exist!", c.SettingsFile)
+	}
+
+	mc, err := management.ClientFromPublishSettingsFile(c.SettingsFile, c.SubscriptionID)
+	if err != nil {
+		return nil, nil
+	}
+
+	return &Client{
+		mgmtClient:           mc,
+		affinityGroupClient:  affinitygroup.NewClient(mc),
+		hostedServiceClient:  hostedservice.NewClient(mc),
+		secGroupClient:       networksecuritygroup.NewClient(mc),
+		osImageClient:        osimage.NewClient(mc),
+		sqlClient:            sql.NewClient(mc),
+		storageServiceClient: storageservice.NewClient(mc),
+		vmClient:             virtualmachine.NewClient(mc),
+		vmDiskClient:         virtualmachinedisk.NewClient(mc),
+		vmImageClient:        virtualmachineimage.NewClient(mc),
+		vnetClient:           virtualnetwork.NewClient(mc),
+		mutex:                &sync.Mutex{},
+	}, nil
+}
+
+// NewClient returns a new Azure management client created
+// using a subscription ID and certificate.
+func (c *Config) NewClient() (*Client, error) {
+	mc, err := management.NewClient(c.SubscriptionID, c.Certificate)
+	if err != nil {
+		return nil, nil
+	}
+
+	return &Client{
+		mgmtClient:           mc,
+		affinityGroupClient:  affinitygroup.NewClient(mc),
+		hostedServiceClient:  hostedservice.NewClient(mc),
+		secGroupClient:       networksecuritygroup.NewClient(mc),
+		osImageClient:        osimage.NewClient(mc),
+		sqlClient:            sql.NewClient(mc),
+		storageServiceClient: storageservice.NewClient(mc),
+		vmClient:             virtualmachine.NewClient(mc),
+		vmDiskClient:         virtualmachinedisk.NewClient(mc),
+		vmImageClient:        virtualmachineimage.NewClient(mc),
+		vnetClient:           virtualnetwork.NewClient(mc),
+		mutex:                &sync.Mutex{},
+	}, nil
+}
diff --git a/builtin/providers/azure/constants.go b/builtin/providers/azure/constants.go
new file mode 100644
index 000000000..55264f969
--- /dev/null
+++ b/builtin/providers/azure/constants.go
@@ -0,0 +1,48 @@
+package azure
+
+const (
+	// terraformAzureLabel is used as the label for the hosted service created
+	// by Terraform on Azure.
+	terraformAzureLabel = "terraform-on-azure"
+
+	// terraformAzureDescription is the description used for the hosted service
+	// created by Terraform on Azure.
+	terraformAzureDescription = "Hosted service automatically created by terraform."
+)
+
+// parameterDescriptions holds a list of descriptions for all the available
+// parameters of an Azure configuration.
+var parameterDescriptions = map[string]string{
+	// provider descriptions:
+	"management_url": "The URL of the management API all requests should be sent to.\n" +
+		"Defaults to 'https://management.core.windows.net/', which is the default Azure API URL.\n" +
+		"This should be filled in only if you have your own datacenter with its own hosted management API.",
+	"management_certificate": "The certificate for connecting to the management API specified with 'management_url'",
+	"subscription_id":        "The subscription ID to be used when connecting to the management API.",
+	"publish_settings_file":  "The publish settings file, either created by you or downloaded from 'https://manage.windowsazure.com/publishsettings'",
+	// general resource descriptions:
+	"name":         "Name of the resource to be created as it will appear in the Azure dashboard.",
+	"service_name": "Name of the hosted service within Azure. Will have a DNS entry as dns-name.cloudapp.net",
+	"location": "The Azure location where the resource will be located.\n" +
+		"A list of Azure locations can be found here: http://azure.microsoft.com/en-us/regions/",
+	"reverse_dns_fqdn": "The reverse of the fully qualified domain name. Optional.",
+	"label":            "Label by which the resource will be identified by. Optional.",
+	"description":      "Brief description of the resource. Optional.",
+	// hosted service descriptions:
+	"ephemeral_contents": "Sets whether the associated contents of this resource should also be\n" +
+		"deleted upon this resource's deletion. Default is false.",
+	// instance descriptions:
+	"image":                          "The image the new VM will be booted from. Mandatory.",
+	"size":                           "The size in GB of the disk to be created. Mandatory.",
+	"os_type":                        "The OS type of the VM. Either Windows or Linux. Mandatory.",
+	"storage_account":                "The storage account (pool) name. Mandatory.",
+	"storage_container":              "The storage container name from the storage pool given with 'storage_pool'.",
+	"user_name":                      "The user name to be configured on the new VM.",
+	"user_password":                  "The user password to be configured on the new VM.",
+	"default_certificate_thumbprint": "The thumbprint of the WinRM Certificate to be used as a default.",
+	// local network descriptions:
+	"vpn_gateway_address":    "The IP address of the VPN gateway bridged through this virtual network.",
+	"address_space_prefixes": "List of address space prefixes in the format '<IP>/netmask'",
+	// dns descriptions:
+	"dns_address": "Address of the DNS server. Required.",
+}
diff --git a/builtin/providers/azure/provider.go b/builtin/providers/azure/provider.go
new file mode 100644
index 000000000..2c44b54f6
--- /dev/null
+++ b/builtin/providers/azure/provider.go
@@ -0,0 +1,80 @@
+package azure
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/mitchellh/go-homedir"
+)
+
+// Provider returns a terraform.ResourceProvider.
+func Provider() terraform.ResourceProvider {
+	return &schema.Provider{
+		Schema: map[string]*schema.Schema{
+			"settings_file": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_SETTINGS_FILE", nil),
+			},
+
+			"subscription_id": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_SUBSCRIPTION_ID", ""),
+			},
+
+			"certificate": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_CERTIFICATE", ""),
+			},
+		},
+
+		ResourcesMap: map[string]*schema.Resource{
+			"azure_instance":                          resourceAzureInstance(),
+			"azure_affinity_group":                    resourceAzureAffinityGroup(),
+			"azure_data_disk":                         resourceAzureDataDisk(),
+			"azure_sql_database_server":               resourceAzureSqlDatabaseServer(),
+			"azure_sql_database_server_firewall_rule": resourceAzureSqlDatabaseServerFirewallRule(),
+			"azure_sql_database_service":              resourceAzureSqlDatabaseService(),
+			"azure_hosted_service":                    resourceAzureHostedService(),
+			"azure_storage_service":                   resourceAzureStorageService(),
+			"azure_storage_container":                 resourceAzureStorageContainer(),
+			"azure_storage_blob":                      resourceAzureStorageBlob(),
+			"azure_storage_queue":                     resourceAzureStorageQueue(),
+			"azure_virtual_network":                   resourceAzureVirtualNetwork(),
+			"azure_dns_server":                        resourceAzureDnsServer(),
+			"azure_local_network_connection":          resourceAzureLocalNetworkConnection(),
+			"azure_security_group":                    resourceAzureSecurityGroup(),
+			"azure_security_group_rule":               resourceAzureSecurityGroupRule(),
+		},
+
+		ConfigureFunc: providerConfigure,
+	}
+}
+
+func providerConfigure(d *schema.ResourceData) (interface{}, error) {
+	settingsFile, err := homedir.Expand(d.Get("settings_file").(string))
+	if err != nil {
+		return nil, fmt.Errorf("Error expanding the settings file path: %s", err)
+	}
+
+	config := Config{
+		SettingsFile:   settingsFile,
+		SubscriptionID: d.Get("subscription_id").(string),
+		Certificate:    []byte(d.Get("certificate").(string)),
+	}
+
+	if config.SettingsFile != "" {
+		return config.NewClientFromSettingsFile()
+	}
+
+	if config.SubscriptionID != "" && len(config.Certificate) > 0 {
+		return config.NewClient()
+	}
+
+	return nil, fmt.Errorf(
+		"Insufficient configuration data. Please specify either a 'settings_file'\n" +
+			"or both a 'subscription_id' and 'certificate'.")
+}
diff --git a/builtin/providers/azure/provider_test.go b/builtin/providers/azure/provider_test.go
new file mode 100644
index 000000000..3d5ec342c
--- /dev/null
+++ b/builtin/providers/azure/provider_test.go
@@ -0,0 +1,60 @@
+package azure
+
+import (
+	"os"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+var testAccProviders map[string]terraform.ResourceProvider
+var testAccProvider *schema.Provider
+
+const (
+	testAccSecurityGroupName = "terraform-security-group"
+	testAccHostedServiceName = "terraform-testing-service"
+)
+
+// testAccStorageServiceName is used as the name for the Storage Service
+// created in all storage-related tests.
+// It is much more convenient to provide a Storage Service which
+// has been created beforehand as the creation of one takes a lot
+// and would greatly impede the multitude of tests which rely on one.
+// NOTE: the storage container should be located in `West US`.
+var testAccStorageServiceName = os.Getenv("AZURE_STORAGE")
+
+const testAccStorageContainerName = "terraform-testing-container"
+
+func init() {
+	testAccProvider = Provider().(*schema.Provider)
+	testAccProviders = map[string]terraform.ResourceProvider{
+		"azure": testAccProvider,
+	}
+}
+
+func TestProvider(t *testing.T) {
+	if err := Provider().(*schema.Provider).InternalValidate(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestProvider_impl(t *testing.T) {
+	var _ terraform.ResourceProvider = Provider()
+}
+
+func testAccPreCheck(t *testing.T) {
+	if v := os.Getenv("AZURE_SETTINGS_FILE"); v == "" {
+		subscriptionID := os.Getenv("AZURE_SUBSCRIPTION_ID")
+		certificate := os.Getenv("AZURE_CERTIFICATE")
+
+		if subscriptionID == "" || certificate == "" {
+			t.Fatal("either AZURE_SETTINGS_FILE, or AZURE_SUBSCRIPTION_ID " +
+				"and AZURE_CERTIFICATE must be set for acceptance tests")
+		}
+	}
+
+	if v := os.Getenv("AZURE_STORAGE"); v == "" {
+		t.Fatal("AZURE_STORAGE must be set for acceptance tests")
+	}
+}
diff --git a/builtin/providers/azure/resource_azure_affinity_group.go b/builtin/providers/azure/resource_azure_affinity_group.go
new file mode 100644
index 000000000..5dd5bced4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_affinity_group.go
@@ -0,0 +1,168 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/affinitygroup"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureAffinityGroup returns the *schema.Resource associated to a
+// resource affinity group on Azure.
+func resourceAzureAffinityGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureAffinityGroupCreate,
+		Read:   resourceAzureAffinityGroupRead,
+		Update: resourceAzureAffinityGroupUpdate,
+		Exists: resourceAzureAffinityGroupExists,
+		Delete: resourceAzureAffinityGroupDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+		},
+	}
+}
+
+// resourceAzureAffinityGroupCreate does all the necessary API calls to
+// create an affinity group on Azure.
+func resourceAzureAffinityGroupCreate(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Begun creating Azure Affinity Group creation request.")
+	name := d.Get("name").(string)
+	params := affinitygroup.CreateAffinityGroupParams{
+		Name:     name,
+		Label:    d.Get("label").(string),
+		Location: d.Get("location").(string),
+	}
+
+	if desc, ok := d.GetOk("description"); ok {
+		params.Description = desc.(string)
+	}
+
+	log.Println("[INFO] Sending Affinity Group creation request to Azure.")
+	err := affinityGroupClient.CreateAffinityGroup(params)
+	if err != nil {
+		return fmt.Errorf("Error issuing Azure Affinity Group creation: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureAffinityGroupRead does all the necessary API calls to
+// read the state of the affinity group off Azure.
+func resourceAzureAffinityGroupRead(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Issuing Azure Affinity Group list request.")
+	affinityGroups, err := affinityGroupClient.ListAffinityGroups()
+	if err != nil {
+		return fmt.Errorf("Error obtaining Affinity Group list off Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+	for _, group := range affinityGroups.AffinityGroups {
+		if group.Name == name {
+			found = true
+			d.Set("location", group.Location)
+			d.Set("label", group.Label)
+			d.Set("description", group.Description)
+			break
+		}
+	}
+
+	if !found {
+		// it means the affinity group has been deleted in the meantime, so we
+		// must stop tracking it:
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureAffinityGroupUpdate does all the necessary API calls to
+// update the state of the affinity group on Azure.
+func resourceAzureAffinityGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	name := d.Get("name").(string)
+	clabel := d.HasChange("label")
+	cdesc := d.HasChange("description")
+	if clabel || cdesc {
+		log.Println("[INFO] Beginning Affinity Group update process.")
+		params := affinitygroup.UpdateAffinityGroupParams{}
+
+		if clabel {
+			params.Label = d.Get("label").(string)
+		}
+		if cdesc {
+			params.Description = d.Get("description").(string)
+		}
+
+		log.Println("[INFO] Sending Affinity Group update request to Azure.")
+		err := affinityGroupClient.UpdateAffinityGroup(name, params)
+		if err != nil {
+			return fmt.Errorf("Error updating Azure Affinity Group parameters: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureAffinityGroupExists does all the necessary API calls to
+// check for the existence of the affinity group on Azure.
+func resourceAzureAffinityGroupExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Issuing Azure Affinity Group get request.")
+	name := d.Get("name").(string)
+	_, err := affinityGroupClient.GetAffinityGroup(name)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// it means that the affinity group has been deleted in the
+			// meantime, so we must untrack it from the schema:
+			d.SetId("")
+			return false, nil
+		} else {
+			return false, fmt.Errorf("Error getting Affinity Group off Azure: %s", err)
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureAffinityGroupDelete does all the necessary API calls to
+// delete the affinity group off Azure.
+func resourceAzureAffinityGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Sending Affinity Group deletion request to Azure.")
+	name := d.Get("name").(string)
+	err := affinityGroupClient.DeleteAffinityGroup(name)
+	if err != nil {
+		return fmt.Errorf("Error deleting Azure Affinity Group: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_affinity_group_test.go b/builtin/providers/azure/resource_azure_affinity_group_test.go
new file mode 100644
index 000000000..1cc5211c4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_affinity_group_test.go
@@ -0,0 +1,121 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureAffinityGroupBasic(t *testing.T) {
+	name := "azure_affinity_group.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureAffinityGroupDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "A nice label."),
+					resource.TestCheckResourceAttr(name, "description", "A nice description."),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureAffinityGroupUpdate(t *testing.T) {
+	name := "azure_affinity_group.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureAffinityGroupDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "A nice label."),
+					resource.TestCheckResourceAttr(name, "description", "A nice description."),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "An even nicer label."),
+					resource.TestCheckResourceAttr(name, "description", "An even nicer description."),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureAffinityGroupExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Affinity Group resource %q doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Affinity Group resource %q ID not set.", name)
+		}
+
+		affinityGroupClient := testAccProvider.Meta().(*Client).affinityGroupClient
+		_, err := affinityGroupClient.GetAffinityGroup(resource.Primary.ID)
+		return err
+	}
+}
+
+func testAccCheckAzureAffinityGroupDestroyed(s *terraform.State) error {
+	var err error
+	affinityGroupClient := testAccProvider.Meta().(*Client).affinityGroupClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_affinity_group" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Affinity Group resource ID not set.")
+		}
+
+		_, err = affinityGroupClient.GetAffinityGroup(resource.Primary.ID)
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureAffinityGroupConfig = `
+resource "azure_affinity_group" "foo" {
+	name = "terraform-testing-group"
+	location = "West US"
+	label = "A nice label."
+	description = "A nice description."
+}
+`
+
+const testAccAzureAffinityGroupUpdateConfig = `
+resource "azure_affinity_group" "foo" {
+	name = "terraform-testing-group"
+	location = "West US"
+	label = "An even nicer label."
+	description = "An even nicer description."
+}
+`
diff --git a/builtin/providers/azure/resource_azure_data_disk.go b/builtin/providers/azure/resource_azure_data_disk.go
new file mode 100644
index 000000000..6e48b976a
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_data_disk.go
@@ -0,0 +1,343 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const dataDiskBlobStorageURL = "http://%s.blob.core.windows.net/disks/%s.vhd"
+
+func resourceAzureDataDisk() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureDataDiskCreate,
+		Read:   resourceAzureDataDiskRead,
+		Update: resourceAzureDataDiskUpdate,
+		Delete: resourceAzureDataDiskDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"lun": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+
+			"size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"caching": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "None",
+			},
+
+			"storage_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"media_link": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"source_media_link": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"virtual_machine": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAzureDataDiskCreate(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	if err := verifyDataDiskParameters(d); err != nil {
+		return err
+	}
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	label := d.Get("label").(string)
+	if label == "" {
+		label = fmt.Sprintf("%s-%d", vm, lun)
+	}
+
+	p := virtualmachinedisk.CreateDataDiskParameters{
+		DiskLabel:           label,
+		Lun:                 lun,
+		LogicalDiskSizeInGB: d.Get("size").(int),
+		HostCaching:         hostCaching(d),
+		MediaLink:           mediaLink(d),
+		SourceMediaLink:     d.Get("source_media_link").(string),
+	}
+
+	if name, ok := d.GetOk("name"); ok {
+		p.DiskName = name.(string)
+	}
+
+	log.Printf("[DEBUG] Adding data disk %d to instance: %s", lun, vm)
+	req, err := vmDiskClient.AddDataDisk(vm, vm, vm, p)
+	if err != nil {
+		return fmt.Errorf("Error adding data disk %d to instance %s: %s", lun, vm, err)
+	}
+
+	// Wait until the data disk is added
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for data disk %d to be added to instance %s: %s", lun, vm, err)
+	}
+
+	log.Printf("[DEBUG] Retrieving data disk %d from instance %s", lun, vm)
+	disk, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+	if err != nil {
+		return fmt.Errorf("Error retrieving data disk %d from instance %s: %s", lun, vm, err)
+	}
+
+	d.SetId(disk.DiskName)
+
+	return resourceAzureDataDiskRead(d, meta)
+}
+
+func resourceAzureDataDiskRead(d *schema.ResourceData, meta interface{}) error {
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	log.Printf("[DEBUG] Retrieving data disk: %s", d.Id())
+	datadisk, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving data disk %s: %s", d.Id(), err)
+	}
+
+	d.Set("name", datadisk.DiskName)
+	d.Set("label", datadisk.DiskLabel)
+	d.Set("lun", datadisk.Lun)
+	d.Set("size", datadisk.LogicalDiskSizeInGB)
+	d.Set("caching", datadisk.HostCaching)
+	d.Set("media_link", datadisk.MediaLink)
+
+	log.Printf("[DEBUG] Retrieving disk: %s", d.Id())
+	disk, err := vmDiskClient.GetDisk(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error retrieving disk %s: %s", d.Id(), err)
+	}
+
+	d.Set("virtual_machine", disk.AttachedTo.RoleName)
+
+	return nil
+}
+
+func resourceAzureDataDiskUpdate(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	if d.HasChange("lun") || d.HasChange("size") || d.HasChange("virtual_machine") {
+		olun, _ := d.GetChange("lun")
+		ovm, _ := d.GetChange("virtual_machine")
+
+		log.Printf("[DEBUG] Detaching data disk: %s", d.Id())
+		req, err := vmDiskClient.
+			DeleteDataDisk(ovm.(string), ovm.(string), ovm.(string), olun.(int), false)
+		if err != nil {
+			return fmt.Errorf("Error detaching data disk %s: %s", d.Id(), err)
+		}
+
+		// Wait until the data disk is detached
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be detached: %s", d.Id(), err)
+		}
+
+		log.Printf("[DEBUG] Verifying data disk %s is properly detached...", d.Id())
+		for i := 0; i < 6; i++ {
+			disk, err := vmDiskClient.GetDisk(d.Id())
+			if err != nil {
+				return fmt.Errorf("Error retrieving disk %s: %s", d.Id(), err)
+			}
+
+			// Check if the disk is really detached
+			if disk.AttachedTo.RoleName == "" {
+				break
+			}
+
+			// If not, wait 30 seconds and try it again...
+			time.Sleep(time.Duration(30 * time.Second))
+		}
+
+		if d.HasChange("size") {
+			p := virtualmachinedisk.UpdateDiskParameters{
+				Name:            d.Id(),
+				Label:           d.Get("label").(string),
+				ResizedSizeInGB: d.Get("size").(int),
+			}
+
+			log.Printf("[DEBUG] Updating disk: %s", d.Id())
+			req, err := vmDiskClient.UpdateDisk(d.Id(), p)
+			if err != nil {
+				return fmt.Errorf("Error updating disk %s: %s", d.Id(), err)
+			}
+
+			// Wait until the disk is updated
+			if err := mc.WaitForOperation(req, nil); err != nil {
+				return fmt.Errorf(
+					"Error waiting for disk %s to be updated: %s", d.Id(), err)
+			}
+		}
+
+		p := virtualmachinedisk.CreateDataDiskParameters{
+			DiskName:    d.Id(),
+			Lun:         lun,
+			HostCaching: hostCaching(d),
+			MediaLink:   mediaLink(d),
+		}
+
+		log.Printf("[DEBUG] Attaching data disk: %s", d.Id())
+		req, err = vmDiskClient.AddDataDisk(vm, vm, vm, p)
+		if err != nil {
+			return fmt.Errorf("Error attaching data disk %s to instance %s: %s", d.Id(), vm, err)
+		}
+
+		// Wait until the data disk is attached
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be attached to instance %s: %s", d.Id(), vm, err)
+		}
+
+		// Make sure we return here since all possible changes are
+		// already updated if we reach this point
+		return nil
+	}
+
+	if d.HasChange("caching") {
+		p := virtualmachinedisk.UpdateDataDiskParameters{
+			DiskName:    d.Id(),
+			Lun:         lun,
+			HostCaching: hostCaching(d),
+			MediaLink:   mediaLink(d),
+		}
+
+		log.Printf("[DEBUG] Updating data disk: %s", d.Id())
+		req, err := vmDiskClient.UpdateDataDisk(vm, vm, vm, lun, p)
+		if err != nil {
+			return fmt.Errorf("Error updating data disk %s: %s", d.Id(), err)
+		}
+
+		// Wait until the data disk is updated
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be updated: %s", d.Id(), err)
+		}
+	}
+
+	return resourceAzureDataDiskRead(d, meta)
+}
+
+func resourceAzureDataDiskDelete(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	// If a name was not supplied, it means we created a new emtpy disk and we now want to
+	// delete that disk again. Otherwise we only want to detach the disk and keep the blob.
+	_, removeBlob := d.GetOk("name")
+
+	log.Printf("[DEBUG] Detaching data disk %s with removeBlob = %t", d.Id(), removeBlob)
+	req, err := vmDiskClient.DeleteDataDisk(vm, vm, vm, lun, removeBlob)
+	if err != nil {
+		return fmt.Errorf(
+			"Error detaching data disk %s with removeBlob = %t: %s", d.Id(), removeBlob, err)
+	}
+
+	// Wait until the data disk is detached and optionally deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for data disk %s to be detached with removeBlob = %t: %s",
+			d.Id(), removeBlob, err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+func hostCaching(d *schema.ResourceData) virtualmachinedisk.HostCachingType {
+	switch d.Get("caching").(string) {
+	case "ReadOnly":
+		return virtualmachinedisk.HostCachingTypeReadOnly
+	case "ReadWrite":
+		return virtualmachinedisk.HostCachingTypeReadWrite
+	default:
+		return virtualmachinedisk.HostCachingTypeNone
+	}
+}
+
+func mediaLink(d *schema.ResourceData) string {
+	mediaLink, ok := d.GetOk("media_link")
+	if ok {
+		return mediaLink.(string)
+	}
+
+	name, ok := d.GetOk("name")
+	if !ok {
+		name = fmt.Sprintf("%s-%d", d.Get("virtual_machine").(string), d.Get("lun").(int))
+	}
+
+	return fmt.Sprintf(dataDiskBlobStorageURL, d.Get("storage_service_name").(string), name.(string))
+}
+
+func verifyDataDiskParameters(d *schema.ResourceData) error {
+	caching := d.Get("caching").(string)
+	if caching != "None" && caching != "ReadOnly" && caching != "ReadWrite" {
+		return fmt.Errorf(
+			"Invalid caching type %s! Valid options are 'None', 'ReadOnly' and 'ReadWrite'.", caching)
+	}
+
+	if _, ok := d.GetOk("media_link"); !ok {
+		if _, ok := d.GetOk("storage_service_name"); !ok {
+			return fmt.Errorf("If not supplying 'media_link', you must supply 'storage'.")
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_data_disk_test.go b/builtin/providers/azure/resource_azure_data_disk_test.go
new file mode 100644
index 000000000..dfad26b5e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_data_disk_test.go
@@ -0,0 +1,235 @@
+package azure
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureDataDisk_basic(t *testing.T) {
+	var disk virtualmachinedisk.DataDiskResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDataDiskDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDataDisk_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					testAccCheckAzureDataDiskAttributes(&disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test-0"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "10"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureDataDisk_update(t *testing.T) {
+	var disk virtualmachinedisk.DataDiskResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDataDiskDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDataDisk_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test1-1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "lun", "1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "10"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "caching", "ReadOnly"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "virtual_machine", "terraform-test1"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureDataDisk_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test1-1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "lun", "2"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "20"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "caching", "ReadWrite"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "virtual_machine", "terraform-test2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureDataDiskExists(
+	n string,
+	disk *virtualmachinedisk.DataDiskResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Data Disk ID is set")
+		}
+
+		vm := rs.Primary.Attributes["virtual_machine"]
+		lun, err := strconv.Atoi(rs.Primary.Attributes["lun"])
+		if err != nil {
+			return err
+		}
+
+		vmDiskClient := testAccProvider.Meta().(*Client).vmDiskClient
+		d, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+		if err != nil {
+			return err
+		}
+
+		if d.DiskName != rs.Primary.ID {
+			return fmt.Errorf("Data Disk not found")
+		}
+
+		*disk = d
+
+		return nil
+	}
+}
+
+func testAccCheckAzureDataDiskAttributes(
+	disk *virtualmachinedisk.DataDiskResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if disk.Lun != 0 {
+			return fmt.Errorf("Bad lun: %d", disk.Lun)
+		}
+
+		if disk.LogicalDiskSizeInGB != 10 {
+			return fmt.Errorf("Bad size: %d", disk.LogicalDiskSizeInGB)
+		}
+
+		if disk.HostCaching != "None" {
+			return fmt.Errorf("Bad caching: %s", disk.HostCaching)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureDataDiskDestroy(s *terraform.State) error {
+	vmDiskClient := testAccProvider.Meta().(*Client).vmDiskClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_data_disk" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Disk ID is set")
+		}
+
+		vm := rs.Primary.Attributes["virtual_machine"]
+		lun, err := strconv.Atoi(rs.Primary.Attributes["lun"])
+		if err != nil {
+			return err
+		}
+
+		_, err = vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+		if err == nil {
+			return fmt.Errorf("Data disk %s still exists", rs.Primary.ID)
+		}
+
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureDataDisk_basic = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 0
+    size = 10
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    virtual_machine = "${azure_instance.foo.id}"
+}`, testAccStorageServiceName)
+
+var testAccAzureDataDisk_advanced = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 1
+    size = 10
+    caching = "ReadOnly"
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    virtual_machine = "${azure_instance.foo.id}"
+}`, testAccStorageServiceName)
+
+var testAccAzureDataDisk_update = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_instance" "bar" {
+    name = "terraform-test2"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 2
+    size = 20
+    caching = "ReadWrite"
+    storage_service_name = "${azure_instance.bar.storage_service_name}"
+    virtual_machine = "${azure_instance.bar.id}"
+}`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_dns_server.go b/builtin/providers/azure/resource_azure_dns_server.go
new file mode 100644
index 000000000..dd4e380dc
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_dns_server.go
@@ -0,0 +1,240 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureDnsServer returns the *schema.Resource associated
+// to an Azure hosted service.
+func resourceAzureDnsServer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureDnsServerCreate,
+		Read:   resourceAzureDnsServerRead,
+		Update: resourceAzureDnsServerUpdate,
+		Exists: resourceAzureDnsServerExists,
+		Delete: resourceAzureDnsServerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"dns_address": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["dns_address"],
+			},
+		},
+	}
+}
+
+// resourceAzureDnsServerCreate does all the necessary API calls
+// to create a new DNS server definition on Azure.
+func resourceAzureDnsServerCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network configuration exists yet; create one now:
+			netConf = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+	}
+
+	log.Println("[DEBUG] Adding new DNS server definition to Azure.")
+	name := d.Get("name").(string)
+	address := d.Get("dns_address").(string)
+	netConf.Configuration.DNS.DNSServers = append(
+		netConf.Configuration.DNS.DNSServers,
+		virtualnetwork.DNSServer{
+			Name:      name,
+			IPAddress: address,
+		})
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error setting network configuration: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureDnsServerRead does all the necessary API calls to read
+// the state of the DNS server off Azure.
+func resourceAzureDnsServerRead(d *schema.ResourceData, meta interface{}) error {
+	vnetClient := meta.(*Client).vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+
+	// search for our DNS and update it if the IP has been changed:
+	for _, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			found = true
+			d.Set("dns_address", dns.IPAddress)
+			break
+		}
+	}
+
+	// remove the resource from the state if it has been deleted in the meantime:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureDnsServerUpdate does all the necessary API calls
+// to update the DNS definition on Azure.
+func resourceAzureDnsServerUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	var found bool
+	name := d.Get("name").(string)
+
+	if d.HasChange("dns_address") {
+		log.Println("[DEBUG] DNS server address has changes; updating it on Azure.")
+		log.Println("[INFO] Fetching current network configuration from Azure.")
+		azureClient.mutex.Lock()
+		defer azureClient.mutex.Unlock()
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+
+		// search for our DNS and update its address value:
+		for i, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == name {
+				found = true
+				netConf.Configuration.DNS.DNSServers[i].IPAddress = d.Get("dns_address").(string)
+				break
+			}
+		}
+
+		// if the config has changes, send the configuration back to Azure:
+		if found {
+			log.Println("[INFO] Sending updated network configuration back to Azure.")
+			reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+			if err != nil {
+				return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+			}
+			err = mgmtClient.WaitForOperation(reqID, nil)
+			if err != nil {
+				return fmt.Errorf("Error setting network configuration: %s", err)
+			}
+
+			return nil
+		}
+	}
+
+	// remove the resource from the state if it has been deleted in the meantime:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureDnsServerExists does all the necessary API calls to
+// check if the DNS server definition alredy exists on Azure.
+func resourceAzureDnsServerExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return false, fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for the DNS server's definition:
+	for _, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			return true, nil
+		}
+	}
+
+	// if we reached this point; the resource must have been deleted; and we must untrack it:
+	d.SetId("")
+	return false, nil
+}
+
+// resourceAzureDnsServerDelete does all the necessary API calls
+// to delete the DNS server definition from Azure.
+func resourceAzureDnsServerDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for the DNS server's definition and remove it:
+	var found bool
+	for i, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			found = true
+			netConf.Configuration.DNS.DNSServers = append(
+				netConf.Configuration.DNS.DNSServers[:i],
+				netConf.Configuration.DNS.DNSServers[i+1:]...,
+			)
+			break
+		}
+	}
+
+	// if not found; don't bother re-sending the natwork config:
+	if !found {
+		return nil
+	}
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error setting network configuration: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_dns_server_test.go b/builtin/providers/azure/resource_azure_dns_server_test.go
new file mode 100644
index 000000000..8b8e335b4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_dns_server_test.go
@@ -0,0 +1,126 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureDnsServerBasic(t *testing.T) {
+	name := "azure_dns_server.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDnsServerDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDnsServerBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.8.8"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureDnsServerUpdate(t *testing.T) {
+	name := "azure_dns_server.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDnsServerDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDnsServerBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.8.8"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureDnsServerUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.4.4"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureDnsServerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No DNS Server ID set.")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Failed fetching networking configuration: %s", err)
+		}
+
+		for _, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Azure DNS Server not found.")
+	}
+}
+
+func testAccCheckAzureDnsServerDestroy(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_dns_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No DNS Server ID is set.")
+		}
+
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Error retrieving networking configuration from Azure: %s", err)
+		}
+
+		for _, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == resource.Primary.ID {
+				return fmt.Errorf("Azure DNS Server still exists.")
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureDnsServerBasic = `
+resource "azure_dns_server" "foo" {
+    name = "terraform-dns-server"
+    dns_address = "8.8.8.8"
+}
+`
+
+const testAccAzureDnsServerUpdate = `
+resource "azure_dns_server" "foo" {
+    name = "terraform-dns-server"
+    dns_address = "8.8.4.4"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_hosted_service.go b/builtin/providers/azure/resource_azure_hosted_service.go
new file mode 100644
index 000000000..3d7a638a6
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_hosted_service.go
@@ -0,0 +1,168 @@
+package azure
+
+import (
+	"encoding/base64"
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureHostedService returns the schema.Resource associated to an
+// Azure hosted service.
+func resourceAzureHostedService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureHostedServiceCreate,
+		Read:   resourceAzureHostedServiceRead,
+		Update: resourceAzureHostedServiceUpdate,
+		Delete: resourceAzureHostedServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"location": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["location"],
+			},
+			"ephemeral_contents": &schema.Schema{
+				Type:        schema.TypeBool,
+				Required:    true,
+				Description: parameterDescriptions["ephemeral_contents"],
+			},
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"status": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"reverse_dns_fqdn": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: parameterDescriptions["reverse_dns_fqdn"],
+			},
+			"label": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Optional:    true,
+				Default:     "Made by Terraform.",
+				Description: parameterDescriptions["label"],
+			},
+			"description": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Optional:    true,
+				Description: parameterDescriptions["description"],
+			},
+			"default_certificate_thumbprint": &schema.Schema{
+				Type:        schema.TypeString,
+				Computed:    true,
+				Optional:    true,
+				Description: parameterDescriptions["default_certificate_thumbprint"],
+			},
+		},
+	}
+}
+
+// resourceAzureHostedServiceCreate does all the necessary API calls
+// to create a hosted service on Azure.
+func resourceAzureHostedServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	hostedServiceClient := meta.(*Client).hostedServiceClient
+
+	serviceName := d.Get("name").(string)
+	location := d.Get("location").(string)
+	reverseDNS := d.Get("reverse_dns_fqdn").(string)
+	description := d.Get("description").(string)
+	label := base64.StdEncoding.EncodeToString([]byte(d.Get("label").(string)))
+
+	err := hostedServiceClient.CreateHostedService(
+		hostedservice.CreateHostedServiceParameters{
+			ServiceName:    serviceName,
+			Location:       location,
+			Label:          label,
+			Description:    description,
+			ReverseDNSFqdn: reverseDNS,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("Failed defining new Azure hosted service: %s", err)
+	}
+
+	d.SetId(serviceName)
+	return nil
+}
+
+// resourceAzureHostedServiceRead does all the necessary API calls
+// to read the state of a hosted service from Azure.
+func resourceAzureHostedServiceRead(d *schema.ResourceData, meta interface{}) error {
+	hostedServiceClient := meta.(*Client).hostedServiceClient
+
+	log.Println("[INFO] Querying for hosted service info.")
+	serviceName := d.Get("name").(string)
+	hostedService, err := hostedServiceClient.GetHostedService(serviceName)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// it means the hosted service was deleted in the meantime,
+			// so we must remove it here:
+			d.SetId("")
+			return nil
+		} else {
+			return fmt.Errorf("Failed to get hosted service: %s", err)
+		}
+	}
+
+	log.Println("[DEBUG] Reading hosted service query result data.")
+	d.Set("name", hostedService.ServiceName)
+	d.Set("url", hostedService.URL)
+	d.Set("location", hostedService.Location)
+	d.Set("description", hostedService.Description)
+	d.Set("label", hostedService.Label)
+	d.Set("status", hostedService.Status)
+	d.Set("reverse_dns_fqdn", hostedService.ReverseDNSFqdn)
+	d.Set("default_certificate_thumbprint", hostedService.DefaultWinRmCertificateThumbprint)
+
+	return nil
+}
+
+// resourceAzureHostedServiceUpdate does all the necessary API calls to
+// update some settings of a hosted service on Azure.
+func resourceAzureHostedServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	// NOTE: although no-op; this is still required in order for updates to
+	// ephemeral_contents to be possible.
+
+	// check if the service still exists:
+	return resourceAzureHostedServiceRead(d, meta)
+}
+
+// resourceAzureHostedServiceDelete does all the necessary API calls to
+// delete a hosted service from Azure.
+func resourceAzureHostedServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	hostedServiceClient := azureClient.hostedServiceClient
+
+	log.Println("[INFO] Issuing hosted service deletion.")
+	serviceName := d.Get("name").(string)
+	ephemeral := d.Get("ephemeral_contents").(bool)
+	reqID, err := hostedServiceClient.DeleteHostedService(serviceName, ephemeral)
+	if err != nil {
+		return fmt.Errorf("Failed issuing hosted service deletion request: %s", err)
+	}
+
+	log.Println("[DEBUG] Awaiting confirmation on hosted service deletion.")
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error on hosted service deletion: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_hosted_service_test.go b/builtin/providers/azure/resource_azure_hosted_service_test.go
new file mode 100644
index 000000000..bbad19632
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_hosted_service_test.go
@@ -0,0 +1,123 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureHostedServiceBasic(t *testing.T) {
+	name := "azure_hosted_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureHostedServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureHostedServiceBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "false"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureHostedServiceUpdate(t *testing.T) {
+	name := "azure_hosted_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureHostedServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureHostedServiceBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "false"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureHostedServiceUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "true"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureHostedServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Hosted Service resource not found.")
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Resource's ID is not set.")
+		}
+
+		hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+		_, err := hostedServiceClient.GetHostedService(resource.Primary.ID)
+		return err
+	}
+}
+
+func testAccCheckAzureHostedServiceDestroyed(s *terraform.State) error {
+	hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_hosted_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No Azure Hosted Service Resource found.")
+		}
+
+		_, err := hostedServiceClient.GetHostedService(resource.Primary.ID)
+
+		return testAccResourceDestroyedErrorFilter("Hosted Service", err)
+	}
+
+	return nil
+}
+
+const testAccAzureHostedServiceBasic = `
+resource "azure_hosted_service" "foo" {
+	name = "terraform-testing-service"
+	location = "North Europe"
+    ephemeral_contents = false
+	description = "very discriptive"
+    label = "very identifiable"
+}
+`
+const testAccAzureHostedServiceUpdate = `
+resource "azure_hosted_service" "foo" {
+	name = "terraform-testing-service"
+	location = "North Europe"
+    ephemeral_contents = true
+	description = "very discriptive"
+    label = "very identifiable"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_instance.go b/builtin/providers/azure/resource_azure_instance.go
new file mode 100644
index 000000000..b273675f5
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_instance.go
@@ -0,0 +1,720 @@
+package azure
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/Azure/azure-sdk-for-go/management/osimage"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachineimage"
+	"github.com/Azure/azure-sdk-for-go/management/vmutils"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const (
+	linux                = "Linux"
+	windows              = "Windows"
+	osDiskBlobStorageURL = "http://%s.blob.core.windows.net/vhds/%s.vhd"
+)
+
+func resourceAzureInstance() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureInstanceCreate,
+		Read:   resourceAzureInstanceRead,
+		Update: resourceAzureInstanceUpdate,
+		Delete: resourceAzureInstanceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"hosted_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"image": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"size": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"subnet": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"virtual_network": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"storage_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"reverse_dns": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"automatic_updates": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				ForceNew: true,
+			},
+
+			"time_zone": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"username": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"password": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"ssh_key_thumbprint": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"endpoint": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"protocol": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							Default:  "tcp",
+						},
+
+						"public_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+
+						"private_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAzureEndpointHash,
+			},
+
+			"security_group": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
+			"ip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"vip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAzureInstanceCreate(d *schema.ResourceData, meta interface{}) (err error) {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	hostedServiceClient := azureClient.hostedServiceClient
+	vmClient := azureClient.vmClient
+
+	name := d.Get("name").(string)
+
+	// Compute/set the description
+	description := d.Get("description").(string)
+	if description == "" {
+		description = name
+	}
+
+	// Retrieve the needed details of the image
+	configureForImage, osType, err := retrieveImageDetails(
+		meta,
+		d.Get("image").(string),
+		name,
+		d.Get("storage_service_name").(string),
+	)
+	if err != nil {
+		return err
+	}
+
+	// Verify if we have all required parameters
+	if err := verifyInstanceParameters(d, osType); err != nil {
+		return err
+	}
+
+	var hostedServiceName string
+	// check if hosted service name parameter was given:
+	if serviceName, ok := d.GetOk("hosted_service_name"); !ok {
+		// if not provided; just use the name of the instance to create a new one:
+		hostedServiceName = name
+		d.Set("hosted_service_name", hostedServiceName)
+
+		p := hostedservice.CreateHostedServiceParameters{
+			ServiceName:    hostedServiceName,
+			Label:          base64.StdEncoding.EncodeToString([]byte(name)),
+			Description:    fmt.Sprintf("Cloud Service created automatically for instance %s", name),
+			Location:       d.Get("location").(string),
+			ReverseDNSFqdn: d.Get("reverse_dns").(string),
+		}
+
+		log.Printf("[DEBUG] Creating Cloud Service for instance: %s", name)
+		err = hostedServiceClient.CreateHostedService(p)
+		if err != nil {
+			return fmt.Errorf("Error creating Cloud Service for instance %s: %s", name, err)
+		}
+	} else {
+		// else; use the provided hosted service name:
+		hostedServiceName = serviceName.(string)
+	}
+
+	// Create a new role for the instance
+	role := vmutils.NewVMConfiguration(name, d.Get("size").(string))
+
+	log.Printf("[DEBUG] Configuring deployment from image...")
+	err = configureForImage(&role)
+	if err != nil {
+		return fmt.Errorf("Error configuring the deployment for %s: %s", name, err)
+	}
+
+	if osType == linux {
+		// This is pretty ugly, but the Azure SDK leaves me no other choice...
+		if tp, ok := d.GetOk("ssh_key_thumbprint"); ok {
+			err = vmutils.ConfigureForLinux(
+				&role,
+				name,
+				d.Get("username").(string),
+				d.Get("password").(string),
+				tp.(string),
+			)
+		} else {
+			err = vmutils.ConfigureForLinux(
+				&role,
+				name,
+				d.Get("username").(string),
+				d.Get("password").(string),
+			)
+		}
+		if err != nil {
+			return fmt.Errorf("Error configuring %s for Linux: %s", name, err)
+		}
+	}
+
+	if osType == windows {
+		err = vmutils.ConfigureForWindows(
+			&role,
+			name,
+			d.Get("username").(string),
+			d.Get("password").(string),
+			d.Get("automatic_updates").(bool),
+			d.Get("time_zone").(string),
+		)
+		if err != nil {
+			return fmt.Errorf("Error configuring %s for Windows: %s", name, err)
+		}
+	}
+
+	if s := d.Get("endpoint").(*schema.Set); s.Len() > 0 {
+		for _, v := range s.List() {
+			m := v.(map[string]interface{})
+			err := vmutils.ConfigureWithExternalPort(
+				&role,
+				m["name"].(string),
+				m["private_port"].(int),
+				m["public_port"].(int),
+				endpointProtocol(m["protocol"].(string)),
+			)
+			if err != nil {
+				return fmt.Errorf(
+					"Error adding endpoint %s for instance %s: %s", m["name"].(string), name, err)
+			}
+		}
+	}
+
+	if subnet, ok := d.GetOk("subnet"); ok {
+		err = vmutils.ConfigureWithSubnet(&role, subnet.(string))
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating subnet %s with instance %s: %s", d.Get("subnet").(string), name, err)
+		}
+	}
+
+	if sg, ok := d.GetOk("security_group"); ok {
+		err = vmutils.ConfigureWithSecurityGroup(&role, sg.(string))
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating security group %s with instance %s: %s", sg.(string), name, err)
+		}
+	}
+
+	options := virtualmachine.CreateDeploymentOptions{
+		VirtualNetworkName: d.Get("virtual_network").(string),
+	}
+
+	log.Printf("[DEBUG] Creating the new instance...")
+	req, err := vmClient.CreateDeployment(role, hostedServiceName, options)
+	if err != nil {
+		return fmt.Errorf("Error creating instance %s: %s", name, err)
+	}
+
+	log.Printf("[DEBUG] Waiting for the new instance to be created...")
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for instance %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureInstanceRead(d, meta)
+}
+
+func resourceAzureInstanceRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	hostedServiceClient := azureClient.hostedServiceClient
+	vmClient := azureClient.vmClient
+
+	name := d.Get("name").(string)
+
+	// check if the instance belongs to an independent hosted service
+	// or it had one created for it.
+	var hostedServiceName string
+	if serviceName, ok := d.GetOk("hosted_service_name"); ok {
+		// if independent; use that hosted service name:
+		hostedServiceName = serviceName.(string)
+	} else {
+		// else; suppose it's the instance's name:
+		hostedServiceName = name
+	}
+
+	log.Printf("[DEBUG] Retrieving Cloud Service for instance: %s", name)
+	cs, err := hostedServiceClient.GetHostedService(hostedServiceName)
+	if err != nil {
+		return fmt.Errorf("Error retrieving Cloud Service of instance %s (%q): %s", name, hostedServiceName, err)
+	}
+
+	d.Set("reverse_dns", cs.ReverseDNSFqdn)
+	d.Set("location", cs.Location)
+
+	log.Printf("[DEBUG] Retrieving instance: %s", name)
+	dpmt, err := vmClient.GetDeployment(hostedServiceName, name)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving instance %s: %s", name, err)
+	}
+
+	if len(dpmt.RoleList) != 1 {
+		return fmt.Errorf(
+			"Instance %s has an unexpected number of roles: %d", name, len(dpmt.RoleList))
+	}
+
+	d.Set("size", dpmt.RoleList[0].RoleSize)
+
+	if len(dpmt.RoleInstanceList) != 1 {
+		return fmt.Errorf(
+			"Instance %s has an unexpected number of role instances: %d",
+			name, len(dpmt.RoleInstanceList))
+	}
+	d.Set("ip_address", dpmt.RoleInstanceList[0].IPAddress)
+
+	if len(dpmt.RoleInstanceList[0].InstanceEndpoints) > 0 {
+		d.Set("vip_address", dpmt.RoleInstanceList[0].InstanceEndpoints[0].Vip)
+	}
+
+	// Find the network configuration set
+	for _, c := range dpmt.RoleList[0].ConfigurationSets {
+		if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+			// Create a new set to hold all configured endpoints
+			endpoints := &schema.Set{
+				F: resourceAzureEndpointHash,
+			}
+
+			// Loop through all endpoints
+			for _, ep := range c.InputEndpoints {
+				endpoint := map[string]interface{}{}
+
+				// Update the values
+				endpoint["name"] = ep.Name
+				endpoint["protocol"] = string(ep.Protocol)
+				endpoint["public_port"] = ep.Port
+				endpoint["private_port"] = ep.LocalPort
+				endpoints.Add(endpoint)
+			}
+			d.Set("endpoint", endpoints)
+
+			// Update the subnet
+			switch len(c.SubnetNames) {
+			case 1:
+				d.Set("subnet", c.SubnetNames[0])
+			case 0:
+				d.Set("subnet", "")
+			default:
+				return fmt.Errorf(
+					"Instance %s has an unexpected number of associated subnets %d",
+					name, len(dpmt.RoleInstanceList))
+			}
+
+			// Update the security group
+			d.Set("security_group", c.NetworkSecurityGroup)
+		}
+	}
+
+	connType := "ssh"
+	if dpmt.RoleList[0].OSVirtualHardDisk.OS == windows {
+		connType = "winrm"
+	}
+
+	// Set the connection info for any configured provisioners
+	d.SetConnInfo(map[string]string{
+		"type":     connType,
+		"host":     dpmt.VirtualIPs[0].Address,
+		"user":     d.Get("username").(string),
+		"password": d.Get("password").(string),
+	})
+
+	return nil
+}
+
+func resourceAzureInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	vmClient := azureClient.vmClient
+
+	// First check if anything we can update changed, and if not just return
+	if !d.HasChange("size") && !d.HasChange("endpoint") && !d.HasChange("security_group") {
+		return nil
+	}
+
+	name := d.Get("name").(string)
+	hostedServiceName := d.Get("hosted_service_name").(string)
+
+	// Get the current role
+	role, err := vmClient.GetRole(hostedServiceName, name, name)
+	if err != nil {
+		return fmt.Errorf("Error retrieving role of instance %s: %s", name, err)
+	}
+
+	// Verify if we have all required parameters
+	if err := verifyInstanceParameters(d, role.OSVirtualHardDisk.OS); err != nil {
+		return err
+	}
+
+	if d.HasChange("size") {
+		role.RoleSize = d.Get("size").(string)
+	}
+
+	if d.HasChange("endpoint") {
+		_, n := d.GetChange("endpoint")
+
+		// Delete the existing endpoints
+		for i, c := range role.ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				c.InputEndpoints = nil
+				role.ConfigurationSets[i] = c
+			}
+		}
+
+		// And add the ones we still want
+		if s := n.(*schema.Set); s.Len() > 0 {
+			for _, v := range s.List() {
+				m := v.(map[string]interface{})
+				err := vmutils.ConfigureWithExternalPort(
+					role,
+					m["name"].(string),
+					m["private_port"].(int),
+					m["public_port"].(int),
+					endpointProtocol(m["protocol"].(string)),
+				)
+				if err != nil {
+					return fmt.Errorf(
+						"Error adding endpoint %s for instance %s: %s", m["name"].(string), name, err)
+				}
+			}
+		}
+	}
+
+	if d.HasChange("security_group") {
+		sg := d.Get("security_group").(string)
+		err := vmutils.ConfigureWithSecurityGroup(role, sg)
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating security group %s with instance %s: %s", sg, name, err)
+		}
+	}
+
+	// Update the adjusted role
+	req, err := vmClient.UpdateRole(hostedServiceName, name, name, *role)
+	if err != nil {
+		return fmt.Errorf("Error updating role of instance %s: %s", name, err)
+	}
+
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for role of instance %s to be updated: %s", name, err)
+	}
+
+	return resourceAzureInstanceRead(d, meta)
+}
+
+func resourceAzureInstanceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	vmClient := azureClient.vmClient
+	hostedServiceClient := azureClient.hostedServiceClient
+
+	name := d.Get("name").(string)
+	hostedServiceName := d.Get("hosted_service_name").(string)
+
+	log.Printf("[DEBUG] Deleting instance: %s", name)
+
+	// check if the instance had a hosted service created especially for it:
+	if name == hostedServiceName {
+		// if so; we must delete the associated hosted service as well:
+		req, err := hostedServiceClient.DeleteHostedService(name, true)
+		if err != nil {
+			return fmt.Errorf("Error deleting instance and hosted service %s: %s", name, err)
+		}
+
+		// Wait until the hosted service and the instance it contains is deleted:
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for instance %s to be deleted: %s", name, err)
+		}
+	} else {
+		// else; just delete the instance:
+		reqID, err := vmClient.DeleteDeployment(hostedServiceName, name)
+		if err != nil {
+			return fmt.Errorf("Error deleting instance %s off hosted service %s: %s", name, hostedServiceName, err)
+		}
+
+		// and wait for the deletion:
+		if err := mc.WaitForOperation(reqID, nil); err != nil {
+			return fmt.Errorf("Error waiting for intance %s to be deleted off the hosted service %s: %s",
+				name, hostedServiceName, err)
+		}
+	}
+
+	return nil
+}
+
+func resourceAzureEndpointHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%d-", m["public_port"].(int)))
+	buf.WriteString(fmt.Sprintf("%d-", m["private_port"].(int)))
+
+	return hashcode.String(buf.String())
+}
+
+func retrieveImageDetails(
+	meta interface{},
+	label string,
+	name string,
+	storage string) (func(*virtualmachine.Role) error, string, error) {
+
+	azureClient := meta.(*Client)
+	vmImageClient := azureClient.vmImageClient
+	osImageClient := azureClient.osImageClient
+
+	configureForImage, osType, VMLabels, err := retrieveVMImageDetails(vmImageClient, label)
+	if err == nil {
+		return configureForImage, osType, nil
+	}
+
+	configureForImage, osType, OSLabels, err := retrieveOSImageDetails(osImageClient, label, name, storage)
+	if err == nil {
+		return configureForImage, osType, nil
+	}
+
+	return nil, "", fmt.Errorf("Could not find image with label '%s'. Available images are: %s",
+		label, strings.Join(append(VMLabels, OSLabels...), ", "))
+}
+
+func retrieveVMImageDetails(
+	vmImageClient virtualmachineimage.Client,
+	label string) (func(*virtualmachine.Role) error, string, []string, error) {
+	imgs, err := vmImageClient.ListVirtualMachineImages()
+	if err != nil {
+		return nil, "", nil, fmt.Errorf("Error retrieving image details: %s", err)
+	}
+
+	var labels []string
+	for _, img := range imgs.VMImages {
+		if img.Label == label {
+			if img.OSDiskConfiguration.OS != linux && img.OSDiskConfiguration.OS != windows {
+				return nil, "", nil, fmt.Errorf("Unsupported image OS: %s", img.OSDiskConfiguration.OS)
+			}
+
+			configureForImage := func(role *virtualmachine.Role) error {
+				return vmutils.ConfigureDeploymentFromVMImage(
+					role,
+					img.Name,
+					"",
+					true,
+				)
+			}
+
+			return configureForImage, img.OSDiskConfiguration.OS, nil, nil
+		}
+
+		labels = append(labels, img.Label)
+	}
+
+	return nil, "", labels, fmt.Errorf("Could not find image with label '%s'", label)
+}
+
+func retrieveOSImageDetails(
+	osImageClient osimage.OSImageClient,
+	label string,
+	name string,
+	storage string) (func(*virtualmachine.Role) error, string, []string, error) {
+	imgs, err := osImageClient.ListOSImages()
+	if err != nil {
+		return nil, "", nil, fmt.Errorf("Error retrieving image details: %s", err)
+	}
+
+	var labels []string
+	for _, img := range imgs.OSImages {
+		if img.Label == label {
+			if img.OS != linux && img.OS != windows {
+				return nil, "", nil, fmt.Errorf("Unsupported image OS: %s", img.OS)
+			}
+			if img.MediaLink == "" {
+				if storage == "" {
+					return nil, "", nil,
+						fmt.Errorf("When using a platform image, the 'storage' parameter is required")
+				}
+				img.MediaLink = fmt.Sprintf(osDiskBlobStorageURL, storage, name)
+			}
+
+			configureForImage := func(role *virtualmachine.Role) error {
+				return vmutils.ConfigureDeploymentFromPlatformImage(
+					role,
+					img.Name,
+					img.MediaLink,
+					label,
+				)
+			}
+
+			return configureForImage, img.OS, nil, nil
+		}
+
+		labels = append(labels, img.Label)
+	}
+
+	return nil, "", labels, fmt.Errorf("Could not find image with label '%s'", label)
+}
+
+func endpointProtocol(p string) virtualmachine.InputEndpointProtocol {
+	if p == "tcp" {
+		return virtualmachine.InputEndpointProtocolTCP
+	}
+
+	return virtualmachine.InputEndpointProtocolUDP
+}
+
+func verifyInstanceParameters(d *schema.ResourceData, osType string) error {
+	if osType == linux {
+		_, pass := d.GetOk("password")
+		_, key := d.GetOk("ssh_key_thumbprint")
+
+		if !pass && !key {
+			return fmt.Errorf(
+				"You must supply a 'password' and/or a 'ssh_key_thumbprint' when using a Linux image")
+		}
+	}
+
+	if osType == windows {
+		if _, ok := d.GetOk("password"); !ok {
+			return fmt.Errorf("You must supply a 'password' when using a Windows image")
+		}
+
+		if _, ok := d.GetOk("time_zone"); !ok {
+			return fmt.Errorf("You must supply a 'time_zone' when using a Windows image")
+		}
+	}
+
+	if _, ok := d.GetOk("subnet"); ok {
+		if _, ok := d.GetOk("virtual_network"); !ok {
+			return fmt.Errorf("You must also supply a 'virtual_network' when supplying a 'subnet'")
+		}
+	}
+
+	if s := d.Get("endpoint").(*schema.Set); s.Len() > 0 {
+		for _, v := range s.List() {
+			protocol := v.(map[string]interface{})["protocol"].(string)
+
+			if protocol != "tcp" && protocol != "udp" {
+				return fmt.Errorf(
+					"Invalid endpoint protocol %s! Valid options are 'tcp' and 'udp'.", protocol)
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_instance_test.go b/builtin/providers/azure/resource_azure_instance_test.go
new file mode 100644
index 000000000..679aa015b
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_instance_test.go
@@ -0,0 +1,542 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureInstance_basic(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceBasicAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.2462817782.public_port", "22"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_separateHostedService(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(testAccHostedServiceName),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_seperateHostedService,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", testAccHostedServiceName, &dpmt),
+					testAccCheckAzureInstanceBasicAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.2462817782.public_port", "22"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_advanced(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceAdvancedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "subnet", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "virtual_network", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_update(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceAdvancedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "subnet", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "virtual_network", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureInstance_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceUpdatedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A2"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group2"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.3713350066.public_port", "5985"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureInstanceExists(
+	n string,
+	hostedServiceName string,
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No instance ID is set")
+		}
+
+		// if not hosted service was provided; it means that we expect it
+		// to be identical with the name of the instance; which is in the ID.
+		var serviceName string
+		if hostedServiceName == "" {
+			serviceName = rs.Primary.ID
+		} else {
+			serviceName = hostedServiceName
+		}
+
+		vmClient := testAccProvider.Meta().(*Client).vmClient
+		vm, err := vmClient.GetDeployment(serviceName, rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		if vm.Name != rs.Primary.ID {
+			return fmt.Errorf("Instance not found")
+		}
+
+		*dpmt = vm
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceBasicAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A1" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceAdvancedAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test1" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if dpmt.VirtualNetworkName != "terraform-vnet" {
+			return fmt.Errorf("Bad virtual network: %s", dpmt.VirtualNetworkName)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A1" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		for _, c := range dpmt.RoleList[0].ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				if len(c.InputEndpoints) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of endpoints %d",
+						dpmt.Name, len(c.InputEndpoints))
+				}
+
+				if c.InputEndpoints[0].Name != "RDP" {
+					return fmt.Errorf("Bad endpoint name: %s", c.InputEndpoints[0].Name)
+				}
+
+				if c.InputEndpoints[0].Port != 3389 {
+					return fmt.Errorf("Bad endpoint port: %d", c.InputEndpoints[0].Port)
+				}
+
+				if len(c.SubnetNames) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of associated subnets %d",
+						dpmt.Name, len(c.SubnetNames))
+				}
+
+				if c.SubnetNames[0] != "subnet1" {
+					return fmt.Errorf("Bad subnet: %s", c.SubnetNames[0])
+				}
+
+				if c.NetworkSecurityGroup != "terraform-security-group1" {
+					return fmt.Errorf("Bad security group: %s", c.NetworkSecurityGroup)
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceUpdatedAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test1" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if dpmt.VirtualNetworkName != "terraform-vnet" {
+			return fmt.Errorf("Bad virtual network: %s", dpmt.VirtualNetworkName)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A2" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		for _, c := range dpmt.RoleList[0].ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				if len(c.InputEndpoints) != 2 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of endpoints %d",
+						dpmt.Name, len(c.InputEndpoints))
+				}
+
+				if c.InputEndpoints[1].Name != "WINRM" {
+					return fmt.Errorf("Bad endpoint name: %s", c.InputEndpoints[1].Name)
+				}
+
+				if c.InputEndpoints[1].Port != 5985 {
+					return fmt.Errorf("Bad endpoint port: %d", c.InputEndpoints[1].Port)
+				}
+
+				if len(c.SubnetNames) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of associated subnets %d",
+						dpmt.Name, len(c.SubnetNames))
+				}
+
+				if c.SubnetNames[0] != "subnet1" {
+					return fmt.Errorf("Bad subnet: %s", c.SubnetNames[0])
+				}
+
+				if c.NetworkSecurityGroup != "terraform-security-group2" {
+					return fmt.Errorf("Bad security group: %s", c.NetworkSecurityGroup)
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceDestroyed(hostedServiceName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "azure_instance" {
+				continue
+			}
+
+			if rs.Primary.ID == "" {
+				return fmt.Errorf("No instance ID is set")
+			}
+
+			// if not hosted service was provided; it means that we expect it
+			// to be identical with the name of the instance; which is in the ID.
+			var serviceName string
+			if hostedServiceName == "" {
+				serviceName = rs.Primary.ID
+			} else {
+				serviceName = hostedServiceName
+			}
+
+			_, err := hostedServiceClient.GetHostedService(serviceName)
+			if err == nil {
+				return fmt.Errorf("Instance %s still exists", rs.Primary.ID)
+			}
+
+			if !management.IsResourceNotFoundError(err) {
+				return err
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureInstance_basic = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}`, testAccStorageServiceName)
+
+var testAccAzureInstance_seperateHostedService = fmt.Sprintf(`
+resource "azure_hosted_service" "foo" {
+	name = "%s"
+	location = "West US"
+	ephemeral_contents = true
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+	hosted_service_name = "${azure_hosted_service.foo.name}"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}`, testAccHostedServiceName, testAccStorageServiceName)
+
+var testAccAzureInstance_advanced = fmt.Sprintf(`
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+		location = "West US"
+
+		subnet {
+        name = "subnet1"
+				address_prefix = "10.1.2.0/25"
+		}
+
+		subnet {
+        name = "subnet2"
+				address_prefix = "10.1.2.128/25"
+    }
+}
+
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.foo.name}"]
+    priority = 101
+    source_address_prefix = "*"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	action = "Deny"
+	type = "Inbound"
+    protocol = "TCP"
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Windows Server 2012 R2 Datacenter, April 2015"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    time_zone = "America/Los_Angeles"
+    subnet = "subnet1"
+    virtual_network = "${azure_virtual_network.foo.name}"
+    security_group = "${azure_security_group.foo.name}"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "RDP"
+        protocol = "tcp"
+        public_port = 3389
+        private_port = 3389
+    }
+}`, testAccStorageServiceName)
+
+var testAccAzureInstance_update = fmt.Sprintf(`
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+		location = "West US"
+
+    subnet {
+        name = "subnet1"
+		address_prefix = "10.1.2.0/25"
+	}
+
+    subnet {
+        name = "subnet2"
+		address_prefix = "10.1.2.128/25"
+    }
+}
+
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.foo.name}"]
+    priority = 101
+    source_address_prefix = "*"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	type = "Inbound"
+	action = "Deny"
+    protocol = "TCP"
+}
+
+resource "azure_security_group" "bar" {
+    name = "terraform-security-group2"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "bar" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.bar.name}"]
+    priority = 101
+    source_address_prefix = "192.168.0.0/24"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	type = "Inbound"
+	action = "Deny"
+    protocol = "TCP"
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Windows Server 2012 R2 Datacenter, April 2015"
+    size = "Basic_A2"
+    storage_service_name = "%s"
+    location = "West US"
+    time_zone = "America/Los_Angeles"
+    subnet = "subnet1"
+    virtual_network = "${azure_virtual_network.foo.name}"
+    security_group = "${azure_security_group.bar.name}"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "RDP"
+        protocol = "tcp"
+        public_port = 3389
+        private_port = 3389
+    }
+
+    endpoint {
+        name = "WINRM"
+        protocol = "tcp"
+        public_port = 5985
+        private_port = 5985
+    }
+}`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_local_network.go b/builtin/providers/azure/resource_azure_local_network.go
new file mode 100644
index 000000000..5c2f4f3d8
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_local_network.go
@@ -0,0 +1,253 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureLocalNetworkConnetion returns the schema.Resource associated to an
+// Azure hosted service.
+func resourceAzureLocalNetworkConnection() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureLocalNetworkConnectionCreate,
+		Read:   resourceAzureLocalNetworkConnectionRead,
+		Update: resourceAzureLocalNetworkConnectionUpdate,
+		Exists: resourceAzureLocalNetworkConnectionExists,
+		Delete: resourceAzureLocalNetworkConnectionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"vpn_gateway_address": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["vpn_gateway_address"],
+			},
+			"address_space_prefixes": &schema.Schema{
+				Type:     schema.TypeList,
+				Required: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Description: parameterDescriptions["address_space_prefixes"],
+			},
+		},
+	}
+}
+
+// sourceAzureLocalNetworkConnectionCreate issues all the necessary API calls
+// to create a virtual network on Azure.
+func resourceAzureLocalNetworkConnectionCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network config exists yet; create a new one now:
+			netConf = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+	}
+
+	// get provided configuration:
+	name := d.Get("name").(string)
+	vpnGateway := d.Get("vpn_gateway_address").(string)
+	var prefixes []string
+	for _, prefix := range d.Get("address_space_prefixes").([]interface{}) {
+		prefixes = append(prefixes, prefix.(string))
+	}
+
+	// add configuration to network config:
+	netConf.Configuration.LocalNetworkSites = append(netConf.Configuration.LocalNetworkSites,
+		virtualnetwork.LocalNetworkSite{
+			Name:              name,
+			VPNGatewayAddress: vpnGateway,
+			AddressSpace: virtualnetwork.AddressSpace{
+				AddressPrefix: prefixes,
+			},
+		})
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed setting updated network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed updating the network configuration: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionRead does all the necessary API calls to
+// read the state of our local natwork from Azure.
+func resourceAzureLocalNetworkConnectionRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+
+	// browsing for our network config:
+	for _, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			found = true
+			d.Set("vpn_gateway_address", lnet.VPNGatewayAddress)
+			d.Set("address_space_prefixes", lnet.AddressSpace.AddressPrefix)
+			break
+		}
+	}
+
+	// remove the resource from the state of it has been deleted in the meantime:
+	if !found {
+		log.Println(fmt.Printf("[INFO] Azure local network '%s' has been deleted remotely. Removimg from Terraform.", name))
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionUpdate does all the necessary API calls
+// update the settings of our Local Network on Azure.
+func resourceAzureLocalNetworkConnectionUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+	cvpn := d.HasChange("vpn_gateway_address")
+	cprefixes := d.HasChange("address_space_prefixes")
+
+	var found bool
+	for i, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			found = true
+			if cvpn {
+				netConf.Configuration.LocalNetworkSites[i].VPNGatewayAddress = d.Get("vpn_gateway_address").(string)
+			}
+			if cprefixes {
+				var prefixes []string
+				for _, prefix := range d.Get("address_space_prefixes").([]interface{}) {
+					prefixes = append(prefixes, prefix.(string))
+				}
+				netConf.Configuration.LocalNetworkSites[i].AddressSpace.AddressPrefix = prefixes
+			}
+			break
+		}
+	}
+
+	// remove the resource from the state of it has been deleted in the meantime:
+	if !found {
+		log.Println(fmt.Printf("[INFO] Azure local network '%s' has been deleted remotely. Removimg from Terraform.", name))
+		d.SetId("")
+	} else if cvpn || cprefixes {
+		// else, send the configuration back to Azure:
+		log.Println("[INFO] Sending updated network configuration back to Azure.")
+		reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+		if err != nil {
+			return fmt.Errorf("Failed setting updated network configuration: %s", err)
+		}
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Failed updating the network configuration: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionExists does all the necessary API calls
+// to check if the local network already exists on Azure.
+func resourceAzureLocalNetworkConnectionExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	vnetClient := meta.(*Client).vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return false, fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name")
+
+	for _, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// resourceAzureLocalNetworkConnectionDelete does all the necessary API calls
+// to delete a local network off Azure.
+func resourceAzureLocalNetworkConnectionDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for our local network and remove it if found:
+	for i, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			netConf.Configuration.LocalNetworkSites = append(
+				netConf.Configuration.LocalNetworkSites[:i],
+				netConf.Configuration.LocalNetworkSites[i+1:]...,
+			)
+			break
+		}
+	}
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed setting updated network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed updating the network configuration: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_local_network_test.go b/builtin/providers/azure/resource_azure_local_network_test.go
new file mode 100644
index 000000000..2f9f0fdda
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_local_network_test.go
@@ -0,0 +1,139 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureLocalNetworkConnectionBasic(t *testing.T) {
+	name := "azure_local_network_connection.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureLocalNetworkConnectionDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.13"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.0/31"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.1/31"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureLocalNetworkConnectionUpdate(t *testing.T) {
+	name := "azure_local_network_connection.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureLocalNetworkConnectionDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.13"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.0/31"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.1/31"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.14"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.2/30"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.3/30"),
+				),
+			},
+		},
+	})
+}
+
+// testAccAzureLocalNetworkConnectionExists checks whether the given local network
+// connection exists on Azure.
+func testAccAzureLocalNetworkConnectionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Local Network Connection not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Local Network Connection ID not set.")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, lnet := range netConf.Configuration.LocalNetworkSites {
+			if lnet.Name == resource.Primary.ID {
+				return nil
+			}
+			break
+		}
+
+		return fmt.Errorf("Local Network Connection not found: %s", name)
+	}
+}
+
+// testAccAzureLocalNetworkConnectionDestroyed checks whether the local network
+// connection has been destroyed on Azure or not.
+func testAccAzureLocalNetworkConnectionDestroyed(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_local_network_connection" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Local Network Connection ID not set.")
+		}
+
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, lnet := range netConf.Configuration.LocalNetworkSites {
+			if lnet.Name == resource.Primary.ID {
+				return fmt.Errorf("Azure Local Network Connection still exists.")
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureLocalNetworkConnectionBasic = `
+resource "azure_local_network_connection" "foo" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "10.11.12.13"
+    address_space_prefixes = ["10.10.10.0/31", "10.10.10.1/31"]
+}
+`
+
+const testAccAzureLocalNetworkConnectionUpdate = `
+resource "azure_local_network_connection" "foo" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "10.11.12.14"
+    address_space_prefixes = ["10.10.10.2/30", "10.10.10.3/30"]
+}
+`
diff --git a/builtin/providers/azure/resource_azure_security_group.go b/builtin/providers/azure/resource_azure_security_group.go
new file mode 100644
index 000000000..1d066d031
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group.go
@@ -0,0 +1,110 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAzureSecurityGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSecurityGroupCreate,
+		Read:   resourceAzureSecurityGroupRead,
+		Delete: resourceAzureSecurityGroupDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAzureSecurityGroupCreate(d *schema.ResourceData, meta interface{}) (err error) {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	name := d.Get("name").(string)
+
+	// Compute/set the label
+	label := d.Get("label").(string)
+	if label == "" {
+		label = name
+	}
+
+	req, err := secGroupClient.CreateNetworkSecurityGroup(
+		name,
+		label,
+		d.Get("location").(string),
+	)
+	if err != nil {
+		return fmt.Errorf("Error creating Network Security Group %s: %s", name, err)
+	}
+
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for Network Security Group %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureSecurityGroupRead(d, meta)
+}
+
+func resourceAzureSecurityGroupRead(d *schema.ResourceData, meta interface{}) error {
+	secGroupClient := meta.(*Client).secGroupClient
+
+	sg, err := secGroupClient.GetNetworkSecurityGroup(d.Id())
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving Network Security Group %s: %s", d.Id(), err)
+	}
+
+	d.Set("label", sg.Label)
+	d.Set("location", sg.Location)
+
+	return nil
+}
+
+func resourceAzureSecurityGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	log.Printf("[DEBUG] Deleting Network Security Group: %s", d.Id())
+	req, err := secGroupClient.DeleteNetworkSecurityGroup(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error deleting Network Security Group %s: %s", d.Id(), err)
+	}
+
+	// Wait until the network security group is deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for Network Security Group %s to be deleted: %s", d.Id(), err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_security_group_rule.go b/builtin/providers/azure/resource_azure_security_group_rule.go
new file mode 100644
index 000000000..868edb150
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_rule.go
@@ -0,0 +1,301 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	netsecgroup "github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSecurityGroupRule returns the *schema.Resource for
+// a network security group rule on Azure.
+func resourceAzureSecurityGroupRule() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSecurityGroupRuleCreate,
+		Read:   resourceAzureSecurityGroupRuleRead,
+		Update: resourceAzureSecurityGroupRuleUpdate,
+		Delete: resourceAzureSecurityGroupRuleDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"security_group_names": &schema.Schema{
+				Type:        schema.TypeSet,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["netsecgroup_secgroup_names"],
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Set: schema.HashString,
+			},
+			"type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_type"],
+			},
+			"priority": &schema.Schema{
+				Type:        schema.TypeInt,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_priority"],
+			},
+			"action": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_action"],
+			},
+			"source_address_prefix": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_src_addr_prefix"],
+			},
+			"source_port_range": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_src_port_range"],
+			},
+			"destination_address_prefix": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_dest_addr_prefix"],
+			},
+			"destination_port_range": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_dest_port_range"],
+			},
+			"protocol": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_protocol"],
+			},
+		},
+	}
+}
+
+// resourceAzureSecurityGroupRuleCreate does all the necessary API calls to
+// create a new network security group rule on Azure.
+func resourceAzureSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	// create and configure the RuleResponse:
+	name := d.Get("name").(string)
+	rule := netsecgroup.RuleRequest{
+		Name:                     name,
+		Type:                     netsecgroup.RuleType(d.Get("type").(string)),
+		Priority:                 d.Get("priority").(int),
+		Action:                   netsecgroup.RuleAction(d.Get("action").(string)),
+		SourceAddressPrefix:      d.Get("source_address_prefix").(string),
+		SourcePortRange:          d.Get("source_port_range").(string),
+		DestinationAddressPrefix: d.Get("destination_address_prefix").(string),
+		DestinationPortRange:     d.Get("destination_port_range").(string),
+		Protocol:                 netsecgroup.RuleProtocol(d.Get("protocol").(string)),
+	}
+
+	// apply the rule to all the necessary network security groups:
+	secGroups := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroups {
+		secGroup := sg.(string)
+
+		// send the create request to Azure:
+		log.Printf("[INFO] Sending Azure security group rule addition request for security group %q.", secGroup)
+		reqID, err := secGroupClient.SetNetworkSecurityGroupRule(
+			secGroup,
+			rule,
+		)
+		if err != nil {
+			return fmt.Errorf("Error sending Azure network security group rule creation request for security group %q: %s", secGroup, err)
+		}
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error creating Azure network security group rule for security group %q: %s", secGroup, err)
+		}
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleRead does all the necessary API calls to
+// read the state of a network security group ruke off Azure.
+func resourceAzureSecurityGroupRuleRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	secGroupClient := azureClient.secGroupClient
+
+	var found bool
+	name := d.Get("name").(string)
+
+	secGroups := d.Get("security_group_names").(*schema.Set).List()
+	remaining := schema.NewSet(schema.HashString, nil)
+
+	// for each of our security groups; check for our rule:
+	for _, sg := range secGroups {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and check its rules for this one:
+		log.Printf("[INFO] Sending Azure network security group rule query for security group %s.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf("Error issuing network security group rules query for security group %q: %s", secGroupName, err)
+			} else {
+				// it meants that the network security group this rule belonged to has
+				// been deleted; so we skip this iteration:
+				continue
+			}
+		}
+
+		// find our security rule:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// note the fact that this rule still apllies to this security group:
+				found = true
+				remaining.Add(secGroupName)
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is any security group still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// now; we must update the set of security groups still having this rule:
+	d.Set("security_group_names", remaining)
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleUpdate does all the necessary API calls to
+// update the state of a network security group rule off Azure.
+func resourceAzureSecurityGroupRuleUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	var found bool
+	name := d.Get("name").(string)
+	newRule := netsecgroup.RuleRequest{
+		Name:                     d.Get("name").(string),
+		Type:                     netsecgroup.RuleType(d.Get("type").(string)),
+		Priority:                 d.Get("priority").(int),
+		Action:                   netsecgroup.RuleAction(d.Get("action").(string)),
+		SourceAddressPrefix:      d.Get("source_address_prefix").(string),
+		SourcePortRange:          d.Get("source_port_range").(string),
+		DestinationAddressPrefix: d.Get("destination_address_prefix").(string),
+		DestinationPortRange:     d.Get("destination_port_range").(string),
+		Protocol:                 netsecgroup.RuleProtocol(d.Get("protocol").(string)),
+	}
+
+	// iterate over all the security groups that should have this rule and
+	// update it per security group:
+	remaining := schema.NewSet(schema.HashString, nil)
+	secGroupNames := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroupNames {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and check its rules for this one:
+		log.Printf("[INFO] Sending Azure network security group rule query for security group %q.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf("Error issuing network security group rules query: %s", err)
+			} else {
+				// it meants that the network security group this rule belonged to has
+				// been deleted; so we skip this iteration:
+				continue
+			}
+		}
+
+		// try and find our security group rule:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// note the fact that this rule still applies to this security group:
+				found = true
+				remaining.Add(secGroupName)
+
+				// and go ahead and update it:
+				log.Printf("[INFO] Sending Azure network security group rule update request for security group %q.", secGroupName)
+				reqID, err := secGroupClient.SetNetworkSecurityGroupRule(
+					secGroupName,
+					newRule,
+				)
+				if err != nil {
+					return fmt.Errorf("Error sending Azure network security group rule update request for security group %q: %s", secGroupName, err)
+				}
+				err = mgmtClient.WaitForOperation(reqID, nil)
+				if err != nil {
+					return fmt.Errorf("Error updating Azure network security group rule for security group %q: %s", secGroupName, err)
+				}
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is any security group still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// here; we must update the set of security groups still having this rule:
+	d.Set("security_group_names", remaining)
+
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleDelete does all the necessary API calls to
+// delete a network security group rule off Azure.
+func resourceAzureSecurityGroupRuleDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	name := d.Get("name").(string)
+	secGroupNames := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroupNames {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and search for our rule:
+		log.Printf("[INFO] Sending network security group rule query for security group %q.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if management.IsResourceNotFoundError(err) {
+				// it means that this network security group this rule belonged to has
+				// been deleted; so we need not do anything more here:
+				continue
+			} else {
+				return fmt.Errorf("Error issuing Azure network security group rules query for security group %q: %s", secGroupName, err)
+			}
+		}
+
+		// check if the rule has been deleted in the meantime:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// if not; we shall issue the delete:
+				reqID, err := secGroupClient.DeleteNetworkSecurityGroupRule(secGroupName, name)
+				if err != nil {
+					return fmt.Errorf("Error sending network security group rule delete request to Azure: %s", err)
+				}
+				err = mgmtClient.WaitForOperation(reqID, nil)
+				if err != nil {
+					return fmt.Errorf("Error deleting network security group rule off Azure: %s", err)
+				}
+			}
+			break
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_security_group_rule_test.go b/builtin/providers/azure/resource_azure_security_group_rule_test.go
new file mode 100644
index 000000000..ec430f098
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_rule_test.go
@@ -0,0 +1,249 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+var (
+	testAcctestingSecurityGroup1     = fmt.Sprintf("%s-%d", testAccSecurityGroupName, 1)
+	testAccTestingSecurityGroupHash1 = fmt.Sprintf("%d", schema.HashString(testAcctestingSecurityGroup1))
+
+	testAcctestingSecurityGroup2     = fmt.Sprintf("%s-%d", testAccSecurityGroupName, 2)
+	testAccTestingSecurityGroupHash2 = fmt.Sprintf("%d", schema.HashString(testAcctestingSecurityGroup2))
+)
+
+func TestAccAzureSecurityGroupRuleBasic(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted([]string{testAccSecurityGroupName}),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleBasicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAccSecurityGroupName),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name,
+						fmt.Sprintf("security_group_names.%d", schema.HashString(testAccSecurityGroupName)),
+						testAccSecurityGroupName),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSecurityGroupRuleAdvanced(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted(
+			[]string{
+				testAcctestingSecurityGroup1,
+				testAcctestingSecurityGroup2,
+			},
+		),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup1),
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash1), testAcctestingSecurityGroup1),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSecurityGroupRuleUpdate(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted(
+			[]string{
+				testAcctestingSecurityGroup1,
+				testAcctestingSecurityGroup2,
+			},
+		),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup1),
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash1), testAcctestingSecurityGroup1),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Outbound"),
+					resource.TestCheckResourceAttr(name, "action", "Allow"),
+					resource.TestCheckResourceAttr(name, "priority", "100"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "101.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1001"),
+					resource.TestCheckResourceAttr(name, "protocol", "UDP"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSecurityGroupRuleExists(name, groupName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure security group rule not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure network security group rule ID not set: %s", name)
+		}
+
+		secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+		secGroup, err := secGroupClient.GetNetworkSecurityGroup(groupName)
+		if err != nil {
+			return fmt.Errorf("Failed getting network security group details for %q: %s", groupName, err)
+		}
+
+		for _, rule := range secGroup.Rules {
+			if rule.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Azure security group rule doesn't exist: %s", name)
+	}
+}
+
+func testAccCheckAzureSecurityGroupRuleDeleted(groups []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_security_group_rule" {
+				continue
+			}
+
+			if resource.Primary.ID == "" {
+				return fmt.Errorf("Azure network security group ID not set.")
+			}
+
+			secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+			for _, groupName := range groups {
+				secGroup, err := secGroupClient.GetNetworkSecurityGroup(groupName)
+				if err != nil {
+					if !management.IsResourceNotFoundError(err) {
+						return fmt.Errorf("Failed getting network security group details for %q: %s", groupName, err)
+					}
+				}
+
+				for _, rule := range secGroup.Rules {
+					if rule.Name == resource.Primary.ID {
+						return fmt.Errorf("Azure network security group rule still exists!")
+					}
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureSecurityGroupRuleBasicConfig = testAccAzureSecurityGroupConfig + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+`
+var testAccAzureSecurityGroupRuleAdvancedConfig = fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "foo", testAcctestingSecurityGroup1) +
+	fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "bar", testAcctestingSecurityGroup2) + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}", "${azure_security_group.bar.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+`
+
+var testAccAzureSecurityGroupRuleUpdateConfig = fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "foo", testAcctestingSecurityGroup1) +
+	fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "bar", testAcctestingSecurityGroup2) + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.bar.name}"]
+	type = "Outbound"
+	action = "Allow"
+	priority = 100
+	source_address_prefix = "101.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1001"
+	protocol = "UDP"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_security_group_test.go b/builtin/providers/azure/resource_azure_security_group_test.go
new file mode 100644
index 000000000..3d86d0873
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_test.go
@@ -0,0 +1,102 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSecurityGroup_basic(t *testing.T) {
+	var group networksecuritygroup.SecurityGroupResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupExists(
+						"azure_security_group.foo", &group),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "name", "terraform-security-group"),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "label", "terraform testing security group"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSecurityGroupExists(
+	n string,
+	group *networksecuritygroup.SecurityGroupResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Network Security Group ID is set")
+		}
+
+		secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+		sg, err := secGroupClient.GetNetworkSecurityGroup(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		if sg.Name != rs.Primary.ID {
+			return fmt.Errorf("Security Group not found")
+		}
+
+		*group = sg
+
+		return nil
+	}
+}
+
+func testAccCheckAzureSecurityGroupDestroy(s *terraform.State) error {
+	secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_security_group" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Network Security Group ID is set")
+		}
+
+		_, err := secGroupClient.GetNetworkSecurityGroup(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network Security Group %s still exists", rs.Primary.ID)
+		}
+
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureSecurityGroupConfigTemplate = `
+resource "azure_security_group" "%s" {
+    name = "%s"
+    location = "West US"
+    label = "terraform testing security group"
+}`
+
+var testAccAzureSecurityGroupConfig = fmt.Sprintf(
+	testAccAzureSecurityGroupConfigTemplate,
+	"foo", "terraform-security-group",
+)
diff --git a/builtin/providers/azure/resource_azure_sql_database_server.go b/builtin/providers/azure/resource_azure_sql_database_server.go
new file mode 100644
index 000000000..b3412b7b3
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server.go
@@ -0,0 +1,118 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureDatabaseServer returns the *schema.Resource associated
+// to a database server on Azure.
+func resourceAzureSqlDatabaseServer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServerCreate,
+		Read:   resourceAzureSqlDatabaseServerRead,
+		Delete: resourceAzureSqlDatabaseServerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"username": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"password": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"version": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "12.0",
+				ForceNew: true,
+			},
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServerCreate does all the necessary API calls to
+// create an SQL database server off Azure.
+func resourceAzureSqlDatabaseServerCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Began constructing SQL Server creation request.")
+	params := sql.DatabaseServerCreateParams{
+		Location:                   d.Get("location").(string),
+		AdministratorLogin:         d.Get("username").(string),
+		AdministratorLoginPassword: d.Get("password").(string),
+		Version:                    d.Get("version").(string),
+	}
+
+	log.Println("[INFO] Issuing SQL Server creation request to Azure.")
+	name, err := sqlClient.CreateServer(params)
+	if err != nil {
+		return fmt.Errorf("Error creating SQL Server on Azure: %s", err)
+	}
+
+	d.Set("name", name)
+
+	d.SetId(name)
+	return resourceAzureSqlDatabaseServerRead(d, meta)
+}
+
+// resourceAzureSqlDatabaseServerRead does all the necessary API calls to
+// read the state of the SQL database server off Azure.
+func resourceAzureSqlDatabaseServerRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Sending SQL Servers list query to Azure.")
+	srvList, err := sqlClient.ListServers()
+	if err != nil {
+		return fmt.Errorf("Error issuing SQL Servers list query to Azure: %s", err)
+	}
+
+	// search for our particular server:
+	name := d.Get("name")
+	for _, srv := range srvList.DatabaseServers {
+		if srv.Name == name {
+			d.Set("url", srv.FullyQualifiedDomainName)
+			d.Set("state", srv.State)
+			return nil
+		}
+	}
+
+	// if reached here; it means out server doesn't exist, so we must untrack it:
+	d.SetId("")
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerDelete does all the necessary API calls to
+// delete the SQL database server off Azure.
+func resourceAzureSqlDatabaseServerDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Sending SQL Server deletion request to Azure.")
+	name := d.Get("name").(string)
+	err := sqlClient.DeleteServer(name)
+	if err != nil {
+		return fmt.Errorf("Error while issuing SQL Server deletion request to Azure: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go
new file mode 100644
index 000000000..a5cb0b214
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go
@@ -0,0 +1,222 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSqlDatabaseServerFirewallRule returns the *schema.Resource
+// associated to a firewall rule of a database server in Azure.
+func resourceAzureSqlDatabaseServerFirewallRule() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServerFirewallRuleCreate,
+		Read:   resourceAzureSqlDatabaseServerFirewallRuleRead,
+		Update: resourceAzureSqlDatabaseServerFirewallRuleUpdate,
+		Delete: resourceAzureSqlDatabaseServerFirewallRuleDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"database_server_names": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Set: schema.HashString,
+			},
+			"start_ip": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"end_ip": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleCreate does all the necessary API
+// calls to create the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	params := sql.FirewallRuleCreateParams{
+		Name:           name,
+		StartIPAddress: d.Get("start_ip").(string),
+		EndIPAddress:   d.Get("end_ip").(string),
+	}
+
+	// loop over all the database servers and apply the firewall rule to each:
+	serverNames := d.Get("database_server_names").(*schema.Set).List()
+	for _, srv := range serverNames {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule %q creation request for Server %q.", name, serverName)
+		if err := sqlClient.CreateFirewallRule(serverName, params); err != nil {
+			return fmt.Errorf("Error creating Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+		}
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleRead does all the necessary API
+// calls to read the state of the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	remaining := schema.NewSet(schema.HashString, nil)
+
+	// for each of our servers; check to see if the rule is still present:
+	var found bool
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule list query for server %q.", serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				found = true
+				remaining.Add(serverName)
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is still any Database Server still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// else; update the list of Database Servers still having this rule:
+	d.Set("database_server_names", remaining)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleUpdate does all the necessary API
+// calls to update the state of the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleUpdate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	var found bool
+	name := d.Get("name").(string)
+	updateParams := sql.FirewallRuleUpdateParams{
+		Name:           name,
+		StartIPAddress: d.Get("start_ip").(string),
+		EndIPAddress:   d.Get("end_ip").(string),
+	}
+
+	// for each of the Database Servers our rules concerns; issue the update:
+	remaining := schema.NewSet(schema.HashString, nil)
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Issuing Azure Database Server Firewall Rule list for Database Server %q: %s.", name, serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				// take note of the fact that this Database Server still has
+				// this rule:
+				found = true
+				remaining.Add(serverName)
+
+				// go ahead and update the rule:
+				log.Printf("[INFO] Issuing update of Azure Database Server Firewall Rule %q in Server %q.", name, serverName)
+				if err := sqlClient.UpdateFirewallRule(serverName, name, updateParams); err != nil {
+					return fmt.Errorf("Error updating Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+				}
+
+				break
+			}
+		}
+	}
+
+	// check to see if the rule is still exists on any of the servers:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// else; update the list with the remaining Servers:
+	d.Set("database_server_names", remaining)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleDelete does all the necessary API
+// calls to delete the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule list query for Server %q.", serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				// go ahead and delete the rule:
+				log.Printf("[INFO] Issuing deletion of Azure Database Server Firewall Rule %q in Server %q.", name, serverName)
+				if err := sqlClient.DeleteFirewallRule(serverName, name); err != nil {
+					return fmt.Errorf("Error deleting Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+				}
+
+				break
+			}
+		}
+
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go
new file mode 100644
index 000000000..9202be7e1
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go
@@ -0,0 +1,235 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSqlDatabaseServerFirewallRuleBasic(t *testing.T) {
+	name := "azure_sql_database_server_firewall_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleBasicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(1),
+					testAccAzureDatabaseServerFirewallRuleExists(name, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-rule"),
+					resource.TestCheckResourceAttr(name, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name, "end_ip", "10.0.0.255"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServerFirewallRuleAdvanced(t *testing.T) {
+	name1 := "azure_sql_database_server_firewall_rule.foo"
+	name2 := "azure_sql_database_server_firewall_rule.bar"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "10.0.0.255"),
+					testAccAzureDatabaseServerFirewallRuleExists(name2, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name2, "name", "terraform-testing-rule2"),
+					resource.TestCheckResourceAttr(name2, "start_ip", "200.0.0.0"),
+					resource.TestCheckResourceAttr(name2, "end_ip", "200.255.255.255"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServerFirewallRuleUpdate(t *testing.T) {
+	name1 := "azure_sql_database_server_firewall_rule.foo"
+	name2 := "azure_sql_database_server_firewall_rule.bar"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "10.0.0.255"),
+					testAccAzureDatabaseServerFirewallRuleExists(name2, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name2, "name", "terraform-testing-rule2"),
+					resource.TestCheckResourceAttr(name2, "start_ip", "200.0.0.0"),
+					resource.TestCheckResourceAttr(name2, "end_ip", "200.255.255.255"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "11.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "11.0.0.255"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAzureDatabaseServerFirewallRuleExists(name string, servers []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Database Server Firewall Rule %q doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Database Server Firewall Rule %q resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+
+		for _, server := range servers {
+			rules, err := sqlClient.ListFirewallRules(server)
+			if err != nil {
+				return fmt.Errorf("Error listing Azure Database Server Firewall Rules for Server %q: %s", server, err)
+			}
+
+			var found bool
+			for _, rule := range rules.FirewallRules {
+				if rule.Name == resource.Primary.ID {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return fmt.Errorf("Azure Database Server Firewall Rule %q doesn't exists on server %q.", resource.Primary.ID, server)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccAzureDatabaseServerFirewallRuleDeleted(servers []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_sql_database_server_firewall_rule" {
+				continue
+			}
+
+			if resource.Primary.ID == "" {
+				return fmt.Errorf("Azure Database Server Firewall Rule resource ID not set.")
+			}
+
+			sqlClient := testAccProvider.Meta().(*Client).sqlClient
+
+			for _, server := range servers {
+				rules, err := sqlClient.ListFirewallRules(server)
+				if err != nil {
+					return fmt.Errorf("Error listing Azure Database Server Firewall Rules for Server %q: %s", server, err)
+				}
+
+				for _, rule := range rules.FirewallRules {
+					if rule.Name == resource.Primary.ID {
+						return fmt.Errorf("Azure Database Server Firewall Rule %q still exists on Server %q.", resource.Primary.ID, err)
+					}
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureDatabaseServerFirewallRuleBasicConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule"
+	depends_on = ["azure_sql_database_server.foo"]
+	start_ip = "10.0.0.0"
+	end_ip = "10.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}"]
+}
+`
+
+var testAccAzureDatabaseServerFirewallRuleAdvancedConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server" "bar" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule1"
+	start_ip = "10.0.0.0"
+	end_ip = "10.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}", "${azure_sql_database_server.bar.name}"]
+}
+
+resource "azure_sql_database_server_firewall_rule" "bar" {
+	name = "terraform-testing-rule2"
+	start_ip = "200.0.0.0"
+	end_ip = "200.255.255.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}", "${azure_sql_database_server.bar.name}"]
+}
+`
+
+var testAccAzureDatabaseServerFirewallRuleUpdateConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server" "bar" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule1"
+	start_ip = "11.0.0.0"
+	end_ip = "11.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}"]
+}
+`
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_test.go b/builtin/providers/azure/resource_azure_sql_database_server_test.go
new file mode 100644
index 000000000..cee7cb4ed
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_test.go
@@ -0,0 +1,158 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+// testAccAzureSqlServerName is a helper variable in which to store
+// the randomly-generated name of the SQL Server after it is created.
+// The anonymous function is there because go is too good to &"" directly.
+var testAccAzureSqlServerName *string = func(s string) *string { return &s }("")
+var testAccAzureSqlServerNames []string = []string{}
+
+func TestAccAzureSqlDatabaseServer(t *testing.T) {
+	name := "azure_sql_database_server.foo"
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServerDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServerConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServerExists(name),
+					resource.TestCheckResourceAttrPtr(name, "name", testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "username", "SuperUser"),
+					resource.TestCheckResourceAttr(name, "password", "SuperSEKR3T"),
+					resource.TestCheckResourceAttr(name, "version", "2.0"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSqlDatabaseServerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("SQL Server %s doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Server %s resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		servers, err := sqlClient.ListServers()
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Server list request: %s", err)
+		}
+
+		for _, srv := range servers.DatabaseServers {
+			if srv.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("SQL Server %s doesn't exist.", name)
+	}
+}
+
+func testAccCheckAzureSqlDatabaseServerDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Server resource ID not set.")
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		servers, err := sqlClient.ListServers()
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Server list request: %s", err)
+		}
+
+		for _, srv := range servers.DatabaseServers {
+			if srv.Name == resource.Primary.ID {
+				fmt.Errorf("SQL Server %s still exists.", resource.Primary.ID)
+			}
+		}
+	}
+	return nil
+}
+
+// testAccAzureSqlDatabaseServerGetName is ahelper function which reads the current
+// state form Terraform and sets the testAccAzureSqlServerName variable
+// to the ID (which is actually the name) of the newly created server.
+// It is modeled as a resource.TestCheckFunc so as to be easily-embeddable in
+// test cases and run live.
+func testAccAzureSqlDatabaseServerGetName(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure SQL Server resource ID not set.")
+		}
+
+		*testAccAzureSqlServerName = resource.Primary.ID
+		return nil
+	}
+
+	return fmt.Errorf("No Azure SQL Servers found.")
+}
+
+// testAccAzureSqlDatabaseServerGetNames is the same as the above; only it gets
+// all the servers' names.
+func testAccAzureSqlDatabaseServerGetNames(s *terraform.State) error {
+	testAccAzureSqlServerNames = []string{}
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure SQL Server resource ID not set.")
+		}
+
+		testAccAzureSqlServerNames = append(testAccAzureSqlServerNames, resource.Primary.ID)
+	}
+
+	if len(testAccAzureSqlServerNames) == 0 {
+		return fmt.Errorf("No Azure SQL Servers found.")
+	}
+
+	return nil
+}
+
+// testAccAzureSqlDatabaseServersNumber checks if the numbers of servers is
+// exactly equal to the given number. It is modeled as a resource.TestCheckFunc
+// to be easily embeddable in test checks.
+func testAccAzureSqlDatabaseServersNumber(n int) resource.TestCheckFunc {
+	return func(_ *terraform.State) error {
+		if len(testAccAzureSqlServerNames) != n {
+			return fmt.Errorf("Erroneous number of Azure Sql Database Servers. Expected %d; have %d.", n,
+				len(testAccAzureSqlServerNames))
+		}
+
+		return nil
+	}
+}
+
+const testAccAzureSqlDatabaseServerConfig = `
+resource "azure_sql_database_server" "foo" {
+    location = "West US"
+    username = "SuperUser"
+    password = "SuperSEKR3T"
+    version = "2.0"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_sql_database_service.go b/builtin/providers/azure/resource_azure_sql_database_service.go
new file mode 100644
index 000000000..29824d743
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_service.go
@@ -0,0 +1,234 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSqlDatabaseService returns the *schema.Resource
+// associated to an SQL Database Service on Azure.
+func resourceAzureSqlDatabaseService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServiceCreate,
+		Read:   resourceAzureSqlDatabaseServiceRead,
+		Update: resourceAzureSqlDatabaseServiceUpdate,
+		Exists: resourceAzureSqlDatabaseServiceExists,
+		Delete: resourceAzureSqlDatabaseServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"database_server_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"collation": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"edition": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"max_size_bytes": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"service_level_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServiceCreate does all the necessary API calls to
+// create an SQL Database Service on Azure.
+func resourceAzureSqlDatabaseServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Creating Azure SQL Database service creation request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	params := sql.DatabaseCreateParams{
+		Name:               name,
+		Edition:            d.Get("edition").(string),
+		CollationName:      d.Get("collation").(string),
+		ServiceObjectiveID: d.Get("service_level_id").(string),
+	}
+
+	if maxSize, ok := d.GetOk("max_size_bytes"); ok {
+		val, err := strconv.ParseInt(maxSize.(string), 10, 64)
+		if err != nil {
+			return fmt.Errorf("Provided max_size_bytes is not an integer: %s", err)
+		}
+		params.MaxSizeBytes = val
+	}
+
+	log.Println("[INFO] Sending SQL Database Service creation request to Azure.")
+	err := sqlClient.CreateDatabase(serverName, params)
+	if err != nil {
+		return fmt.Errorf("Error issuing Azure SQL Database Service creation: %s", err)
+	}
+
+	log.Println("[INFO] Beginning wait for Azure SQL Database Service creation.")
+	err = sqlClient.WaitForDatabaseCreation(serverName, name, nil)
+	if err != nil {
+		return fmt.Errorf("Error whilst waiting for Azure SQL Database Service creation: %s", err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureSqlDatabaseServiceRead(d, meta)
+}
+
+// resourceAzureSqlDatabaseServiceRead does all the necessary API calls to
+// read the state of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database Services list operation.")
+	serverName := d.Get("database_server_name").(string)
+	dbs, err := sqlClient.ListDatabases(serverName)
+	if err != nil {
+		return fmt.Errorf("Error whilst listing Database Services off Azure: %s", err)
+	}
+
+	// search for our database:
+	var found bool
+	name := d.Get("name").(string)
+	for _, db := range dbs.ServiceResources {
+		if db.Name == name {
+			found = true
+			d.Set("edition", db.Edition)
+			d.Set("collation", db.CollationName)
+			d.Set("max_size_bytes", strconv.FormatInt(db.MaxSizeBytes, 10))
+			d.Set("service_level_id", db.ServiceObjectiveID)
+			break
+		}
+	}
+
+	// if not found; we must untrack the resource:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureSqlDatabaseServiceUpdate does all the necessary API calls to
+// update the state of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	sqlClient := azureClient.sqlClient
+	serverName := d.Get("database_server_name").(string)
+
+	// changes to the name must occur seperately from changes to the attributes:
+	if d.HasChange("name") {
+		oldv, newv := d.GetChange("name")
+
+		// issue the update request:
+		log.Println("[INFO] Issuing Azure Database Service name change.")
+		reqID, err := sqlClient.UpdateDatabase(serverName, oldv.(string),
+			sql.ServiceResourceUpdateParams{
+				Name: newv.(string),
+			})
+
+		// wait for the update to occur:
+		log.Println("[INFO] Waiting for Azure SQL Database Service name change.")
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error waiting for Azure SQL Database Service name update: %s", err)
+		}
+
+		// set the new name as the ID:
+		d.SetId(newv.(string))
+	}
+
+	name := d.Get("name").(string)
+	cedition := d.HasChange("edition")
+	cmaxsize := d.HasChange("max_size_bytes")
+	clevel := d.HasChange("service_level_id")
+	if cedition || cmaxsize || clevel {
+		updateParams := sql.ServiceResourceUpdateParams{
+			// we still have to stick the name in here for good measure:
+			Name: name,
+		}
+
+		// build the update request:
+		if cedition {
+			updateParams.Edition = d.Get("edition").(string)
+		}
+		if maxSize, ok := d.GetOk("max_size_bytes"); cmaxsize && ok && maxSize.(string) != "" {
+			val, err := strconv.ParseInt(maxSize.(string), 10, 64)
+			if err != nil {
+				return fmt.Errorf("Provided max_size_bytes is not an integer: %s", err)
+			}
+			updateParams.MaxSizeBytes = val
+		}
+		if clevel {
+			updateParams.ServiceObjectiveID = d.Get("service_level_id").(string)
+		}
+
+		// issue the update:
+		log.Println("[INFO] Issuing Azure Database Service parameter update.")
+		reqID, err := sqlClient.UpdateDatabase(serverName, name, updateParams)
+		if err != nil {
+			return fmt.Errorf("Failed issuing Azure SQL Service paramater update: %s", err)
+		}
+
+		log.Println("[INFO] Waiting for Azure SQL Database Service parameter update.")
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error waiting for Azure SQL Database Service parameter update: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureSqlDatabaseServiceExists does all the necessary API calls to
+// check for the existence of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database Service get request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	_, err := sqlClient.GetDatabase(serverName, name)
+	if err != nil {
+		if strings.Contains(err.Error(), "does not exist") {
+			d.SetId("")
+			return false, nil
+		} else {
+			return false, fmt.Errorf("Error whilst getting Azure SQL Database Service info: %s", err)
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureSqlDatabaseServiceDelete does all the necessary API calls to
+// delete the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database deletion request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	return sqlClient.DeleteDatabase(serverName, name)
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_service_test.go b/builtin/providers/azure/resource_azure_sql_database_service_test.go
new file mode 100644
index 000000000..24d865774
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_service_test.go
@@ -0,0 +1,190 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSqlDatabaseServiceBasic(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "collation",
+						"SQL_Latin1_General_CP1_CI_AS"),
+					resource.TestCheckResourceAttr(name, "edition", "Standard"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServiceAdvanced(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigAdvanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Premium"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"Arabic_BIN"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "10737418240"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"7203483a-c4fb-4304-9e9f-17c71c904f5d"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServiceUpdate(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigAdvanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Premium"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"Arabic_BIN"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "10737418240"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"7203483a-c4fb-4304-9e9f-17c71c904f5d"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name",
+						"terraform-testing-db-renamed"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Standard"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"SQL_Latin1_General_CP1_CI_AS"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "5368709120"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"f1173c43-91bd-4aaa-973c-54e79e15235b"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSqlDatabaseServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("SQL Service %s doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Service %s resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		dbs, err := sqlClient.ListDatabases(*testAccAzureSqlServerName)
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Service list request: %s", err)
+		}
+
+		for _, srv := range dbs.ServiceResources {
+			if srv.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("SQL Service %s doesn't exist.", name)
+	}
+}
+
+func testAccCheckAzureSqlDatabaseServiceDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Service resource ID not set.")
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		dbs, err := sqlClient.ListDatabases(*testAccAzureSqlServerName)
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Service list request: %s", err)
+		}
+
+		for _, srv := range dbs.ServiceResources {
+			if srv.Name == resource.Primary.ID {
+				fmt.Errorf("SQL Service %s still exists.", resource.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureSqlDatabaseServiceConfigBasic = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Standard"
+}
+`
+
+const testAccAzureSqlDatabaseServiceConfigAdvanced = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Premium"
+    collation = "Arabic_BIN"
+    max_size_bytes = "10737418240"
+    service_level_id = "7203483a-c4fb-4304-9e9f-17c71c904f5d"
+}
+`
+
+const testAccAzureSqlDatabaseServiceConfigUpdate = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db-renamed"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Standard"
+    collation = "SQL_Latin1_General_CP1_CI_AS"
+    max_size_bytes = "5368709120"
+    service_level_id = "f1173c43-91bd-4aaa-973c-54e79e15235b"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_storage_blob.go b/builtin/providers/azure/resource_azure_storage_blob.go
new file mode 100644
index 000000000..de2431c2f
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_blob.go
@@ -0,0 +1,184 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageBlob returns the *schema.Resource associated
+// with a storage blob on Azure.
+func resourceAzureStorageBlob() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageBlobCreate,
+		Read:   resourceAzureStorageBlobRead,
+		Update: resourceAzureStorageBlobUpdate,
+		Exists: resourceAzureStorageBlobExists,
+		Delete: resourceAzureStorageBlobDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["type"],
+			},
+			"size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true,
+				DefaultFunc: func() (interface{}, error) {
+					return int64(0), nil
+				},
+			},
+			"storage_container_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_container_name"],
+			},
+			"storage_service_name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+			"url": &schema.Schema{
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: parameterDescriptions["url"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageBlobCreate does all the necessary API calls to
+// create the storage blob on Azure.
+func resourceAzureStorageBlobCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing create on Azure storage blob.")
+	name := d.Get("name").(string)
+	blobType := d.Get("type").(string)
+	cont := d.Get("storage_container_name").(string)
+	switch blobType {
+	case "BlockBlob":
+		err = blobClient.CreateBlockBlob(cont, name)
+	case "PageBlob":
+		size := int64(d.Get("size").(int))
+		err = blobClient.PutPageBlob(cont, name, size)
+	default:
+		err = fmt.Errorf("Invalid blob type specified; see parameter desciptions for more info.")
+	}
+	if err != nil {
+		return fmt.Errorf("Error creating storage blob on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageBlobRead(d, meta)
+}
+
+// resourceAzureStorageBlobRead does all the necessary API calls to
+// read the status of the storage blob off Azure.
+func resourceAzureStorageBlobRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+
+	// check for it's existence:
+	exists, err := resourceAzureStorageBlobExists(d, meta)
+	if err != nil {
+		return err
+	}
+
+	// if it exists; read relevant information:
+	if exists {
+		storName := d.Get("storage_service_name").(string)
+
+		blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+		if err != nil {
+			return err
+		}
+
+		name := d.Get("name").(string)
+		cont := d.Get("storage_container_name").(string)
+		url := blobClient.GetBlobURL(cont, name)
+		d.Set("url", url)
+	}
+
+	// NOTE: no need to unset the ID here, as resourceAzureStorageBlobExists
+	// already should have done so if it were required.
+	return nil
+}
+
+// resourceAzureStorageBlobUpdate does all the necessary API calls to
+// update a blob on Azure.
+func resourceAzureStorageBlobUpdate(d *schema.ResourceData, meta interface{}) error {
+	// NOTE: although empty as most paramters have ForceNew set; this is
+	// still required in case of changes to the storage_service_key
+
+	// run the ExistsFunc beforehand to ensure the resource's existence nonetheless:
+	_, err := resourceAzureStorageBlobExists(d, meta)
+	return err
+}
+
+// resourceAzureStorageBlobExists does all the necessary API calls to
+// check for the existence of the blob on Azure.
+func resourceAzureStorageBlobExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return false, err
+	}
+
+	log.Println("[INFO] Querying Azure for storage blob's existence.")
+	name := d.Get("name").(string)
+	cont := d.Get("storage_container_name").(string)
+	exists, err := blobClient.BlobExists(cont, name)
+	if err != nil {
+		return false, fmt.Errorf("Error whilst checking for Azure storage blob's existence: %s", err)
+	}
+
+	// if not found; it means it was deleted in the meantime and
+	// we must remove it from the schema.
+	if !exists {
+		d.SetId("")
+	}
+
+	return exists, nil
+}
+
+// resourceAzureStorageBlobDelete does all the necessary API calls to
+// delete the blob off Azure.
+func resourceAzureStorageBlobDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing storage blob delete command off Azure.")
+	name := d.Get("name").(string)
+	cont := d.Get("storage_container_name").(string)
+	if _, err = blobClient.DeleteBlobIfExists(cont, name); err != nil {
+		return fmt.Errorf("Error whilst deleting storage blob: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_blob_test.go b/builtin/providers/azure/resource_azure_storage_blob_test.go
new file mode 100644
index 000000000..d559a6bcd
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_blob_test.go
@@ -0,0 +1,153 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageBlockBlob(t *testing.T) {
+	name := "azure_storage_blob.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageBlobDeleted("block"),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageBlockBlobConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageBlobExists(name, "block"),
+					resource.TestCheckResourceAttr(name, "name", "tftesting-blob"),
+					resource.TestCheckResourceAttr(name, "type", "BlockBlob"),
+					resource.TestCheckResourceAttr(name, "storage_container_name",
+						fmt.Sprintf("%s-block", testAccStorageContainerName)),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureStoragePageBlob(t *testing.T) {
+	name := "azure_storage_blob.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageBlobDeleted("page"),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStoragePageBlobConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageBlobExists(name, "page"),
+					resource.TestCheckResourceAttr(name, "name", "tftesting-blob"),
+					resource.TestCheckResourceAttr(name, "type", "PageBlob"),
+					resource.TestCheckResourceAttr(name, "size", "512"),
+					resource.TestCheckResourceAttr(name, "storage_container_name",
+						fmt.Sprintf("%s-page", testAccStorageContainerName)),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureStorageBlobExists(name, typ string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Container resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Container ID not set: %s", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.BlobExists(fmt.Sprintf("%s-%s", testAccStorageContainerName, typ),
+			resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Blob %s doesn't exist.", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageBlobDeleted(typ string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_storage_blob" {
+				continue
+			}
+
+			azureClient := testAccProvider.Meta().(*Client)
+			blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+			if err != nil {
+				return err
+			}
+
+			exists, err := blobClient.BlobExists(fmt.Sprintf("%s-%s", testAccStorageContainerName,
+				typ), resource.Primary.ID)
+			if err != nil {
+				return err
+			}
+			if exists {
+				return fmt.Errorf("Azure Storage Blob still exists.")
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureStorageBlockBlobConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s-block"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+
+resource "azure_storage_blob" "foo" {
+	name = "tftesting-blob"
+	type = "BlockBlob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "${azure_storage_container.foo.storage_service_name}"
+	storage_container_name = "${azure_storage_container.foo.name}"
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
+
+var testAccAzureStoragePageBlobConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s-page"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+
+resource "azure_storage_blob" "foo" {
+	name = "tftesting-blob"
+	type = "PageBlob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "${azure_storage_container.foo.storage_service_name}"
+	storage_container_name = "${azure_storage_container.foo.name}"
+    # NOTE: must be a multiple of 512:
+    size = 512
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_container.go b/builtin/providers/azure/resource_azure_storage_container.go
new file mode 100644
index 000000000..8b8e375da
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_container.go
@@ -0,0 +1,163 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/storage"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageContainer returns the *schema.Resource associated
+// to a storage container on Azure.
+func resourceAzureStorageContainer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageContainerCreate,
+		Read:   resourceAzureStorageContainerRead,
+		Exists: resourceAzureStorageContainerExists,
+		Delete: resourceAzureStorageContainerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"storage_service_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+			"container_access_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["container_access_type"],
+			},
+			"properties": &schema.Schema{
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Elem:        schema.TypeString,
+				Description: parameterDescriptions["properties"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageContainerCreate does all the necessary API calls to
+// create the storage container on Azure.
+func resourceAzureStorageContainerCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Creating storage container on Azure.")
+	name := d.Get("name").(string)
+	accessType := storage.ContainerAccessType(d.Get("container_access_type").(string))
+	err = blobClient.CreateContainer(name, accessType)
+	if err != nil {
+		return fmt.Errorf("Failed to create storage container on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageContainerRead(d, meta)
+}
+
+// resourceAzureStorageContainerRead does all the necessary API calls to
+// read the status of the storage container off Azure.
+func resourceAzureStorageContainerRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Querying Azure for storage containers.")
+	name := d.Get("name").(string)
+	containers, err := blobClient.ListContainers(storage.ListContainersParameters{
+		Prefix:  name,
+		Timeout: 90,
+	})
+	if err != nil {
+		return fmt.Errorf("Failed to query Azure for its storage containers: %s", err)
+	}
+
+	// search for our storage container and update its stats:
+	var found bool
+	// loop just to make sure we got the right container:
+	for _, cont := range containers.Containers {
+		if cont.Name == name {
+			found = true
+
+			props := make(map[string]interface{})
+			props["last_modified"] = cont.Properties.LastModified
+			props["lease_status"] = cont.Properties.LeaseStatus
+			props["lease_state"] = cont.Properties.LeaseState
+			props["lease_duration"] = cont.Properties.LeaseDuration
+
+			d.Set("properties", props)
+		}
+	}
+
+	// if not found; it means the resource has been deleted
+	// in the meantime; so we must untrack it:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureStorageContainerExists does all the necessary API calls to
+// check if the storage container already exists on Azure.
+func resourceAzureStorageContainerExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return false, err
+	}
+
+	log.Println("[INFO] Checking existence of storage container on Azure.")
+	name := d.Get("name").(string)
+	exists, err := blobClient.ContainerExists(name)
+	if err != nil {
+		return false, fmt.Errorf("Failed to query for Azure storage container existence: %s", err)
+	}
+
+	// if it does not exist; untrack the resource:
+	if !exists {
+		d.SetId("")
+	}
+	return exists, nil
+}
+
+// resourceAzureStorageContainerDelete does all the necessary API calls to
+// delete a storage container off Azure.
+func resourceAzureStorageContainerDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing Azure storage container deletion call.")
+	name := d.Get("name").(string)
+	if _, err := blobClient.DeleteContainerIfExists(name); err != nil {
+		return fmt.Errorf("Failed deleting storage container off Azure: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_container_test.go b/builtin/providers/azure/resource_azure_storage_container_test.go
new file mode 100644
index 000000000..6c110c5e4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_container_test.go
@@ -0,0 +1,97 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageContainer(t *testing.T) {
+	name := "azure_storage_container.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageContainerDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageContainerConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageContainerExists(name),
+					resource.TestCheckResourceAttr(name, "name", testAccStorageContainerName),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+					resource.TestCheckResourceAttr(name, "container_access_type", "blob"),
+				),
+			},
+		},
+	})
+
+	// because containers take a while to get deleted, sleep for one minute:
+	time.Sleep(3 * time.Minute)
+}
+
+func testAccCheckAzureStorageContainerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Container resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Container ID not set: %s", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.ContainerExists(resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Container %s doesn't exist.", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageContainerDestroyed(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_container" {
+			continue
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.ContainerExists(resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if exists {
+			return fmt.Errorf("Azure Storage Container still exists.")
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureStorageContainerConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_queue.go b/builtin/providers/azure/resource_azure_storage_queue.go
new file mode 100644
index 000000000..4799e236e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_queue.go
@@ -0,0 +1,103 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageQueue returns the *schema.Resource associated
+// to a storage queue on Azure.
+func resourceAzureStorageQueue() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageQueueCreate,
+		Read:   resourceAzureStorageQueueRead,
+		Delete: resourceAzureStorageQueueDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"storage_service_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageQueueCreate does all the necessary API calls to
+// create a storage queue on Azure.
+func resourceAzureStorageQueueCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// create the queue:
+	log.Println("Sending Storage Queue creation request to Azure.")
+	name := d.Get("name").(string)
+	err = queueClient.CreateQueue(name)
+	if err != nil {
+		return fmt.Errorf("Error creation Storage Queue on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureStorageQueueRead does all the necessary API calls to
+// read the state of the storage queue off Azure.
+func resourceAzureStorageQueueRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// check for queue's existence:
+	log.Println("[INFO] Sending Storage Queue existence query to Azure.")
+	name := d.Get("name").(string)
+	exists, err := queueClient.QueueExists(name)
+	if err != nil {
+		return fmt.Errorf("Error checking for Storage Queue existence: %s", err)
+	}
+
+	// If the queue has been deleted in the meantime;
+	// untrack the resource from the schema.
+	if !exists {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureStorageQueueDelete does all the necessary API calls to
+// delete the storage queue off Azure.
+func resourceAzureStorageQueueDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// issue the deletion of the storage queue:
+	log.Println("[INFO] Sending Storage Queue deletion request to Azure.")
+	name := d.Get("name").(string)
+	err = queueClient.DeleteQueue(name)
+	if err != nil {
+		return fmt.Errorf("Error deleting Storage queue off Azure: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_queue_test.go b/builtin/providers/azure/resource_azure_storage_queue_test.go
new file mode 100644
index 000000000..c7c691f4e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_queue_test.go
@@ -0,0 +1,93 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageQueue(t *testing.T) {
+	name := "azure_storage_queue.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageQueueDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageQueueConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageQueueExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-queue"),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureStorageQueueExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Queue resource '%s' is missing.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service Queue ID %s is missing.", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		queueClient, err := azureClient.getStorageServiceQueueClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := queueClient.QueueExists(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Error querying Azure for Storage Queue existence: %s", err)
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Queue %s doesn't exist!", resource.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageQueueDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_queue" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service Queue ID %s is missing.", resource.Primary.ID)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		queueClient, err := azureClient.getStorageServiceQueueClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := queueClient.QueueExists(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Error querying Azure for Storage Queue existence: %s", err)
+		}
+		if exists {
+			return fmt.Errorf("Azure Storage Queue %s still exists!", resource.Primary.ID)
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureStorageQueueConfig = fmt.Sprintf(`
+resource "azure_storage_queue" "foo" {
+    name = "terraform-queue"
+    storage_service_name = "%s"
+}
+`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_service.go b/builtin/providers/azure/resource_azure_storage_service.go
new file mode 100644
index 000000000..1d3a0c251
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_service.go
@@ -0,0 +1,217 @@
+package azure
+
+import (
+	"encoding/base64"
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/storageservice"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageService returns the *schema.Resource associated
+// to an Azure hosted service.
+func resourceAzureStorageService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageServiceCreate,
+		Read:   resourceAzureStorageServiceRead,
+		Exists: resourceAzureStorageServiceExists,
+		Delete: resourceAzureStorageServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			// General attributes:
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				// TODO(aznashwan): constrain name in description
+				Description: parameterDescriptions["name"],
+			},
+			"location": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["location"],
+			},
+			"label": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Default:     "Made by Terraform.",
+				Description: parameterDescriptions["label"],
+			},
+			"description": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["description"],
+			},
+			// Functional attributes:
+			"account_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["account_type"],
+			},
+			"affinity_group": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["affinity_group"],
+			},
+			"properties": &schema.Schema{
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Elem:     schema.TypeString,
+			},
+			// Computed attributes:
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"primary_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"secondary_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureStorageServiceCreate does all the necessary API calls to
+// create a new Azure storage service.
+func resourceAzureStorageServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	storageServiceClient := azureClient.storageServiceClient
+
+	// get all the values:
+	log.Println("[INFO] Creating Azure Storage Service creation parameters.")
+	name := d.Get("name").(string)
+	location := d.Get("location").(string)
+	accountType := storageservice.AccountType(d.Get("account_type").(string))
+	affinityGroup := d.Get("affinity_group").(string)
+	description := d.Get("description").(string)
+	label := base64.StdEncoding.EncodeToString([]byte(d.Get("label").(string)))
+	var props []storageservice.ExtendedProperty
+	if given := d.Get("properties").(map[string]interface{}); len(given) > 0 {
+		props = []storageservice.ExtendedProperty{}
+		for k, v := range given {
+			props = append(props, storageservice.ExtendedProperty{
+				Name:  k,
+				Value: v.(string),
+			})
+		}
+	}
+
+	// create parameters and send request:
+	log.Println("[INFO] Sending Storage Service creation request to Azure.")
+	reqID, err := storageServiceClient.CreateStorageService(
+		storageservice.StorageAccountCreateParameters{
+			ServiceName:   name,
+			Location:      location,
+			Description:   description,
+			Label:         label,
+			AffinityGroup: affinityGroup,
+			AccountType:   accountType,
+			ExtendedProperties: storageservice.ExtendedPropertyList{
+				ExtendedProperty: props,
+			},
+		})
+	if err != nil {
+		return fmt.Errorf("Failed to create Azure storage service %s: %s", name, err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed creating storage service %s: %s", name, err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageServiceRead(d, meta)
+}
+
+// resourceAzureStorageServiceRead does all the necessary API calls to
+// read the state of the storage service off Azure.
+func resourceAzureStorageServiceRead(d *schema.ResourceData, meta interface{}) error {
+	storageServiceClient := meta.(*Client).storageServiceClient
+
+	// get our storage service:
+	log.Println("[INFO] Sending query about storage service to Azure.")
+	name := d.Get("name").(string)
+	storsvc, err := storageServiceClient.GetStorageService(name)
+	if err != nil {
+		if !management.IsResourceNotFoundError(err) {
+			return fmt.Errorf("Failed to query about Azure about storage service: %s", err)
+		} else {
+			// it means that the resource has been deleted from Azure
+			// in the meantime and we must remove its associated Resource.
+			d.SetId("")
+			return nil
+
+		}
+	}
+
+	// read values:
+	d.Set("url", storsvc.URL)
+	log.Println("[INFO] Querying keys of Azure storage service.")
+	keys, err := storageServiceClient.GetStorageServiceKeys(name)
+	if err != nil {
+		return fmt.Errorf("Failed querying keys for Azure storage service: %s", err)
+	}
+	d.Set("primary_key", keys.PrimaryKey)
+	d.Set("secondary_key", keys.SecondaryKey)
+
+	return nil
+}
+
+// resourceAzureStorageServiceExists does all the necessary API calls to
+// check if the storage service exists on Azure.
+func resourceAzureStorageServiceExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	storageServiceClient := meta.(*Client).storageServiceClient
+
+	// get our storage service:
+	log.Println("[INFO] Sending query about storage service to Azure.")
+	name := d.Get("name").(string)
+	_, err := storageServiceClient.GetStorageService(name)
+	if err != nil {
+		if !management.IsResourceNotFoundError(err) {
+			return false, fmt.Errorf("Failed to query about Azure about storage service: %s", err)
+		} else {
+			// it means that the resource has been deleted from Azure
+			// in the meantime and we must remove its associated Resource.
+			d.SetId("")
+			return false, nil
+
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureStorageServiceDelete does all the necessary API calls to
+// delete the storage service off Azure.
+func resourceAzureStorageServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	storageServiceClient := azureClient.storageServiceClient
+
+	// issue the deletion:
+	name := d.Get("name").(string)
+	log.Println("[INFO] Issuing delete of storage service off Azure.")
+	reqID, err := storageServiceClient.DeleteStorageService(name)
+	if err != nil {
+		return fmt.Errorf("Error whilst issuing deletion of storage service off Azure: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error whilst deleting storage service off Azure: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_service_test.go b/builtin/providers/azure/resource_azure_storage_service_test.go
new file mode 100644
index 000000000..e3ac588d2
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_service_test.go
@@ -0,0 +1,78 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageService(t *testing.T) {
+	name := "azure_storage_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureStorageServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageServiceConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureStorageServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "tftesting"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "description", "very descriptive"),
+					resource.TestCheckResourceAttr(name, "account_type", "Standard_LRS"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAzureStorageServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Service Resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service ID not set.")
+		}
+
+		storageServiceClient := testAccProvider.Meta().(*Client).storageServiceClient
+		_, err := storageServiceClient.GetStorageService(resource.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccAzureStorageServiceDestroyed(s *terraform.State) error {
+	storageServiceClient := testAccProvider.Meta().(*Client).storageServiceClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service ID not set.")
+		}
+
+		_, err := storageServiceClient.GetStorageService(resource.Primary.ID)
+		return testAccResourceDestroyedErrorFilter("Storage Service", err)
+	}
+
+	return nil
+}
+
+var testAccAzureStorageServiceConfig = `
+resource "azure_storage_service" "foo" {
+  # NOTE: storage service names constrained to lowercase letters only.
+  name = "tftesting"
+  location = "West US"
+  description = "very descriptive"
+  account_type = "Standard_LRS"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_virtual_network.go b/builtin/providers/azure/resource_azure_virtual_network.go
new file mode 100644
index 000000000..dcb008f07
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_virtual_network.go
@@ -0,0 +1,367 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const (
+	virtualNetworkRetrievalError = "Error retrieving Virtual Network Configuration: %s"
+)
+
+func resourceAzureVirtualNetwork() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureVirtualNetworkCreate,
+		Read:   resourceAzureVirtualNetworkRead,
+		Update: resourceAzureVirtualNetworkUpdate,
+		Delete: resourceAzureVirtualNetworkDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"address_space": &schema.Schema{
+				Type:     schema.TypeList,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+
+			"dns_servers_names": &schema.Schema{
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+
+			"subnet": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"address_prefix": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"security_group": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+				Set: resourceAzureSubnetHash,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAzureVirtualNetworkCreate(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	name := d.Get("name").(string)
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network config exists yet; create a new one now:
+			nc = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf(virtualNetworkRetrievalError, err)
+		}
+	}
+
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == name {
+			return fmt.Errorf("Virtual Network %s already exists!", name)
+		}
+	}
+
+	network := createVirtualNetwork(d)
+	nc.Configuration.VirtualNetworkSites = append(nc.Configuration.VirtualNetworkSites, network)
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error creating Virtual Network %s: %s", name, err)
+	}
+
+	// Wait until the virtual network is created
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	if err := associateSecurityGroups(d, meta); err != nil {
+		return err
+	}
+
+	return resourceAzureVirtualNetworkRead(d, meta)
+}
+
+func resourceAzureVirtualNetworkRead(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	vnetClient := ac.vnetClient
+	secGroupClient := ac.secGroupClient
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == d.Id() {
+			d.Set("address_space", n.AddressSpace.AddressPrefix)
+			d.Set("location", n.Location)
+
+			// Create a new set to hold all configured subnets
+			subnets := &schema.Set{
+				F: resourceAzureSubnetHash,
+			}
+
+			// Loop through all endpoints
+			for _, s := range n.Subnets {
+				subnet := map[string]interface{}{}
+
+				// Get the associated (if any) security group
+				sg, err := secGroupClient.GetNetworkSecurityGroupForSubnet(s.Name, d.Id())
+				if err != nil && !management.IsResourceNotFoundError(err) {
+					return fmt.Errorf(
+						"Error retrieving Network Security Group associations of subnet %s: %s", s.Name, err)
+				}
+
+				// Update the values
+				subnet["name"] = s.Name
+				subnet["address_prefix"] = s.AddressPrefix
+				subnet["security_group"] = sg.Name
+
+				subnets.Add(subnet)
+			}
+
+			d.Set("subnet", subnets)
+
+			return nil
+		}
+	}
+
+	log.Printf("[DEBUG] Virtual Network %s does no longer exist", d.Id())
+	d.SetId("")
+
+	return nil
+}
+
+func resourceAzureVirtualNetworkUpdate(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	found := false
+	for i, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == d.Id() {
+			network := createVirtualNetwork(d)
+			nc.Configuration.VirtualNetworkSites[i] = network
+
+			found = true
+		}
+	}
+
+	if !found {
+		return fmt.Errorf("Virtual Network %s does not exists!", d.Id())
+	}
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error updating Virtual Network %s: %s", d.Id(), err)
+	}
+
+	// Wait until the virtual network is updated
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be updated: %s", d.Id(), err)
+	}
+
+	if err := associateSecurityGroups(d, meta); err != nil {
+		return err
+	}
+
+	return resourceAzureVirtualNetworkRead(d, meta)
+}
+
+func resourceAzureVirtualNetworkDelete(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	filtered := nc.Configuration.VirtualNetworkSites[:0]
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name != d.Id() {
+			filtered = append(filtered, n)
+		}
+	}
+
+	nc.Configuration.VirtualNetworkSites = filtered
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error deleting Virtual Network %s: %s", d.Id(), err)
+	}
+
+	// Wait until the virtual network is deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be deleted: %s", d.Id(), err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+func resourceAzureSubnetHash(v interface{}) int {
+	m := v.(map[string]interface{})
+	subnet := m["name"].(string) + m["address_prefix"].(string) + m["security_group"].(string)
+	return hashcode.String(subnet)
+}
+
+func createVirtualNetwork(d *schema.ResourceData) virtualnetwork.VirtualNetworkSite {
+	// fetch address spaces:
+	var prefixes []string
+	for _, prefix := range d.Get("address_space").([]interface{}) {
+		prefixes = append(prefixes, prefix.(string))
+	}
+
+	// fetch DNS references:
+	var dnsRefs []virtualnetwork.DNSServerRef
+	for _, dns := range d.Get("dns_servers_names").([]interface{}) {
+		dnsRefs = append(dnsRefs, virtualnetwork.DNSServerRef{
+			Name: dns.(string),
+		})
+	}
+
+	// Add all subnets that are configured
+	var subnets []virtualnetwork.Subnet
+	if rs := d.Get("subnet").(*schema.Set); rs.Len() > 0 {
+		for _, subnet := range rs.List() {
+			subnet := subnet.(map[string]interface{})
+			subnets = append(subnets, virtualnetwork.Subnet{
+				Name:          subnet["name"].(string),
+				AddressPrefix: subnet["address_prefix"].(string),
+			})
+		}
+	}
+
+	return virtualnetwork.VirtualNetworkSite{
+		Name:     d.Get("name").(string),
+		Location: d.Get("location").(string),
+		AddressSpace: virtualnetwork.AddressSpace{
+			AddressPrefix: prefixes,
+		},
+		DNSServersRef: dnsRefs,
+		Subnets:       subnets,
+	}
+}
+
+func associateSecurityGroups(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	virtualNetwork := d.Get("name").(string)
+
+	if rs := d.Get("subnet").(*schema.Set); rs.Len() > 0 {
+		for _, subnet := range rs.List() {
+			subnet := subnet.(map[string]interface{})
+			securityGroup := subnet["security_group"].(string)
+			subnetName := subnet["name"].(string)
+
+			// Get the associated (if any) security group
+			sg, err := secGroupClient.GetNetworkSecurityGroupForSubnet(subnetName, d.Id())
+			if err != nil && !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf(
+					"Error retrieving Network Security Group associations of subnet %s: %s", subnetName, err)
+			}
+
+			// If the desired and actual security group are the same, were done so can just continue
+			if sg.Name == securityGroup {
+				continue
+			}
+
+			// If there is an associated security group, make sure we first remove it from the subnet
+			if sg.Name != "" {
+				req, err := secGroupClient.RemoveNetworkSecurityGroupFromSubnet(sg.Name, subnetName, virtualNetwork)
+				if err != nil {
+					return fmt.Errorf("Error removing Network Security Group %s from subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+
+				// Wait until the security group is associated
+				if err := mc.WaitForOperation(req, nil); err != nil {
+					return fmt.Errorf(
+						"Error waiting for Network Security Group %s to be removed from subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+			}
+
+			// If the desired security group is not empty, assign the security group to the subnet
+			if securityGroup != "" {
+				req, err := secGroupClient.AddNetworkSecurityToSubnet(securityGroup, subnetName, virtualNetwork)
+				if err != nil {
+					return fmt.Errorf("Error associating Network Security Group %s to subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+
+				// Wait until the security group is associated
+				if err := mc.WaitForOperation(req, nil); err != nil {
+					return fmt.Errorf(
+						"Error waiting for Network Security Group %s to be associated with subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+			}
+
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_virtual_network_test.go b/builtin/providers/azure/resource_azure_virtual_network_test.go
new file mode 100644
index 000000000..f6d637f16
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_virtual_network_test.go
@@ -0,0 +1,278 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureVirtualNetwork_basic(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.1787288781.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.1787288781.address_prefix", "10.1.2.0/25"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureVirtualNetwork_advanced(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.address_prefix", "10.1.2.0/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.security_group", "terraform-security-group1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureVirtualNetwork_update(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.address_prefix", "10.1.2.0/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.security_group", "terraform-security-group1"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.3.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.address_prefix", "10.1.3.128/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.security_group", "terraform-security-group2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureVirtualNetworkExists(
+	n string,
+	network *virtualnetwork.VirtualNetworkSite) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Virtual Network ID is set")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		nc, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, n := range nc.Configuration.VirtualNetworkSites {
+			if n.Name == rs.Primary.ID {
+				*network = n
+
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Virtual Network not found")
+	}
+}
+
+func testAccCheckAzureVirtualNetworkAttributes(
+	network *virtualnetwork.VirtualNetworkSite) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if network.Name != "terraform-vnet" {
+			return fmt.Errorf("Bad name: %s", network.Name)
+		}
+
+		if network.Location != "West US" {
+			return fmt.Errorf("Bad location: %s", network.Location)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureVirtualNetworkDestroy(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_virtual_network" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Virtual Network ID is set")
+		}
+
+		nc, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Error retrieving Virtual Network Configuration: %s", err)
+		}
+
+		for _, n := range nc.Configuration.VirtualNetworkSites {
+			if n.Name == rs.Primary.ID {
+				return fmt.Errorf("Virtual Network %s still exists", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureVirtualNetwork_basic = `
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+    }
+}`
+
+const testAccAzureVirtualNetwork_advanced = `
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+        security_group = "${azure_security_group.foo.name}"
+    }
+}`
+
+const testAccAzureVirtualNetwork_update = `
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+
+resource "azure_security_group" "bar" {
+    name = "terraform-security-group2"
+    location = "West US"
+}
+
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.3.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.3.128/25"
+        security_group = "${azure_security_group.bar.name}"
+    }
+}`
diff --git a/builtin/providers/azure/resources.go b/builtin/providers/azure/resources.go
new file mode 100644
index 000000000..6512f735e
--- /dev/null
+++ b/builtin/providers/azure/resources.go
@@ -0,0 +1 @@
+package azure
diff --git a/builtin/providers/azure/utils_test.go b/builtin/providers/azure/utils_test.go
new file mode 100644
index 000000000..3a3212263
--- /dev/null
+++ b/builtin/providers/azure/utils_test.go
@@ -0,0 +1,20 @@
+package azure
+
+import (
+	"fmt"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+)
+
+// testAccResourceDestroyedErrorFilter tests whether the given error is an azure ResourceNotFound
+// error and properly annotates it if otherwise:
+func testAccResourceDestroyedErrorFilter(resource string, err error) error {
+	switch {
+	case err == nil:
+		return fmt.Errorf("Azure %s still exists.", resource)
+	case err != nil && management.IsResourceNotFoundError(err):
+		return nil
+	default:
+		return err
+	}
+}
diff --git a/builtin/providers/cloudflare/resource_cloudflare_record.go b/builtin/providers/cloudflare/resource_cloudflare_record.go
index e388272d4..03f3c00eb 100644
--- a/builtin/providers/cloudflare/resource_cloudflare_record.go
+++ b/builtin/providers/cloudflare/resource_cloudflare_record.go
@@ -3,6 +3,7 @@ package cloudflare
 import (
 	"fmt"
 	"log"
+	"strings"
 
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/pearkes/cloudflare"
@@ -72,16 +73,16 @@ func resourceCloudFlareRecordCreate(d *schema.ResourceData, meta interface{}) er
 		newRecord.Priority = priority.(string)
 	}
 
-	log.Printf("[DEBUG] record create configuration: %#v", newRecord)
+	log.Printf("[DEBUG] CloudFlare Record create configuration: %#v", newRecord)
 
 	rec, err := client.CreateRecord(d.Get("domain").(string), newRecord)
 
 	if err != nil {
-		return fmt.Errorf("Failed to create record: %s", err)
+		return fmt.Errorf("Failed to create CloudFlare Record: %s", err)
 	}
 
 	d.SetId(rec.Id)
-	log.Printf("[INFO] record ID: %s", d.Id())
+	log.Printf("[INFO] CloudFlare Record ID: %s", d.Id())
 
 	return resourceCloudFlareRecordRead(d, meta)
 }
@@ -91,7 +92,14 @@ func resourceCloudFlareRecordRead(d *schema.ResourceData, meta interface{}) erro
 
 	rec, err := client.RetrieveRecord(d.Get("domain").(string), d.Id())
 	if err != nil {
-		return fmt.Errorf("Couldn't find record ID (%s) for domain (%s): %s", d.Id(), d.Get("domain").(string), err)
+		if strings.Contains(err.Error(), "not found") {
+			d.SetId("")
+			return nil
+		}
+
+		return fmt.Errorf(
+			"Couldn't find CloudFlare Record ID (%s) for domain (%s): %s",
+			d.Id(), d.Get("domain").(string), err)
 	}
 
 	d.Set("name", rec.Name)
@@ -122,11 +130,11 @@ func resourceCloudFlareRecordUpdate(d *schema.ResourceData, meta interface{}) er
 		updateRecord.Priority = priority.(string)
 	}
 
-	log.Printf("[DEBUG] record update configuration: %#v", updateRecord)
+	log.Printf("[DEBUG] CloudFlare Record update configuration: %#v", updateRecord)
 
 	err := client.UpdateRecord(d.Get("domain").(string), d.Id(), updateRecord)
 	if err != nil {
-		return fmt.Errorf("Failed to update record: %s", err)
+		return fmt.Errorf("Failed to update CloudFlare Record: %s", err)
 	}
 
 	return resourceCloudFlareRecordRead(d, meta)
@@ -135,12 +143,12 @@ func resourceCloudFlareRecordUpdate(d *schema.ResourceData, meta interface{}) er
 func resourceCloudFlareRecordDelete(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*cloudflare.Client)
 
-	log.Printf("[INFO] Deleting record: %s, %s", d.Get("domain").(string), d.Id())
+	log.Printf("[INFO] Deleting CloudFlare Record: %s, %s", d.Get("domain").(string), d.Id())
 
 	err := client.DestroyRecord(d.Get("domain").(string), d.Id())
 
 	if err != nil {
-		return fmt.Errorf("Error deleting record: %s", err)
+		return fmt.Errorf("Error deleting CloudFlare Record: %s", err)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/config.go b/builtin/providers/cloudstack/config.go
index 9185bb27e..8a2ad813b 100644
--- a/builtin/providers/cloudstack/config.go
+++ b/builtin/providers/cloudstack/config.go
@@ -5,15 +5,17 @@ import "github.com/xanzy/go-cloudstack/cloudstack"
 // Config is the configuration structure used to instantiate a
 // new CloudStack client.
 type Config struct {
-	ApiURL    string
-	ApiKey    string
-	SecretKey string
-	Timeout   int64
+	APIURL      string
+	APIKey      string
+	SecretKey   string
+	HTTPGETOnly bool
+	Timeout     int64
 }
 
-// Client() returns a new CloudStack client.
+// NewClient returns a new CloudStack client.
 func (c *Config) NewClient() (*cloudstack.CloudStackClient, error) {
-	cs := cloudstack.NewAsyncClient(c.ApiURL, c.ApiKey, c.SecretKey, false)
+	cs := cloudstack.NewAsyncClient(c.APIURL, c.APIKey, c.SecretKey, false)
+	cs.HTTPGETOnly = c.HTTPGETOnly
 	cs.AsyncTimeout(c.Timeout)
 	return cs, nil
 }
diff --git a/builtin/providers/cloudstack/provider.go b/builtin/providers/cloudstack/provider.go
index 8cdafd1ab..740c2d17a 100644
--- a/builtin/providers/cloudstack/provider.go
+++ b/builtin/providers/cloudstack/provider.go
@@ -27,6 +27,12 @@ func Provider() terraform.ResourceProvider {
 				DefaultFunc: schema.EnvDefaultFunc("CLOUDSTACK_SECRET_KEY", nil),
 			},
 
+			"http_get_only": &schema.Schema{
+				Type:        schema.TypeBool,
+				Required:    true,
+				DefaultFunc: schema.EnvDefaultFunc("CLOUDSTACK_HTTP_GET_ONLY", false),
+			},
+
 			"timeout": &schema.Schema{
 				Type:        schema.TypeInt,
 				Required:    true,
@@ -45,6 +51,8 @@ func Provider() terraform.ResourceProvider {
 			"cloudstack_network_acl_rule":     resourceCloudStackNetworkACLRule(),
 			"cloudstack_nic":                  resourceCloudStackNIC(),
 			"cloudstack_port_forward":         resourceCloudStackPortForward(),
+			"cloudstack_secondary_ipaddress":  resourceCloudStackSecondaryIPAddress(),
+			"cloudstack_ssh_keypair":          resourceCloudStackSSHKeyPair(),
 			"cloudstack_template":             resourceCloudStackTemplate(),
 			"cloudstack_vpc":                  resourceCloudStackVPC(),
 			"cloudstack_vpn_connection":       resourceCloudStackVPNConnection(),
@@ -58,10 +66,11 @@ func Provider() terraform.ResourceProvider {
 
 func providerConfigure(d *schema.ResourceData) (interface{}, error) {
 	config := Config{
-		ApiURL:    d.Get("api_url").(string),
-		ApiKey:    d.Get("api_key").(string),
-		SecretKey: d.Get("secret_key").(string),
-		Timeout:   int64(d.Get("timeout").(int)),
+		APIURL:      d.Get("api_url").(string),
+		APIKey:      d.Get("api_key").(string),
+		SecretKey:   d.Get("secret_key").(string),
+		HTTPGETOnly: d.Get("http_get_only").(bool),
+		Timeout:     int64(d.Get("timeout").(int)),
 	}
 
 	return config.NewClient()
diff --git a/builtin/providers/cloudstack/provider_test.go b/builtin/providers/cloudstack/provider_test.go
index c9da7dc8a..76a60870e 100644
--- a/builtin/providers/cloudstack/provider_test.go
+++ b/builtin/providers/cloudstack/provider_test.go
@@ -39,7 +39,7 @@ func testSetValueOnResourceData(t *testing.T) {
 	}
 }
 
-func testSetUuidOnResourceData(t *testing.T) {
+func testSetUUIDOnResourceData(t *testing.T) {
 	d := schema.ResourceData{}
 	d.Set("id", "54711781-274e-41b2-83c0-17194d0108f7")
 
@@ -60,30 +60,116 @@ func testAccPreCheck(t *testing.T) {
 	if v := os.Getenv("CLOUDSTACK_SECRET_KEY"); v == "" {
 		t.Fatal("CLOUDSTACK_SECRET_KEY must be set for acceptance tests")
 	}
+	if v := os.Getenv("CLOUDSTACK_2ND_NIC_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_2ND_NIC_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_2ND_NIC_NETWORK"); v == "" {
+		t.Fatal("CLOUDSTACK_2ND_NIC_NETWORK must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_DISK_OFFERING_1"); v == "" {
+		t.Fatal("CLOUDSTACK_DISK_OFFERING_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_DISK_OFFERING_2"); v == "" {
+		t.Fatal("CLOUDSTACK_DISK_OFFERING_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_HYPERVISOR"); v == "" {
+		t.Fatal("CLOUDSTACK_HYPERVISOR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SERVICE_OFFERING_1"); v == "" {
+		t.Fatal("CLOUDSTACK_SERVICE_OFFERING_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SERVICE_OFFERING_2"); v == "" {
+		t.Fatal("CLOUDSTACK_SERVICE_OFFERING_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_1"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_1_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_1_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_CIDR"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_CIDR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_CIDR_1"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_CIDR_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_CIDR_2"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_CIDR_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_NETWORK_CIDR"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_NETWORK_CIDR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_NETWORK_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_NETWORK_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PUBLIC_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_PUBLIC_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SSH_KEYPAIR"); v == "" {
+		t.Fatal("CLOUDSTACK_SSH_KEYPAIR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SSH_PUBLIC_KEY"); v == "" {
+		t.Fatal("CLOUDSTACK_SSH_PUBLIC_KEY must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_FORMAT"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_FORMAT must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_URL"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_URL must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_OS_TYPE"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_OS_TYPE must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PROJECT_NAME"); v == "" {
+		t.Fatal("CLOUDSTACK_PROJECT_NAME must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PROJECT_NETWORK"); v == "" {
+		t.Fatal("CLOUDSTACK_PROJECT_NETWORK must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_ZONE"); v == "" {
+		t.Fatal("CLOUDSTACK_ZONE must be set for acceptance tests")
+	}
 }
 
-// SET THESE VALUES IN ORDER TO RUN THE ACC TESTS!!
-var CLOUDSTACK_2ND_NIC_IPADDRESS = ""
-var CLOUDSTACK_2ND_NIC_NETWORK = ""
-var CLOUDSTACK_DISK_OFFERING_1 = ""
-var CLOUDSTACK_DISK_OFFERING_2 = ""
-var CLOUDSTACK_HYPERVISOR = ""
-var CLOUDSTACK_SERVICE_OFFERING_1 = ""
-var CLOUDSTACK_SERVICE_OFFERING_2 = ""
-var CLOUDSTACK_NETWORK_1 = ""
-var CLOUDSTACK_NETWORK_1_IPADDRESS = ""
-var CLOUDSTACK_NETWORK_2 = ""
-var CLOUDSTACK_NETWORK_2_CIDR = ""
-var CLOUDSTACK_NETWORK_2_OFFERING = ""
-var CLOUDSTACK_NETWORK_2_IPADDRESS = ""
-var CLOUDSTACK_VPC_CIDR_1 = ""
-var CLOUDSTACK_VPC_CIDR_2 = ""
-var CLOUDSTACK_VPC_OFFERING = ""
-var CLOUDSTACK_VPC_NETWORK_CIDR = ""
-var CLOUDSTACK_VPC_NETWORK_OFFERING = ""
-var CLOUDSTACK_PUBLIC_IPADDRESS = ""
-var CLOUDSTACK_TEMPLATE = ""
-var CLOUDSTACK_TEMPLATE_FORMAT = ""
-var CLOUDSTACK_TEMPLATE_URL = ""
-var CLOUDSTACK_TEMPLATE_OS_TYPE = ""
-var CLOUDSTACK_ZONE = ""
+var CLOUDSTACK_2ND_NIC_IPADDRESS = os.Getenv("CLOUDSTACK_2ND_NIC_IPADDRESS")
+var CLOUDSTACK_2ND_NIC_NETWORK = os.Getenv("CLOUDSTACK_2ND_NIC_NETWORK")
+var CLOUDSTACK_DISK_OFFERING_1 = os.Getenv("CLOUDSTACK_DISK_OFFERING_1")
+var CLOUDSTACK_DISK_OFFERING_2 = os.Getenv("CLOUDSTACK_DISK_OFFERING_2")
+var CLOUDSTACK_HYPERVISOR = os.Getenv("CLOUDSTACK_HYPERVISOR")
+var CLOUDSTACK_SERVICE_OFFERING_1 = os.Getenv("CLOUDSTACK_SERVICE_OFFERING_1")
+var CLOUDSTACK_SERVICE_OFFERING_2 = os.Getenv("CLOUDSTACK_SERVICE_OFFERING_2")
+var CLOUDSTACK_NETWORK_1 = os.Getenv("CLOUDSTACK_NETWORK_1")
+var CLOUDSTACK_NETWORK_1_IPADDRESS = os.Getenv("CLOUDSTACK_NETWORK_1_IPADDRESS")
+var CLOUDSTACK_NETWORK_2 = os.Getenv("CLOUDSTACK_NETWORK_2")
+var CLOUDSTACK_NETWORK_2_CIDR = os.Getenv("CLOUDSTACK_NETWORK_2_CIDR")
+var CLOUDSTACK_NETWORK_2_OFFERING = os.Getenv("CLOUDSTACK_NETWORK_2_OFFERING")
+var CLOUDSTACK_NETWORK_2_IPADDRESS = os.Getenv("CLOUDSTACK_NETWORK_2_IPADDRESS")
+var CLOUDSTACK_VPC_CIDR_1 = os.Getenv("CLOUDSTACK_VPC_CIDR_1")
+var CLOUDSTACK_VPC_CIDR_2 = os.Getenv("CLOUDSTACK_VPC_CIDR_2")
+var CLOUDSTACK_VPC_OFFERING = os.Getenv("CLOUDSTACK_VPC_OFFERING")
+var CLOUDSTACK_VPC_NETWORK_CIDR = os.Getenv("CLOUDSTACK_VPC_NETWORK_CIDR")
+var CLOUDSTACK_VPC_NETWORK_OFFERING = os.Getenv("CLOUDSTACK_VPC_NETWORK_OFFERING")
+var CLOUDSTACK_PUBLIC_IPADDRESS = os.Getenv("CLOUDSTACK_PUBLIC_IPADDRESS")
+var CLOUDSTACK_SSH_PUBLIC_KEY = os.Getenv("CLOUDSTACK_SSH_PUBLIC_KEY")
+var CLOUDSTACK_TEMPLATE = os.Getenv("CLOUDSTACK_TEMPLATE")
+var CLOUDSTACK_TEMPLATE_FORMAT = os.Getenv("CLOUDSTACK_TEMPLATE_FORMAT")
+var CLOUDSTACK_TEMPLATE_URL = os.Getenv("CLOUDSTACK_TEMPLATE_URL")
+var CLOUDSTACK_TEMPLATE_OS_TYPE = os.Getenv("CLOUDSTACK_TEMPLATE_OS_TYPE")
+var CLOUDSTACK_PROJECT_NAME = os.Getenv("CLOUDSTACK_PROJECT_NAME")
+var CLOUDSTACK_PROJECT_NETWORK = os.Getenv("CLOUDSTACK_PROJECT_NETWORK")
+var CLOUDSTACK_ZONE = os.Getenv("CLOUDSTACK_ZONE")
diff --git a/builtin/providers/cloudstack/resource_cloudstack_disk.go b/builtin/providers/cloudstack/resource_cloudstack_disk.go
index c4d84f520..1c7ad36bd 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_disk.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_disk.go
@@ -165,7 +165,7 @@ func resourceCloudStackDiskRead(d *schema.ResourceData, meta interface{}) error
 		}
 
 		d.Set("device", retrieveDeviceName(v.Deviceid, c.Name))
-		d.Set("virtual_machine", v.Vmname)
+		setValueOrUUID(d, "virtual_machine", v.Vmname, v.Virtualmachineid)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/resource_cloudstack_disk_test.go b/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
index 0f4b49c77..5eee8ed8d 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
@@ -35,7 +35,7 @@ func TestAccCloudStackDisk_device(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckCloudStackDiskDestroyAdvanced,
+		CheckDestroy: testAccCheckCloudStackDiskDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccCloudStackDisk_device,
@@ -57,7 +57,7 @@ func TestAccCloudStackDisk_update(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckCloudStackDiskDestroyAdvanced,
+		CheckDestroy: testAccCheckCloudStackDiskDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccCloudStackDisk_update,
@@ -151,57 +151,9 @@ func testAccCheckCloudStackDiskDestroy(s *terraform.State) error {
 			return fmt.Errorf("No disk ID is set")
 		}
 
-		p := cs.Volume.NewDeleteVolumeParams(rs.Primary.ID)
-		_, err := cs.Volume.DeleteVolume(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting disk (%s): %s",
-				rs.Primary.ID, err)
-		}
-	}
-
-	return nil
-}
-
-func testAccCheckCloudStackDiskDestroyAdvanced(s *terraform.State) error {
-	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
-
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "cloudstack_disk" {
-			continue
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No disk ID is set")
-		}
-
-		p := cs.Volume.NewDeleteVolumeParams(rs.Primary.ID)
-		_, err := cs.Volume.DeleteVolume(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting disk (%s): %s",
-				rs.Primary.ID, err)
-		}
-	}
-
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "cloudstack_instance" {
-			continue
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No instance ID is set")
-		}
-
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Volume.GetVolumeByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Disk %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
index 9211ba34e..0fa5fbf25 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
@@ -154,11 +154,9 @@ func testAccCheckCloudStackEgressFirewallDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeleteEgressFirewallRuleParams(uuid)
-			_, err := cs.Firewall.DeleteEgressFirewallRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetEgressFirewallRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Egress rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
index bb629cfab..2be2cebea 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
@@ -148,11 +148,9 @@ func testAccCheckCloudStackFirewallDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeleteFirewallRuleParams(uuid)
-			_, err := cs.Firewall.DeleteFirewallRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetFirewallRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Firewall rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_instance.go b/builtin/providers/cloudstack/resource_cloudstack_instance.go
index c07678f3e..106b87e11 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_instance.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_instance.go
@@ -56,12 +56,23 @@ func resourceCloudStackInstance() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"project": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"zone": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
 
+			"keypair": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
 			"user_data": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
@@ -95,8 +106,14 @@ func resourceCloudStackInstanceCreate(d *schema.ResourceData, meta interface{})
 		return e.Error()
 	}
 
+	// Retrieve the zone UUID
+	zoneid, e := retrieveUUID(cs, "zone", d.Get("zone").(string))
+	if e != nil {
+		return e.Error()
+	}
+
 	// Retrieve the zone object
-	zone, _, err := cs.Zone.GetZoneByName(d.Get("zone").(string))
+	zone, _, err := cs.Zone.GetZoneByID(zoneid)
 	if err != nil {
 		return err
 	}
@@ -136,15 +153,41 @@ func resourceCloudStackInstanceCreate(d *schema.ResourceData, meta interface{})
 		p.SetIpaddress(ipaddres.(string))
 	}
 
+	// If there is a project supplied, we retreive and set the project id
+	if project, ok := d.GetOk("project"); ok {
+		// Retrieve the project UUID
+		projectid, e := retrieveUUID(cs, "project", project.(string))
+		if e != nil {
+			return e.Error()
+		}
+		// Set the default project ID
+		p.SetProjectid(projectid)
+	}
+
+	// If a keypair is supplied, add it to the parameter struct
+	if keypair, ok := d.GetOk("keypair"); ok {
+		p.SetKeypair(keypair.(string))
+	}
+
 	// If the user data contains any info, it needs to be base64 encoded and
 	// added to the parameter struct
 	if userData, ok := d.GetOk("user_data"); ok {
 		ud := base64.StdEncoding.EncodeToString([]byte(userData.(string)))
-		if len(ud) > 2048 {
+
+		// deployVirtualMachine uses POST by default, so max userdata is 32K
+		maxUD := 32768
+
+		if cs.HTTPGETOnly {
+			// deployVirtualMachine using GET instead, so max userdata is 2K
+			maxUD = 2048
+		}
+
+		if len(ud) > maxUD {
 			return fmt.Errorf(
 				"The supplied user_data contains %d bytes after encoding, "+
-					"this exeeds the limit of 2048 bytes", len(ud))
+					"this exeeds the limit of %d bytes", len(ud), maxUD)
 		}
+
 		p.SetUserdata(ud)
 	}
 
@@ -173,7 +216,6 @@ func resourceCloudStackInstanceRead(d *schema.ResourceData, meta interface{}) er
 	if err != nil {
 		if count == 0 {
 			log.Printf("[DEBUG] Instance %s does no longer exist", d.Get("name").(string))
-			// Clear out all details so it's obvious the instance is gone
 			d.SetId("")
 			return nil
 		}
@@ -185,11 +227,13 @@ func resourceCloudStackInstanceRead(d *schema.ResourceData, meta interface{}) er
 	d.Set("name", vm.Name)
 	d.Set("display_name", vm.Displayname)
 	d.Set("ipaddress", vm.Nic[0].Ipaddress)
-	d.Set("zone", vm.Zonename)
+	//NB cloudstack sometimes sends back the wrong keypair name, so dont update it
 
 	setValueOrUUID(d, "network", vm.Nic[0].Networkname, vm.Nic[0].Networkid)
 	setValueOrUUID(d, "service_offering", vm.Serviceofferingname, vm.Serviceofferingid)
 	setValueOrUUID(d, "template", vm.Templatename, vm.Templateid)
+	setValueOrUUID(d, "project", vm.Project, vm.Projectid)
+	setValueOrUUID(d, "zone", vm.Zonename, vm.Zoneid)
 
 	return nil
 }
@@ -220,39 +264,59 @@ func resourceCloudStackInstanceUpdate(d *schema.ResourceData, meta interface{})
 		d.SetPartial("display_name")
 	}
 
-	// Check if the service offering is changed and if so, update the offering
-	if d.HasChange("service_offering") {
-		log.Printf("[DEBUG] Service offering changed for %s, starting update", name)
-
-		// Retrieve the service_offering UUID
-		serviceofferingid, e := retrieveUUID(cs, "service_offering", d.Get("service_offering").(string))
-		if e != nil {
-			return e.Error()
-		}
-
-		// Create a new parameter struct
-		p := cs.VirtualMachine.NewChangeServiceForVirtualMachineParams(d.Id(), serviceofferingid)
-
-		// Before we can actually change the service offering, the virtual machine must be stopped
-		_, err := cs.VirtualMachine.StopVirtualMachine(cs.VirtualMachine.NewStopVirtualMachineParams(d.Id()))
+	// Attributes that require reboot to update
+	if d.HasChange("service_offering") || d.HasChange("keypair") {
+		// Before we can actually make these changes, the virtual machine must be stopped
+		_, err := cs.VirtualMachine.StopVirtualMachine(
+			cs.VirtualMachine.NewStopVirtualMachineParams(d.Id()))
 		if err != nil {
 			return fmt.Errorf(
-				"Error stopping instance %s before changing service offering: %s", name, err)
+				"Error stopping instance %s before making changes: %s", name, err)
 		}
-		// Change the service offering
-		_, err = cs.VirtualMachine.ChangeServiceForVirtualMachine(p)
-		if err != nil {
-			return fmt.Errorf(
-				"Error changing the service offering for instance %s: %s", name, err)
+
+		// Check if the service offering is changed and if so, update the offering
+		if d.HasChange("service_offering") {
+			log.Printf("[DEBUG] Service offering changed for %s, starting update", name)
+
+			// Retrieve the service_offering UUID
+			serviceofferingid, e := retrieveUUID(cs, "service_offering", d.Get("service_offering").(string))
+			if e != nil {
+				return e.Error()
+			}
+
+			// Create a new parameter struct
+			p := cs.VirtualMachine.NewChangeServiceForVirtualMachineParams(d.Id(), serviceofferingid)
+
+			// Change the service offering
+			_, err = cs.VirtualMachine.ChangeServiceForVirtualMachine(p)
+			if err != nil {
+				return fmt.Errorf(
+					"Error changing the service offering for instance %s: %s", name, err)
+			}
+			d.SetPartial("service_offering")
 		}
+
+		if d.HasChange("keypair") {
+			log.Printf("[DEBUG] SSH keypair changed for %s, starting update", name)
+
+			p := cs.SSH.NewResetSSHKeyForVirtualMachineParams(d.Id(), d.Get("keypair").(string))
+
+			// Change the ssh keypair
+			_, err = cs.SSH.ResetSSHKeyForVirtualMachine(p)
+			if err != nil {
+				return fmt.Errorf(
+					"Error changing the SSH keypair for instance %s: %s", name, err)
+			}
+			d.SetPartial("keypair")
+		}
+
 		// Start the virtual machine again
-		_, err = cs.VirtualMachine.StartVirtualMachine(cs.VirtualMachine.NewStartVirtualMachineParams(d.Id()))
+		_, err = cs.VirtualMachine.StartVirtualMachine(
+			cs.VirtualMachine.NewStartVirtualMachineParams(d.Id()))
 		if err != nil {
 			return fmt.Errorf(
-				"Error starting instance %s after changing service offering: %s", name, err)
+				"Error starting instance %s after making changes", name)
 		}
-
-		d.SetPartial("service_offering")
 	}
 
 	d.Partial(false)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_instance_test.go b/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
index 2d1be9c53..b0f241a67 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
@@ -24,9 +24,7 @@ func TestAccCloudStackInstance_basic(t *testing.T) {
 						"cloudstack_instance.foobar", &instance),
 					testAccCheckCloudStackInstanceAttributes(&instance),
 					resource.TestCheckResourceAttr(
-						"cloudstack_instance.foobar",
-						"user_data",
-						"0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
+						"cloudstack_instance.foobar", "user_data", "0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
 				),
 			},
 		},
@@ -47,6 +45,8 @@ func TestAccCloudStackInstance_update(t *testing.T) {
 					testAccCheckCloudStackInstanceExists(
 						"cloudstack_instance.foobar", &instance),
 					testAccCheckCloudStackInstanceAttributes(&instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "user_data", "0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
 				),
 			},
 
@@ -87,6 +87,48 @@ func TestAccCloudStackInstance_fixedIP(t *testing.T) {
 	})
 }
 
+func TestAccCloudStackInstance_keyPair(t *testing.T) {
+	var instance cloudstack.VirtualMachine
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackInstance_keyPair,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackInstanceExists(
+						"cloudstack_instance.foobar", &instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "keypair", "terraform-test-keypair"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackInstance_project(t *testing.T) {
+	var instance cloudstack.VirtualMachine
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackInstance_project,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackInstanceExists(
+						"cloudstack_instance.foobar", &instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "project", CLOUDSTACK_PROJECT_NAME),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudStackInstanceExists(
 	n string, instance *cloudstack.VirtualMachine) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -172,13 +214,9 @@ func testAccCheckCloudStackInstanceDestroy(s *terraform.State) error {
 			return fmt.Errorf("No instance ID is set")
 		}
 
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VirtualMachine.GetVirtualMachineByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Virtual Machine %s still exists", rs.Primary.ID)
 		}
 	}
 
@@ -233,3 +271,42 @@ resource "cloudstack_instance" "foobar" {
 	CLOUDSTACK_NETWORK_1_IPADDRESS,
 	CLOUDSTACK_TEMPLATE,
 	CLOUDSTACK_ZONE)
+
+var testAccCloudStackInstance_keyPair = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+}
+
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  display_name = "terraform"
+  service_offering= "%s"
+  network = "%s"
+  ipaddress = "%s"
+  template = "%s"
+  zone = "%s"
+	keypair = "${cloudstack_ssh_keypair.foo.name}"
+  expunge = true
+}`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_NETWORK_1_IPADDRESS,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_ZONE)
+
+var testAccCloudStackInstance_project = fmt.Sprintf(`
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  display_name = "terraform"
+  service_offering= "%s"
+	network = "%s"
+  template = "%s"
+	project = "%s"
+  zone = "%s"
+  expunge = true
+}`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_PROJECT_NETWORK,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_PROJECT_NAME,
+	CLOUDSTACK_ZONE)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go b/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
index 59d942b63..84e067f81 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
@@ -105,7 +105,7 @@ func resourceCloudStackIPAddressRead(d *schema.ResourceData, meta interface{}) e
 			return err
 		}
 
-		d.Set("network", n.Name)
+		setValueOrUUID(d, "network", n.Name, f.Associatednetworkid)
 	}
 
 	if _, ok := d.GetOk("vpc"); ok {
@@ -115,7 +115,7 @@ func resourceCloudStackIPAddressRead(d *schema.ResourceData, meta interface{}) e
 			return err
 		}
 
-		d.Set("vpc", v.Name)
+		setValueOrUUID(d, "vpc", v.Name, f.Vpcid)
 	}
 
 	return nil
@@ -136,7 +136,7 @@ func resourceCloudStackIPAddressDelete(d *schema.ResourceData, meta interface{})
 			return nil
 		}
 
-		return fmt.Errorf("Error deleting network ACL list %s: %s", d.Get("name").(string), err)
+		return fmt.Errorf("Error disassociating IP address %s: %s", d.Get("name").(string), err)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go b/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
index dfdeba209..edf120573 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
@@ -103,13 +103,9 @@ func testAccCheckCloudStackIPAddressDestroy(s *terraform.State) error {
 			return fmt.Errorf("No IP address ID is set")
 		}
 
-		p := cs.Address.NewDisassociateIpAddressParams(rs.Primary.ID)
-		_, err := cs.Address.DisassociateIpAddress(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error disassociating IP address (%s): %s",
-				rs.Primary.ID, err)
+		ip, _, err := cs.Address.GetPublicIpAddressByID(rs.Primary.ID)
+		if err == nil && ip.Associatednetworkid != "" {
+			return fmt.Errorf("Public IP %s still associated", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
index 6900ef168..d4ccf49d2 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
@@ -157,21 +157,23 @@ func resourceCloudStackNetworkACLRuleCreateRule(
 		p.SetIcmptype(rule["icmp_type"].(int))
 		p.SetIcmpcode(rule["icmp_code"].(int))
 
-		r, err := cs.NetworkACL.CreateNetworkACL(p)
+		r, err := Retry(4, retryableACLCreationFunc(cs, p))
 		if err != nil {
 			return err
 		}
-		uuids["icmp"] = r.Id
+
+		uuids["icmp"] = r.(*cloudstack.CreateNetworkACLResponse).Id
 		rule["uuids"] = uuids
 	}
 
 	// If the protocol is ALL set the needed parameters
 	if rule["protocol"].(string) == "all" {
-		r, err := cs.NetworkACL.CreateNetworkACL(p)
+		r, err := Retry(4, retryableACLCreationFunc(cs, p))
 		if err != nil {
 			return err
 		}
-		uuids["all"] = r.Id
+
+		uuids["all"] = r.(*cloudstack.CreateNetworkACLResponse).Id
 		rule["uuids"] = uuids
 	}
 
@@ -206,7 +208,7 @@ func resourceCloudStackNetworkACLRuleCreateRule(
 				p.SetStartport(startPort)
 				p.SetEndport(endPort)
 
-				r, err := cs.NetworkACL.CreateNetworkACL(p)
+				r, err := Retry(4, retryableACLCreationFunc(cs, p))
 				if err != nil {
 					return err
 				}
@@ -214,7 +216,7 @@ func resourceCloudStackNetworkACLRuleCreateRule(
 				ports.Add(port)
 				rule["ports"] = ports
 
-				uuids[port.(string)] = r.Id
+				uuids[port.(string)] = r.(*cloudstack.CreateNetworkACLResponse).Id
 				rule["uuids"] = uuids
 			}
 		}
@@ -593,3 +595,15 @@ func verifyNetworkACLRuleParams(d *schema.ResourceData, rule map[string]interfac
 
 	return nil
 }
+
+func retryableACLCreationFunc(
+	cs *cloudstack.CloudStackClient,
+	p *cloudstack.CreateNetworkACLParams) func() (interface{}, error) {
+	return func() (interface{}, error) {
+		r, err := cs.NetworkACL.CreateNetworkACL(p)
+		if err != nil {
+			return nil, err
+		}
+		return r, nil
+	}
+}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
index 5b88b0254..5f450f931 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
@@ -160,11 +160,9 @@ func testAccCheckCloudStackNetworkACLRuleDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.NetworkACL.NewDeleteNetworkACLParams(uuid)
-			_, err := cs.NetworkACL.DeleteNetworkACL(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.NetworkACL.GetNetworkACLByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Network ACL rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
@@ -183,7 +181,7 @@ resource "cloudstack_vpc" "foobar" {
 resource "cloudstack_network_acl" "foo" {
   name = "terraform-acl"
   description = "terraform-acl-text"
-  vpc = "${cloudstack_vpc.foobar.name}"
+  vpc = "${cloudstack_vpc.foobar.id}"
 }
 
 resource "cloudstack_network_acl_rule" "foo" {
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
index 9bf0bb0cf..c8a58a8fe 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
@@ -86,13 +86,9 @@ func testAccCheckCloudStackNetworkACLDestroy(s *terraform.State) error {
 			return fmt.Errorf("No network ACL ID is set")
 		}
 
-		p := cs.NetworkACL.NewDeleteNetworkACLListParams(rs.Primary.ID)
-		_, err := cs.NetworkACL.DeleteNetworkACLList(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting network ACL (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.NetworkACL.GetNetworkACLListByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network ACl list %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_test.go
index 74e639ba2..2cc366c15 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_test.go
@@ -140,13 +140,9 @@ func testAccCheckCloudStackNetworkDestroy(s *terraform.State) error {
 			return fmt.Errorf("No network ID is set")
 		}
 
-		p := cs.Network.NewDeleteNetworkParams(rs.Primary.ID)
-		_, err := cs.Network.DeleteNetwork(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting network (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Network.GetNetworkByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_nic_test.go b/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
index 338c0848f..ef302cbd7 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
@@ -140,13 +140,9 @@ func testAccCheckCloudStackNICDestroy(s *terraform.State) error {
 			return fmt.Errorf("No instance ID is set")
 		}
 
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VirtualMachine.GetVirtualMachineByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Virtual Machine %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_port_forward.go b/builtin/providers/cloudstack/resource_cloudstack_port_forward.go
index ebb74b351..4982356d6 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_port_forward.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_port_forward.go
@@ -116,7 +116,12 @@ func resourceCloudStackPortForwardCreateForward(
 	}
 
 	// Retrieve the virtual_machine UUID
-	vm, _, err := cs.VirtualMachine.GetVirtualMachineByName(forward["virtual_machine"].(string))
+	virtualmachineid, e := retrieveUUID(cs, "virtual_machine", forward["virtual_machine"].(string))
+	if e != nil {
+		return e.Error()
+	}
+
+	vm, _, err := cs.VirtualMachine.GetVirtualMachineByID(virtualmachineid)
 	if err != nil {
 		return err
 	}
@@ -186,7 +191,13 @@ func resourceCloudStackPortForwardRead(d *schema.ResourceData, meta interface{})
 			forward["protocol"] = r.Protocol
 			forward["private_port"] = privPort
 			forward["public_port"] = pubPort
-			forward["virtual_machine"] = r.Virtualmachinename
+
+			if isUUID(forward["virtual_machine"].(string)) {
+				forward["virtual_machine"] = r.Virtualmachineid
+			} else {
+				forward["virtual_machine"] = r.Virtualmachinename
+			}
+
 			forwards.Add(forward)
 		}
 	}
@@ -219,7 +230,7 @@ func resourceCloudStackPortForwardRead(d *schema.ResourceData, meta interface{})
 			}
 		}
 
-		for uuid, _ := range uuids {
+		for uuid := range uuids {
 			// Make a dummy forward to hold the unknown UUID
 			forward := map[string]interface{}{
 				"protocol":        "N/A",
diff --git a/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go b/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
index 6a99caf54..39ebfe8f6 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
@@ -140,11 +140,9 @@ func testAccCheckCloudStackPortForwardDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeletePortForwardingRuleParams(uuid)
-			_, err := cs.Firewall.DeletePortForwardingRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetPortForwardingRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Port forward %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress.go b/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress.go
new file mode 100644
index 000000000..1c491be44
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress.go
@@ -0,0 +1,160 @@
+package cloudstack
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackSecondaryIPAddress() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackSecondaryIPAddressCreate,
+		Read:   resourceCloudStackSecondaryIPAddressRead,
+		Delete: resourceCloudStackSecondaryIPAddressDelete,
+
+		Schema: map[string]*schema.Schema{
+			"ipaddress": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"nicid": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"virtual_machine": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackSecondaryIPAddressCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	nicid := d.Get("nicid").(string)
+	if nicid == "" {
+		// Retrieve the virtual_machine UUID
+		virtualmachineid, e := retrieveUUID(cs, "virtual_machine", d.Get("virtual_machine").(string))
+		if e != nil {
+			return e.Error()
+		}
+
+		// Get the virtual machine details
+		vm, count, err := cs.VirtualMachine.GetVirtualMachineByID(virtualmachineid)
+		if err != nil {
+			if count == 0 {
+				log.Printf("[DEBUG] Instance %s does no longer exist", d.Get("virtual_machine").(string))
+				d.SetId("")
+				return nil
+			}
+			return err
+		}
+
+		nicid = vm.Nic[0].Id
+	}
+
+	// Create a new parameter struct
+	p := cs.Nic.NewAddIpToNicParams(nicid)
+
+	if addr := d.Get("ipaddress").(string); addr != "" {
+		p.SetIpaddress(addr)
+	}
+
+	ip, err := cs.Nic.AddIpToNic(p)
+	if err != nil {
+		return err
+	}
+
+	d.SetId(ip.Id)
+
+	return nil
+}
+
+func resourceCloudStackSecondaryIPAddressRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Retrieve the virtual_machine UUID
+	virtualmachineid, e := retrieveUUID(cs, "virtual_machine", d.Get("virtual_machine").(string))
+	if e != nil {
+		return e.Error()
+	}
+
+	// Get the virtual machine details
+	vm, count, err := cs.VirtualMachine.GetVirtualMachineByID(virtualmachineid)
+	if err != nil {
+		if count == 0 {
+			log.Printf("[DEBUG] Instance %s does no longer exist", d.Get("virtual_machine").(string))
+			d.SetId("")
+			return nil
+		}
+		return err
+	}
+
+	nicid := d.Get("nicid").(string)
+	if nicid == "" {
+		nicid = vm.Nic[0].Id
+	}
+
+	p := cs.Nic.NewListNicsParams(virtualmachineid)
+	p.SetNicid(nicid)
+
+	l, err := cs.Nic.ListNics(p)
+	if err != nil {
+		return err
+	}
+
+	if l.Count == 0 {
+		log.Printf("[DEBUG] NIC %s does no longer exist", d.Get("nicid").(string))
+		d.SetId("")
+		return nil
+	}
+
+	if l.Count > 1 {
+		return fmt.Errorf("Found more then one possible result: %v", l.Nics)
+	}
+
+	for _, ip := range l.Nics[0].Secondaryip {
+		if ip.Id == d.Id() {
+			d.Set("ipaddress", ip.Ipaddress)
+			d.Set("nicid", l.Nics[0].Id)
+			return nil
+		}
+	}
+
+	log.Printf("[DEBUG] IP %s no longer exist", d.Get("ipaddress").(string))
+	d.SetId("")
+
+	return nil
+}
+
+func resourceCloudStackSecondaryIPAddressDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.Nic.NewRemoveIpFromNicParams(d.Id())
+
+	log.Printf("[INFO] Removing secondary IP address: %s", d.Get("ipaddress").(string))
+	if _, err := cs.Nic.RemoveIpFromNic(p); err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"Invalid parameter id value=%s due to incorrect long value format, "+
+				"or entity does not exist", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error removing secondary IP address: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress_test.go b/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress_test.go
new file mode 100644
index 000000000..e0c353e20
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_secondary_ipaddress_test.go
@@ -0,0 +1,225 @@
+package cloudstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackSecondaryIPAddress_basic(t *testing.T) {
+	var ip cloudstack.AddIpToNicResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSecondaryIPAddressDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSecondaryIPAddress_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSecondaryIPAddressExists(
+						"cloudstack_secondary_ipaddress.foo", &ip),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackSecondaryIPAddress_fixedIP(t *testing.T) {
+	var ip cloudstack.AddIpToNicResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSecondaryIPAddressDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSecondaryIPAddress_fixedIP,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSecondaryIPAddressExists(
+						"cloudstack_secondary_ipaddress.foo", &ip),
+					testAccCheckCloudStackSecondaryIPAddressAttributes(&ip),
+					resource.TestCheckResourceAttr(
+						"cloudstack_secondary_ipaddress.foo", "ipaddress", CLOUDSTACK_NETWORK_1_IPADDRESS),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackSecondaryIPAddressExists(
+	n string, ip *cloudstack.AddIpToNicResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No IP address ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+		// Retrieve the virtual_machine UUID
+		virtualmachineid, e := retrieveUUID(
+			cs, "virtual_machine", rs.Primary.Attributes["virtual_machine"])
+		if e != nil {
+			return e.Error()
+		}
+
+		// Get the virtual machine details
+		vm, count, err := cs.VirtualMachine.GetVirtualMachineByID(virtualmachineid)
+		if err != nil {
+			if count == 0 {
+				return fmt.Errorf("Instance not found")
+			}
+			return err
+		}
+
+		nicid := rs.Primary.Attributes["nicid"]
+		if nicid == "" {
+			nicid = vm.Nic[0].Id
+		}
+
+		p := cs.Nic.NewListNicsParams(virtualmachineid)
+		p.SetNicid(nicid)
+
+		l, err := cs.Nic.ListNics(p)
+		if err != nil {
+			return err
+		}
+
+		if l.Count == 0 {
+			return fmt.Errorf("NIC not found")
+		}
+
+		if l.Count > 1 {
+			return fmt.Errorf("Found more then one possible result: %v", l.Nics)
+		}
+
+		for _, sip := range l.Nics[0].Secondaryip {
+			if sip.Id == rs.Primary.ID {
+				ip.Ipaddress = sip.Ipaddress
+				ip.Nicid = l.Nics[0].Id
+				return nil
+			}
+		}
+
+		return fmt.Errorf("IP address not found")
+	}
+}
+
+func testAccCheckCloudStackSecondaryIPAddressAttributes(
+	ip *cloudstack.AddIpToNicResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if ip.Ipaddress != CLOUDSTACK_NETWORK_1_IPADDRESS {
+			return fmt.Errorf("Bad IP address: %s", ip.Ipaddress)
+		}
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSecondaryIPAddressDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_secondary_ipaddress" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No IP address ID is set")
+		}
+
+		// Retrieve the virtual_machine UUID
+		virtualmachineid, e := retrieveUUID(
+			cs, "virtual_machine", rs.Primary.Attributes["virtual_machine"])
+		if e != nil {
+			return e.Error()
+		}
+
+		// Get the virtual machine details
+		vm, count, err := cs.VirtualMachine.GetVirtualMachineByID(virtualmachineid)
+		if err != nil {
+			if count == 0 {
+				return fmt.Errorf("Instance not found")
+			}
+			return err
+		}
+
+		nicid := rs.Primary.Attributes["nicid"]
+		if nicid == "" {
+			nicid = vm.Nic[0].Id
+		}
+
+		p := cs.Nic.NewListNicsParams(virtualmachineid)
+		p.SetNicid(nicid)
+
+		l, err := cs.Nic.ListNics(p)
+		if err != nil {
+			return err
+		}
+
+		if l.Count == 0 {
+			return fmt.Errorf("NIC not found")
+		}
+
+		if l.Count > 1 {
+			return fmt.Errorf("Found more then one possible result: %v", l.Nics)
+		}
+
+		for _, sip := range l.Nics[0].Secondaryip {
+			if sip.Id == rs.Primary.ID {
+				return fmt.Errorf("IP address %s still exists", rs.Primary.ID)
+			}
+		}
+
+		return nil
+	}
+
+	return nil
+}
+
+var testAccCloudStackSecondaryIPAddress_basic = fmt.Sprintf(`
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  service_offering= "%s"
+  network = "%s"
+  template = "%s"
+  zone = "%s"
+  expunge = true
+}
+
+resource "cloudstack_secondary_ipaddress" "foo" {
+	virtual_machine = "${cloudstack_instance.foobar.id}"
+}
+`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_ZONE)
+
+var testAccCloudStackSecondaryIPAddress_fixedIP = fmt.Sprintf(`
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  service_offering= "%s"
+  network = "%s"
+  template = "%s"
+  zone = "%s"
+  expunge = true
+}
+
+resource "cloudstack_secondary_ipaddress" "foo" {
+	ipaddress = "%s"
+	virtual_machine = "${cloudstack_instance.foobar.id}"
+}`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_ZONE,
+	CLOUDSTACK_NETWORK_1_IPADDRESS)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go
new file mode 100644
index 000000000..9fb859a22
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go
@@ -0,0 +1,129 @@
+package cloudstack
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/mitchellh/go-homedir"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackSSHKeyPair() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackSSHKeyPairCreate,
+		Read:   resourceCloudStackSSHKeyPairRead,
+		Delete: resourceCloudStackSSHKeyPairDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"public_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"private_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"fingerprint": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackSSHKeyPairCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	name := d.Get("name").(string)
+	publicKey := d.Get("public_key").(string)
+
+	if publicKey != "" {
+		// Register supplied key
+		keyPath, err := homedir.Expand(publicKey)
+		if err != nil {
+			return fmt.Errorf("Error expanding the public key path: %v", err)
+		}
+
+		key, err := ioutil.ReadFile(keyPath)
+		if err != nil {
+			return fmt.Errorf("Error reading the public key: %v", err)
+		}
+
+		p := cs.SSH.NewRegisterSSHKeyPairParams(name, string(key))
+		_, err = cs.SSH.RegisterSSHKeyPair(p)
+		if err != nil {
+			return err
+		}
+	} else {
+		// No key supplied, must create one and return the private key
+		p := cs.SSH.NewCreateSSHKeyPairParams(name)
+		r, err := cs.SSH.CreateSSHKeyPair(p)
+		if err != nil {
+			return err
+		}
+		d.Set("private_key", r.Privatekey)
+	}
+
+	log.Printf("[DEBUG] Key pair successfully generated at Cloudstack")
+	d.SetId(name)
+
+	return resourceCloudStackSSHKeyPairRead(d, meta)
+}
+
+func resourceCloudStackSSHKeyPairRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	log.Printf("[DEBUG] looking for key pair with name %s", d.Id())
+
+	p := cs.SSH.NewListSSHKeyPairsParams()
+	p.SetName(d.Id())
+
+	r, err := cs.SSH.ListSSHKeyPairs(p)
+	if err != nil {
+		return err
+	}
+	if r.Count == 0 {
+		log.Printf("[DEBUG] Key pair %s does not exist", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	//SSHKeyPair name is unique in a cloudstack account so dont need to check for multiple
+	d.Set("name", r.SSHKeyPairs[0].Name)
+	d.Set("fingerprint", r.SSHKeyPairs[0].Fingerprint)
+
+	return nil
+}
+
+func resourceCloudStackSSHKeyPairDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.SSH.NewDeleteSSHKeyPairParams(d.Id())
+
+	// Remove the SSH Keypair
+	_, err := cs.SSH.DeleteSSHKeyPair(p)
+	if err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"A key pair with name '%s' does not exist for account", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error deleting key pair: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go
new file mode 100644
index 000000000..ba70518d5
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go
@@ -0,0 +1,170 @@
+package cloudstack
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackSSHKeyPair_basic(t *testing.T) {
+	var sshkey cloudstack.SSHKeyPair
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSSHKeyPairDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSSHKeyPair_create,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSSHKeyPairExists("cloudstack_ssh_keypair.foo", &sshkey),
+					testAccCheckCloudStackSSHKeyPairAttributes(&sshkey),
+					testAccCheckCloudStackSSHKeyPairCreateAttributes("terraform-test-keypair"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackSSHKeyPair_register(t *testing.T) {
+	var sshkey cloudstack.SSHKeyPair
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSSHKeyPairDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSSHKeyPair_register,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSSHKeyPairExists("cloudstack_ssh_keypair.foo", &sshkey),
+					testAccCheckCloudStackSSHKeyPairAttributes(&sshkey),
+					resource.TestCheckResourceAttr(
+						"cloudstack_ssh_keypair.foo",
+						"public_key",
+						CLOUDSTACK_SSH_PUBLIC_KEY),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackSSHKeyPairExists(n string, sshkey *cloudstack.SSHKeyPair) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No key pair ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+		p := cs.SSH.NewListSSHKeyPairsParams()
+		p.SetName(rs.Primary.ID)
+
+		list, err := cs.SSH.ListSSHKeyPairs(p)
+		if err != nil {
+			return err
+		}
+
+		if list.Count != 1 || list.SSHKeyPairs[0].Name != rs.Primary.ID {
+			return fmt.Errorf("Key pair not found")
+		}
+
+		*sshkey = *list.SSHKeyPairs[0]
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairAttributes(
+	keypair *cloudstack.SSHKeyPair) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		fpLen := len(keypair.Fingerprint)
+		if fpLen != 47 {
+			return fmt.Errorf("SSH key: Attribute private_key expected length 47, got %d", fpLen)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairCreateAttributes(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		found := false
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "cloudstack_ssh_keypair" {
+				continue
+			}
+
+			if rs.Primary.ID != name {
+				continue
+			}
+
+			if !strings.Contains(rs.Primary.Attributes["private_key"], "PRIVATE KEY") {
+				return fmt.Errorf(
+					"SSH key: Attribute private_key expected 'PRIVATE KEY' to be present, got %s",
+					rs.Primary.Attributes["private_key"])
+			}
+
+			found = true
+			break
+		}
+
+		if !found {
+			return fmt.Errorf("Could not find key pair %s", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_ssh_keypair" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No key pair ID is set")
+		}
+
+		p := cs.SSH.NewListSSHKeyPairsParams()
+		p.SetName(rs.Primary.ID)
+
+		list, err := cs.SSH.ListSSHKeyPairs(p)
+		if err != nil {
+			return err
+		}
+		if list.Count != 1 {
+			return fmt.Errorf("Found more Key pair %s still exists", rs.Primary.ID)
+		}
+
+		if list.SSHKeyPairs[0].Name == rs.Primary.ID {
+			return fmt.Errorf("Key pair %s still exists", rs.Primary.ID)
+		}
+	}
+
+	return nil
+}
+
+var testAccCloudStackSSHKeyPair_create = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+}`)
+
+var testAccCloudStackSSHKeyPair_register = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+  public_key = "%s"
+}`, CLOUDSTACK_SSH_PUBLIC_KEY)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_template.go b/builtin/providers/cloudstack/resource_cloudstack_template.go
index f50316027..15c6ebec4 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_template.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_template.go
@@ -292,9 +292,9 @@ func resourceCloudStackTemplateDelete(d *schema.ResourceData, meta interface{})
 
 func verifyTemplateParams(d *schema.ResourceData) error {
 	format := d.Get("format").(string)
-	if format != "QCOW2" && format != "RAW" && format != "VHD" && format != "VMDK" {
+	if format != "OVA" && format != "QCOW2" && format != "RAW" && format != "VHD" && format != "VMDK" {
 		return fmt.Errorf(
-			"%s is not a valid format. Valid options are 'QCOW2', 'RAW', 'VHD' and 'VMDK'", format)
+			"%s is not a valid format. Valid options are 'OVA','QCOW2', 'RAW', 'VHD' and 'VMDK'", format)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/resource_cloudstack_template_test.go b/builtin/providers/cloudstack/resource_cloudstack_template_test.go
index 3e78461dc..f98130661 100755
--- a/builtin/providers/cloudstack/resource_cloudstack_template_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_template_test.go
@@ -149,13 +149,9 @@ func testAccCheckCloudStackTemplateDestroy(s *terraform.State) error {
 			return fmt.Errorf("No template ID is set")
 		}
 
-		p := cs.Template.NewDeleteTemplateParams(rs.Primary.ID)
-		_, err := cs.Template.DeleteTemplate(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting template (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Template.GetTemplateByID(rs.Primary.ID, "executable")
+		if err == nil {
+			return fmt.Errorf("Template %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
index 07861a091..011358a95 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
@@ -92,13 +92,9 @@ func testAccCheckCloudStackVPCDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPC ID is set")
 		}
 
-		p := cs.VPC.NewDeleteVPCParams(rs.Primary.ID)
-		_, err := cs.VPC.DeleteVPC(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPC (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPC.GetVPCByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPC %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
index 41a065725..7d09eea9b 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
@@ -71,13 +71,9 @@ func testAccCheckCloudStackVPNConnectionDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Connection ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnConnectionParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnConnection(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Connection (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnConnectionByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Connection %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
index 459d95016..b24eb3567 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
@@ -163,13 +163,9 @@ func testAccCheckCloudStackVPNCustomerGatewayDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Customer Gateway ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnCustomerGatewayParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnCustomerGateway(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Customer Gateway (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnCustomerGatewayByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Customer Gateway %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
index b017e6456..61fc15160 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
@@ -71,13 +71,9 @@ func testAccCheckCloudStackVPNGatewayDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Gateway ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnGatewayParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnGateway(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Gateway (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnGatewayByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Gateway %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resources.go b/builtin/providers/cloudstack/resources.go
index 85fa0bd5a..cc826492f 100644
--- a/builtin/providers/cloudstack/resources.go
+++ b/builtin/providers/cloudstack/resources.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"log"
 	"regexp"
+	"time"
 
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/xanzy/go-cloudstack/cloudstack"
@@ -79,6 +80,8 @@ func retrieveUUID(cs *cloudstack.CloudStackClient, name, value string) (uuid str
 			break
 		}
 		err = fmt.Errorf("Could not find UUID of OS Type: %s", value)
+	case "project":
+		uuid, err = cs.Project.GetProjectID(value)
 	default:
 		return uuid, &retrieveError{name: name, value: value,
 			err: fmt.Errorf("Unknown request: %s", name)}
@@ -111,3 +114,24 @@ func isUUID(s string) bool {
 	re := regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`)
 	return re.MatchString(s)
 }
+
+// RetryFunc is the function retried n times
+type RetryFunc func() (interface{}, error)
+
+// Retry is a wrapper around a RetryFunc that will retry a function
+// n times or until it succeeds.
+func Retry(n int, f RetryFunc) (interface{}, error) {
+	var lastErr error
+
+	for i := 0; i < n; i++ {
+		r, err := f()
+		if err == nil {
+			return r, nil
+		}
+
+		lastErr = err
+		time.Sleep(30 * time.Second)
+	}
+
+	return nil, lastErr
+}
diff --git a/builtin/providers/consul/resource_consul_keys_test.go b/builtin/providers/consul/resource_consul_keys_test.go
index e1a959b7d..97890335c 100644
--- a/builtin/providers/consul/resource_consul_keys_test.go
+++ b/builtin/providers/consul/resource_consul_keys_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccConsulKeys(t *testing.T) {
+func TestAccConsulKeys_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() {},
 		Providers:    testAccProviders,
diff --git a/builtin/providers/digitalocean/resource_digitalocean_droplet.go b/builtin/providers/digitalocean/resource_digitalocean_droplet.go
index f801eed67..88c0c6d07 100644
--- a/builtin/providers/digitalocean/resource_digitalocean_droplet.go
+++ b/builtin/providers/digitalocean/resource_digitalocean_droplet.go
@@ -165,6 +165,12 @@ func resourceDigitalOceanDropletRead(d *schema.ResourceData, meta interface{}) e
 	// Retrieve the droplet properties for updating the state
 	droplet, err := client.RetrieveDroplet(d.Id())
 	if err != nil {
+		// check if the droplet no longer exists.
+		if err.Error() == "Error retrieving droplet: API Error: 404 Not Found" {
+			d.SetId("")
+			return nil
+		}
+
 		return fmt.Errorf("Error retrieving droplet: %s", err)
 	}
 
diff --git a/builtin/providers/dme/resource_dme_record.go b/builtin/providers/dme/resource_dme_record.go
index 6c50523bf..8e078e420 100644
--- a/builtin/providers/dme/resource_dme_record.go
+++ b/builtin/providers/dme/resource_dme_record.go
@@ -110,6 +110,11 @@ func resourceDMERecordRead(d *schema.ResourceData, meta interface{}) error {
 
 	rec, err := client.ReadRecord(domainid, recordid)
 	if err != nil {
+		if strings.Contains(err.Error(), "Unable to find") {
+			d.SetId("")
+			return nil
+		}
+
 		return fmt.Errorf("Couldn't find record: %s", err)
 	}
 
diff --git a/builtin/providers/dme/resource_dme_record_test.go b/builtin/providers/dme/resource_dme_record_test.go
index 284ab0ad9..430afacb2 100644
--- a/builtin/providers/dme/resource_dme_record_test.go
+++ b/builtin/providers/dme/resource_dme_record_test.go
@@ -13,7 +13,7 @@ import (
 var _ = fmt.Sprintf("dummy") // dummy
 var _ = os.DevNull           // dummy
 
-func TestAccDMERecordA(t *testing.T) {
+func TestAccDMERecord_basic(t *testing.T) {
 	var record dnsmadeeasy.Record
 	domainid := os.Getenv("DME_DOMAINID")
 
diff --git a/builtin/providers/dnsimple/resource_dnsimple_record.go b/builtin/providers/dnsimple/resource_dnsimple_record.go
index dc7cb6172..644876cd8 100644
--- a/builtin/providers/dnsimple/resource_dnsimple_record.go
+++ b/builtin/providers/dnsimple/resource_dnsimple_record.go
@@ -74,12 +74,12 @@ func resourceDNSimpleRecordCreate(d *schema.ResourceData, meta interface{}) erro
 		newRecord.Ttl = ttl.(string)
 	}
 
-	log.Printf("[DEBUG] record create configuration: %#v", newRecord)
+	log.Printf("[DEBUG] DNS Simple Record create configuration: %#v", newRecord)
 
 	recId, err := client.CreateRecord(d.Get("domain").(string), newRecord)
 
 	if err != nil {
-		return fmt.Errorf("Failed to create record: %s", err)
+		return fmt.Errorf("Failed to create DNS Simple Record: %s", err)
 	}
 
 	d.SetId(recId)
@@ -93,7 +93,7 @@ func resourceDNSimpleRecordRead(d *schema.ResourceData, meta interface{}) error
 
 	rec, err := client.RetrieveRecord(d.Get("domain").(string), d.Id())
 	if err != nil {
-		return fmt.Errorf("Couldn't find record: %s", err)
+		return fmt.Errorf("Couldn't find DNS Simple Record: %s", err)
 	}
 
 	d.Set("domain_id", rec.StringDomainId())
@@ -133,11 +133,11 @@ func resourceDNSimpleRecordUpdate(d *schema.ResourceData, meta interface{}) erro
 		updateRecord.Ttl = attr.(string)
 	}
 
-	log.Printf("[DEBUG] record update configuration: %#v", updateRecord)
+	log.Printf("[DEBUG] DNS Simple Record update configuration: %#v", updateRecord)
 
 	_, err := client.UpdateRecord(d.Get("domain").(string), d.Id(), updateRecord)
 	if err != nil {
-		return fmt.Errorf("Failed to update record: %s", err)
+		return fmt.Errorf("Failed to update DNS Simple Record: %s", err)
 	}
 
 	return resourceDNSimpleRecordRead(d, meta)
@@ -146,12 +146,12 @@ func resourceDNSimpleRecordUpdate(d *schema.ResourceData, meta interface{}) erro
 func resourceDNSimpleRecordDelete(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*dnsimple.Client)
 
-	log.Printf("[INFO] Deleting record: %s, %s", d.Get("domain").(string), d.Id())
+	log.Printf("[INFO] Deleting DNS Simple Record: %s, %s", d.Get("domain").(string), d.Id())
 
 	err := client.DestroyRecord(d.Get("domain").(string), d.Id())
 
 	if err != nil {
-		return fmt.Errorf("Error deleting record: %s", err)
+		return fmt.Errorf("Error deleting DNS Simple Record: %s", err)
 	}
 
 	return nil
diff --git a/builtin/providers/docker/resource_docker_container.go b/builtin/providers/docker/resource_docker_container.go
index 10481b268..59e65b9c1 100644
--- a/builtin/providers/docker/resource_docker_container.go
+++ b/builtin/providers/docker/resource_docker_container.go
@@ -136,6 +136,12 @@ func resourceDockerContainer() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+
+			"privileged": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
 		},
 	}
 }
diff --git a/builtin/providers/docker/resource_docker_container_funcs.go b/builtin/providers/docker/resource_docker_container_funcs.go
index c6bd9dea8..058a4411b 100644
--- a/builtin/providers/docker/resource_docker_container_funcs.go
+++ b/builtin/providers/docker/resource_docker_container_funcs.go
@@ -5,11 +5,16 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"time"
 
 	dc "github.com/fsouza/go-dockerclient"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
+var (
+	creationTime time.Time
+)
+
 func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) error {
 	var err error
 	client := meta.(*dc.Client)
@@ -23,9 +28,8 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 	if _, ok := data.DockerImages[image]; !ok {
 		if _, ok := data.DockerImages[image+":latest"]; !ok {
 			return fmt.Errorf("Unable to find image %s", image)
-		} else {
-			image = image + ":latest"
 		}
+		image = image + ":latest"
 	}
 
 	// The awesome, wonderful, splendiferous, sensical
@@ -85,6 +89,7 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 	d.SetId(retContainer.ID)
 
 	hostConfig := &dc.HostConfig{
+		Privileged:      d.Get("privileged").(bool),
 		PublishAllPorts: d.Get("publish_all_ports").(bool),
 	}
 
@@ -107,6 +112,7 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 		hostConfig.Links = stringSetToStringSlice(v.(*schema.Set))
 	}
 
+	creationTime = time.Now()
 	if err := client.StartContainer(retContainer.ID, hostConfig); err != nil {
 		return fmt.Errorf("Unable to start container: %s", err)
 	}
@@ -121,21 +127,49 @@ func resourceDockerContainerRead(d *schema.ResourceData, meta interface{}) error
 	if err != nil {
 		return err
 	}
-
 	if apiContainer == nil {
 		// This container doesn't exist anymore
 		d.SetId("")
-
 		return nil
 	}
 
-	container, err := client.InspectContainer(apiContainer.ID)
-	if err != nil {
-		return fmt.Errorf("Error inspecting container %s: %s", apiContainer.ID, err)
+	var container *dc.Container
+
+	loops := 1 // if it hasn't just been created, don't delay
+	if !creationTime.IsZero() {
+		loops = 30 // with 500ms spacing, 15 seconds; ought to be plenty
+	}
+	sleepTime := 500 * time.Millisecond
+
+	for i := loops; i > 0; i-- {
+		container, err = client.InspectContainer(apiContainer.ID)
+		if err != nil {
+			return fmt.Errorf("Error inspecting container %s: %s", apiContainer.ID, err)
+		}
+
+		if container.State.Running ||
+			(!container.State.Running && !d.Get("must_run").(bool)) {
+			break
+		}
+
+		if creationTime.IsZero() { // We didn't just create it, so don't wait around
+			return resourceDockerContainerDelete(d, meta)
+		}
+
+		if container.State.FinishedAt.After(creationTime) {
+			// It exited immediately, so error out so dependent containers
+			// aren't started
+			resourceDockerContainerDelete(d, meta)
+			return fmt.Errorf("Container %s exited after creation, error was: %s", apiContainer.ID, container.State.Error)
+		}
+
+		time.Sleep(sleepTime)
 	}
 
-	if d.Get("must_run").(bool) && !container.State.Running {
-		return resourceDockerContainerDelete(d, meta)
+	// Handle the case of the for loop above running its course
+	if !container.State.Running && d.Get("must_run").(bool) {
+		resourceDockerContainerDelete(d, meta)
+		return fmt.Errorf("Container %s failed to be in running state", apiContainer.ID)
 	}
 
 	// Read Network Settings
@@ -200,15 +234,17 @@ func fetchDockerContainer(name string, client *dc.Client) (*dc.APIContainers, er
 		// Sometimes the Docker API prefixes container names with /
 		// like it does in these commands. But if there's no
 		// set name, it just uses the ID without a /...ugh.
-		var dockerContainerName string
-		if len(apiContainer.Names) > 0 {
-			dockerContainerName = strings.TrimLeft(apiContainer.Names[0], "/")
-		} else {
-			dockerContainerName = apiContainer.ID
-		}
-
-		if dockerContainerName == name {
-			return &apiContainer, nil
+		switch len(apiContainer.Names) {
+		case 0:
+			if apiContainer.ID == name {
+				return &apiContainer, nil
+			}
+		default:
+			for _, containerName := range apiContainer.Names {
+				if strings.TrimLeft(containerName, "/") == name {
+					return &apiContainer, nil
+				}
+			}
 		}
 	}
 
diff --git a/builtin/providers/docker/resource_docker_container_test.go b/builtin/providers/docker/resource_docker_container_test.go
index 48302d096..29ecc4bb3 100644
--- a/builtin/providers/docker/resource_docker_container_test.go
+++ b/builtin/providers/docker/resource_docker_container_test.go
@@ -53,7 +53,7 @@ func testAccContainerRunning(n string) resource.TestCheckFunc {
 
 const testAccDockerContainerConfig = `
 resource "docker_image" "foo" {
-	name = "ubuntu:trusty-20150320"
+	name = "nginx:latest"
 }
 
 resource "docker_container" "foo" {
diff --git a/builtin/providers/docker/resource_docker_image_funcs.go b/builtin/providers/docker/resource_docker_image_funcs.go
index 8fb58ba28..f45dd2226 100644
--- a/builtin/providers/docker/resource_docker_image_funcs.go
+++ b/builtin/providers/docker/resource_docker_image_funcs.go
@@ -3,7 +3,6 @@ package docker
 import (
 	"fmt"
 	"strings"
-	"regexp"
 
 	dc "github.com/fsouza/go-dockerclient"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -76,28 +75,36 @@ func pullImage(data *Data, client *dc.Client, image string) error {
 
 	pullOpts := dc.PullImageOptions{}
 
-	// 
-	// Breaks apart an image string into host:port, repo, and tag components
-	regex := "^(?:(?P<host>(?:[\\w-]+(?:\\.[\\w-]+)+)(?::[\\d]+)?)/)?(?P<repo>[\\w.-]+(?:/[\\w.-]*)*)*(?::(?P<tag>[\\w.-]*))?"
-	r, _ := regexp.Compile(regex)
+	splitImageName := strings.Split(image, ":")
+	switch len(splitImageName) {
 
-	// Result is in form [[image, host, repo, tag]], so we get the head of the 
-	// outer list to pass the inner list to result
-	result := r.FindAllStringSubmatch(image, -1)[0]
+	// It's in registry:port/username/repo:tag or registry:port/repo:tag format
+	case 3:
+		splitPortRepo := strings.Split(splitImageName[1], "/")
+		pullOpts.Registry = splitImageName[0] + ":" + splitPortRepo[0]
+		pullOpts.Tag = splitImageName[2]
+		pullOpts.Repository = strings.Join(splitPortRepo[1:], "/")
 
-	// If the host is not an empty string, then the image is using a private registry
-	if (result[1] != "") {
-		pullOpts.Registry = result[1]
-		// The repository for a private registry should take the form of host/repo rather than just repo
-		pullOpts.Repository = result[1] + "/" + result[2]
-	} else if (result[2] != "") {
-		// Local registries, or the main docker registry will have an image named as just 'repo'
-		pullOpts.Repository = result[2]
-	}
+	// It's either registry:port/username/repo, registry:port/repo,
+	// or repo:tag with default registry
+	case 2:
+		splitPortRepo := strings.Split(splitImageName[1], "/")
+		switch len(splitPortRepo) {
+		// repo:tag
+		case 1:
+			pullOpts.Repository = splitImageName[0]
+			pullOpts.Tag = splitImageName[1]
 
-	// If there was a tag specified, then set it
-	if (result[3] != "") {
-		pullOpts.Tag = result[3]
+		// registry:port/username/repo or registry:port/repo
+		default:
+			pullOpts.Registry = splitImageName[0] + ":" + splitPortRepo[0]
+			pullOpts.Repository = strings.Join(splitPortRepo[1:], "/")
+			pullOpts.Tag = "latest"
+		}
+
+	// Plain username/repo or repo
+	default:
+		pullOpts.Repository = image
 	}
 
 	if err := client.PullImage(pullOpts, dc.AuthConfiguration{}); err != nil {
diff --git a/builtin/providers/google/config.go b/builtin/providers/google/config.go
index b57c306d1..189653cf6 100644
--- a/builtin/providers/google/config.go
+++ b/builtin/providers/google/config.go
@@ -16,8 +16,10 @@ import (
 	"golang.org/x/oauth2/jwt"
 	"google.golang.org/api/autoscaler/v1beta2"
 	"google.golang.org/api/compute/v1"
+	"google.golang.org/api/container/v1"
 	"google.golang.org/api/dns/v1"
 	"google.golang.org/api/replicapool/v1beta2"
+	"google.golang.org/api/storage/v1"
 )
 
 // Config is the configuration structure used to instantiate the Google
@@ -27,10 +29,12 @@ type Config struct {
 	Project     string
 	Region      string
 
+	clientAutoscaler *autoscaler.Service
 	clientCompute *compute.Service
+	clientContainer *container.Service
 	clientDns *dns.Service
 	clientReplicaPool *replicapool.Service
-	clientAutoscaler *autoscaler.Service
+	clientStorage *storage.Service
 }
 
 func (c *Config) loadAndValidate() error {
@@ -59,7 +63,9 @@ func (c *Config) loadAndValidate() error {
 
 		clientScopes := []string{
 			"https://www.googleapis.com/auth/compute",
+			"https://www.googleapis.com/auth/cloud-platform",
 			"https://www.googleapis.com/auth/ndev.clouddns.readwrite",
+			"https://www.googleapis.com/auth/devstorage.full_control",
 		}
 
 		// Get the token for use in our requests
@@ -112,6 +118,13 @@ func (c *Config) loadAndValidate() error {
 	}
 	c.clientCompute.UserAgent = userAgent
 
+	log.Printf("[INFO] Instantiating GKE client...")
+	c.clientContainer, err = container.New(client)
+	if err != nil {
+		return err
+	}
+	c.clientContainer.UserAgent = userAgent
+
 	log.Printf("[INFO] Instantiating Google Cloud DNS client...")
 	c.clientDns, err = dns.New(client)
 	if err != nil {
@@ -133,6 +146,13 @@ func (c *Config) loadAndValidate() error {
 	}
 	c.clientAutoscaler.UserAgent = userAgent
 
+	log.Printf("[INFO] Instantiating Google Storage Client...")
+	c.clientStorage, err = storage.New(client)
+	if err != nil {
+		return err
+	}
+	c.clientStorage.UserAgent = userAgent
+
 	return nil
 }
 
diff --git a/builtin/providers/google/dns_change.go b/builtin/providers/google/dns_change.go
index d8cb73cdf..a1facdd99 100644
--- a/builtin/providers/google/dns_change.go
+++ b/builtin/providers/google/dns_change.go
@@ -7,9 +7,9 @@ import (
 )
 
 type DnsChangeWaiter struct {
-	Service *dns.Service
-	Change *dns.Change
-	Project string
+	Service     *dns.Service
+	Change      *dns.Change
+	Project     string
 	ManagedZone string
 }
 
diff --git a/builtin/providers/google/provider.go b/builtin/providers/google/provider.go
index be28459fc..c38b736e3 100644
--- a/builtin/providers/google/provider.go
+++ b/builtin/providers/google/provider.go
@@ -40,9 +40,11 @@ func Provider() terraform.ResourceProvider {
 			"google_compute_network": resourceComputeNetwork(),
 			"google_compute_route": resourceComputeRoute(),
 			"google_compute_target_pool": resourceComputeTargetPool(),
+			"google_container_cluster": resourceContainerCluster(),
 			"google_dns_managed_zone": resourceDnsManagedZone(),
 			"google_dns_record_set": resourceDnsRecordSet(),
 			"google_replicapool_instance_group_manager": resourceReplicaPoolInstanceGroupManager(),
+			"google_storage_bucket": resourceStorageBucket(),
 		},
 
 		ConfigureFunc: providerConfigure,
diff --git a/builtin/providers/google/resource_compute_http_health_check_test.go b/builtin/providers/google/resource_compute_http_health_check_test.go
index d071b5ae3..c37c770bb 100644
--- a/builtin/providers/google/resource_compute_http_health_check_test.go
+++ b/builtin/providers/google/resource_compute_http_health_check_test.go
@@ -116,7 +116,7 @@ func testAccCheckComputeHttpHealthCheckExists(n string, healthCheck *compute.Htt
 func testAccCheckComputeHttpHealthCheckRequestPath(path string, healthCheck *compute.HttpHealthCheck) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if healthCheck.RequestPath != path {
-			return fmt.Errorf("RequestPath doesn't match: expected %d, got %d", path, healthCheck.RequestPath)
+			return fmt.Errorf("RequestPath doesn't match: expected %s, got %s", path, healthCheck.RequestPath)
 		}
 
 		return nil
diff --git a/builtin/providers/google/resource_compute_instance.go b/builtin/providers/google/resource_compute_instance.go
index 956f27457..8233815b3 100644
--- a/builtin/providers/google/resource_compute_instance.go
+++ b/builtin/providers/google/resource_compute_instance.go
@@ -101,7 +101,7 @@ func resourceComputeInstance() *schema.Resource {
 						},
 
 						"device_name": &schema.Schema{
-							Type: schema.TypeString,
+							Type:     schema.TypeString,
 							Optional: true,
 						},
 					},
@@ -148,9 +148,9 @@ func resourceComputeInstance() *schema.Resource {
 			},
 
 			"network": &schema.Schema{
-				Type:     schema.TypeList,
-				Optional: true,
-				ForceNew: true,
+				Type:       schema.TypeList,
+				Optional:   true,
+				ForceNew:   true,
 				Deprecated: "Please use network_interface",
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
@@ -191,6 +191,12 @@ func resourceComputeInstance() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"metadata_startup_script": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"metadata": &schema.Schema{
 				Type:     schema.TypeMap,
 				Optional: true,
@@ -229,7 +235,7 @@ func resourceComputeInstance() *schema.Resource {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set: stringHashcode,
+				Set:      stringHashcode,
 			},
 
 			"metadata_fingerprint": &schema.Schema{
@@ -327,7 +333,7 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 			disk.Source = diskData.SelfLink
 		} else {
 			// Create a new disk
-			disk.InitializeParams = &compute.AttachedDiskInitializeParams{ }
+			disk.InitializeParams = &compute.AttachedDiskInitializeParams{}
 		}
 
 		if v, ok := d.GetOk(prefix + ".scratch"); ok {
@@ -367,7 +373,7 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 			disk.InitializeParams.DiskSizeGb = int64(diskSizeGb)
 		}
 
-		if v, ok := d.GetOk(prefix  + ".device_name"); ok {
+		if v, ok := d.GetOk(prefix + ".device_name"); ok {
 			disk.DeviceName = v.(string)
 		}
 
@@ -469,13 +475,18 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 		serviceAccounts = append(serviceAccounts, serviceAccount)
 	}
 
+	metadata, err := resourceInstanceMetadata(d)
+	if err != nil {
+		return fmt.Errorf("Error creating metadata: %s", err)
+	}
+
 	// Create the instance information
 	instance := compute.Instance{
 		CanIpForward:      d.Get("can_ip_forward").(bool),
 		Description:       d.Get("description").(string),
 		Disks:             disks,
 		MachineType:       machineType.SelfLink,
-		Metadata:          resourceInstanceMetadata(d),
+		Metadata:          metadata,
 		Name:              d.Get("name").(string),
 		NetworkInterfaces: networkInterfaces,
 		Tags:              resourceInstanceTags(d),
@@ -662,7 +673,10 @@ func resourceComputeInstanceUpdate(d *schema.ResourceData, meta interface{}) err
 
 	// If the Metadata has changed, then update that.
 	if d.HasChange("metadata") {
-		metadata := resourceInstanceMetadata(d)
+		metadata, err := resourceInstanceMetadata(d)
+		if err != nil {
+			return fmt.Errorf("Error updating metadata: %s", err)
+		}
 		op, err := config.clientCompute.Instances.SetMetadata(
 			config.Project, zone, d.Id(), metadata).Do()
 		if err != nil {
@@ -781,9 +795,18 @@ func resourceComputeInstanceDelete(d *schema.ResourceData, meta interface{}) err
 	return nil
 }
 
-func resourceInstanceMetadata(d *schema.ResourceData) *compute.Metadata {
+func resourceInstanceMetadata(d *schema.ResourceData) (*compute.Metadata, error) {
 	m := &compute.Metadata{}
-	if mdMap := d.Get("metadata").(map[string]interface{}); len(mdMap) > 0 {
+	mdMap := d.Get("metadata").(map[string]interface{})
+	_, mapScriptExists := mdMap["startup-script"]
+	dScript, dScriptExists := d.GetOk("metadata_startup_script")
+	if mapScriptExists && dScriptExists {
+		return nil, fmt.Errorf("Not allowed to have both metadata_startup_script and metadata.startup-script")
+	}
+	if dScriptExists {
+		mdMap["startup-script"] = dScript
+	}
+	if len(mdMap) > 0 {
 		m.Items = make([]*compute.MetadataItems, 0, len(mdMap))
 		for key, val := range mdMap {
 			m.Items = append(m.Items, &compute.MetadataItems{
@@ -797,7 +820,7 @@ func resourceInstanceMetadata(d *schema.ResourceData) *compute.Metadata {
 		m.Fingerprint = d.Get("metadata_fingerprint").(string)
 	}
 
-	return m
+	return m, nil
 }
 
 func resourceInstanceTags(d *schema.ResourceData) *compute.Tags {
diff --git a/builtin/providers/google/resource_compute_instance_migrate.go b/builtin/providers/google/resource_compute_instance_migrate.go
index 749839ad1..05dc6b572 100644
--- a/builtin/providers/google/resource_compute_instance_migrate.go
+++ b/builtin/providers/google/resource_compute_instance_migrate.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-    "github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -127,7 +127,6 @@ func migrateStateV1toV2(is *terraform.InstanceState) (*terraform.InstanceState,
 		delete(is.Attributes, k)
 	}
 
-
 	for service_acct_index, newScopes := range newScopesMap {
 		for _, newScope := range newScopes {
 			hash := hashcode.String(canonicalizeServiceScope(newScope))
diff --git a/builtin/providers/google/resource_compute_instance_migrate_test.go b/builtin/providers/google/resource_compute_instance_migrate_test.go
index 9272761ce..7f9857e48 100644
--- a/builtin/providers/google/resource_compute_instance_migrate_test.go
+++ b/builtin/providers/google/resource_compute_instance_migrate_test.go
@@ -30,8 +30,8 @@ func TestComputeInstanceMigrateState(t *testing.T) {
 		"change scope from list to set": {
 			StateVersion: 1,
 			Attributes: map[string]string{
-				"service_account.#": "1",
-				"service_account.0.email": "xxxxxx-compute@developer.gserviceaccount.com",
+				"service_account.#":          "1",
+				"service_account.0.email":    "xxxxxx-compute@developer.gserviceaccount.com",
 				"service_account.0.scopes.#": "4",
 				"service_account.0.scopes.0": "https://www.googleapis.com/auth/compute",
 				"service_account.0.scopes.1": "https://www.googleapis.com/auth/datastore",
@@ -39,12 +39,12 @@ func TestComputeInstanceMigrateState(t *testing.T) {
 				"service_account.0.scopes.3": "https://www.googleapis.com/auth/logging.write",
 			},
 			Expected: map[string]string{
-				"service_account.#": "1",
-				"service_account.0.email": "xxxxxx-compute@developer.gserviceaccount.com",
-				"service_account.0.scopes.#": "4",
+				"service_account.#":                   "1",
+				"service_account.0.email":             "xxxxxx-compute@developer.gserviceaccount.com",
+				"service_account.0.scopes.#":          "4",
 				"service_account.0.scopes.1693978638": "https://www.googleapis.com/auth/devstorage.full_control",
-				"service_account.0.scopes.172152165": "https://www.googleapis.com/auth/logging.write",
-				"service_account.0.scopes.299962681": "https://www.googleapis.com/auth/compute",
+				"service_account.0.scopes.172152165":  "https://www.googleapis.com/auth/logging.write",
+				"service_account.0.scopes.299962681":  "https://www.googleapis.com/auth/compute",
 				"service_account.0.scopes.3435931483": "https://www.googleapis.com/auth/datastore",
 			},
 		},
diff --git a/builtin/providers/google/resource_compute_instance_template.go b/builtin/providers/google/resource_compute_instance_template.go
index a712bb7d2..cf1103402 100644
--- a/builtin/providers/google/resource_compute_instance_template.go
+++ b/builtin/providers/google/resource_compute_instance_template.go
@@ -344,7 +344,11 @@ func resourceComputeInstanceTemplateCreate(d *schema.ResourceData, meta interfac
 		return err
 	}
 	instanceProperties.Disks = disks
-	instanceProperties.Metadata = resourceInstanceMetadata(d)
+	metadata, err := resourceInstanceMetadata(d)
+	if err != nil {
+		return err
+	}
+	instanceProperties.Metadata = metadata
 	err, networks := buildNetworks(d, meta)
 	if err != nil {
 		return err
diff --git a/builtin/providers/google/resource_compute_instance_test.go b/builtin/providers/google/resource_compute_instance_test.go
index 70d0c5f2f..3ae487a18 100644
--- a/builtin/providers/google/resource_compute_instance_test.go
+++ b/builtin/providers/google/resource_compute_instance_test.go
@@ -476,10 +476,10 @@ resource "google_compute_instance" "foobar" {
 
 	metadata {
 		foo = "bar"
-	}
-	metadata {
 		baz = "qux"
 	}
+
+	metadata_startup_script = "echo Hello"
 }`
 
 const testAccComputeInstance_basic2 = `
diff --git a/builtin/providers/google/resource_container_cluster.go b/builtin/providers/google/resource_container_cluster.go
new file mode 100644
index 000000000..be9573813
--- /dev/null
+++ b/builtin/providers/google/resource_container_cluster.go
@@ -0,0 +1,445 @@
+package google
+
+import (
+	"fmt"
+	"log"
+	"net"
+	"regexp"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"google.golang.org/api/container/v1"
+)
+
+func resourceContainerCluster() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceContainerClusterCreate,
+		Read:   resourceContainerClusterRead,
+		Update: resourceContainerClusterUpdate,
+		Delete: resourceContainerClusterDelete,
+
+		Schema: map[string]*schema.Schema{
+			"zone": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"node_version": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
+			"cluster_ipv4_cidr": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					_, ipnet, err := net.ParseCIDR(value)
+
+					if err != nil || ipnet == nil || value != ipnet.String() {
+						errors = append(errors, fmt.Errorf(
+							"%q must contain a valid CIDR", k))
+					}
+					return
+				},
+			},
+
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"endpoint": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"logging_service": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"monitoring_service": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"master_auth": &schema.Schema{
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"client_certificate": &schema.Schema{
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"client_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"cluster_ca_certificate": &schema.Schema{
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"password": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+
+						"username": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+
+					if len(value) > 40 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 40 characters", k))
+					}
+					if !regexp.MustCompile("^[a-z0-9-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q can only contain lowercase letters, numbers and hyphens", k))
+					}
+					if !regexp.MustCompile("^[a-z]").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must start with a letter", k))
+					}
+					if !regexp.MustCompile("[a-z0-9]$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must end with a number or a letter", k))
+					}
+					return
+				},
+			},
+
+			"network": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "default",
+				ForceNew: true,
+			},
+
+			"node_config": &schema.Schema{
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"machine_type": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+						},
+
+						"disk_size_gb": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+							ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+								value := v.(int)
+
+								if value < 10 {
+									errors = append(errors, fmt.Errorf(
+										"%q cannot be less than 10", k))
+								}
+								return
+							},
+						},
+
+						"oauth_scopes": &schema.Schema{
+							Type:     schema.TypeList,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+
+			"initial_node_count": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"instance_group_urls": &schema.Schema{
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	zoneName := d.Get("zone").(string)
+	clusterName := d.Get("name").(string)
+
+	masterAuths := d.Get("master_auth").([]interface{})
+	if len(masterAuths) > 1 {
+		return fmt.Errorf("Cannot specify more than one master_auth.")
+	}
+	masterAuth := masterAuths[0].(map[string]interface{})
+
+	cluster := &container.Cluster{
+		MasterAuth: &container.MasterAuth{
+			Password: masterAuth["password"].(string),
+			Username: masterAuth["username"].(string),
+		},
+		Name:             clusterName,
+		InitialNodeCount: int64(d.Get("initial_node_count").(int)),
+	}
+
+	if v, ok := d.GetOk("cluster_ipv4_cidr"); ok {
+		cluster.ClusterIpv4Cidr = v.(string)
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		cluster.Description = v.(string)
+	}
+
+	if v, ok := d.GetOk("logging_service"); ok {
+		cluster.LoggingService = v.(string)
+	}
+
+	if v, ok := d.GetOk("monitoring_service"); ok {
+		cluster.MonitoringService = v.(string)
+	}
+
+	if v, ok := d.GetOk("network"); ok {
+		cluster.Network = v.(string)
+	}
+
+	if v, ok := d.GetOk("node_config"); ok {
+		nodeConfigs := v.([]interface{})
+		if len(nodeConfigs) > 1 {
+			return fmt.Errorf("Cannot specify more than one node_config.")
+		}
+		nodeConfig := nodeConfigs[0].(map[string]interface{})
+
+		cluster.NodeConfig = &container.NodeConfig{}
+
+		if v, ok = nodeConfig["machine_type"]; ok {
+			cluster.NodeConfig.MachineType = v.(string)
+		}
+
+		if v, ok = nodeConfig["disk_size_gb"]; ok {
+			cluster.NodeConfig.DiskSizeGb = v.(int64)
+		}
+
+		if v, ok := nodeConfig["oauth_scopes"]; ok {
+			scopesList := v.([]interface{})
+			scopes := []string{}
+			for _, v := range scopesList {
+				scopes = append(scopes, v.(string))
+			}
+
+			cluster.NodeConfig.OauthScopes = scopes
+		}
+	}
+
+	req := &container.CreateClusterRequest{
+		Cluster: cluster,
+	}
+
+	op, err := config.clientContainer.Projects.Zones.Clusters.Create(
+		config.Project, zoneName, req).Do()
+	if err != nil {
+		return err
+	}
+
+	// Wait until it's created
+	wait := resource.StateChangeConf{
+		Pending:    []string{"PENDING", "RUNNING"},
+		Target:     "DONE",
+		Timeout:    30 * time.Minute,
+		MinTimeout: 3 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			resp, err := config.clientContainer.Projects.Zones.Operations.Get(
+				config.Project, zoneName, op.Name).Do()
+			log.Printf("[DEBUG] Progress of creating GKE cluster %s: %s",
+				clusterName, resp.Status)
+			return resp, resp.Status, err
+		},
+	}
+
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[INFO] GKE cluster %s has been created", clusterName)
+
+	d.SetId(clusterName)
+
+	return resourceContainerClusterRead(d, meta)
+}
+
+func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	zoneName := d.Get("zone").(string)
+
+	cluster, err := config.clientContainer.Projects.Zones.Clusters.Get(
+		config.Project, zoneName, d.Get("name").(string)).Do()
+	if err != nil {
+		return err
+	}
+
+	d.Set("name", cluster.Name)
+	d.Set("zone", cluster.Zone)
+	d.Set("endpoint", cluster.Endpoint)
+
+	masterAuth := []map[string]interface{}{
+		map[string]interface{}{
+			"username":               cluster.MasterAuth.Username,
+			"password":               cluster.MasterAuth.Password,
+			"client_certificate":     cluster.MasterAuth.ClientCertificate,
+			"client_key":             cluster.MasterAuth.ClientKey,
+			"cluster_ca_certificate": cluster.MasterAuth.ClusterCaCertificate,
+		},
+	}
+	d.Set("master_auth", masterAuth)
+
+	d.Set("initial_node_count", cluster.InitialNodeCount)
+	d.Set("node_version", cluster.CurrentNodeVersion)
+	d.Set("cluster_ipv4_cidr", cluster.ClusterIpv4Cidr)
+	d.Set("description", cluster.Description)
+	d.Set("logging_service", cluster.LoggingService)
+	d.Set("monitoring_service", cluster.MonitoringService)
+	d.Set("network", cluster.Network)
+	d.Set("node_config", flattenClusterNodeConfig(cluster.NodeConfig))
+	d.Set("instance_group_urls", cluster.InstanceGroupUrls)
+
+	return nil
+}
+
+func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	zoneName := d.Get("zone").(string)
+	clusterName := d.Get("name").(string)
+	desiredNodeVersion := d.Get("node_version").(string)
+
+	req := &container.UpdateClusterRequest{
+		Update: &container.ClusterUpdate{
+			DesiredNodeVersion: desiredNodeVersion,
+		},
+	}
+	op, err := config.clientContainer.Projects.Zones.Clusters.Update(
+		config.Project, zoneName, clusterName, req).Do()
+	if err != nil {
+		return err
+	}
+
+	// Wait until it's updated
+	wait := resource.StateChangeConf{
+		Pending:    []string{"PENDING", "RUNNING"},
+		Target:     "DONE",
+		Timeout:    10 * time.Minute,
+		MinTimeout: 2 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			log.Printf("[DEBUG] Checking if GKE cluster %s is updated", clusterName)
+			resp, err := config.clientContainer.Projects.Zones.Operations.Get(
+				config.Project, zoneName, op.Name).Do()
+			log.Printf("[DEBUG] Progress of updating GKE cluster %s: %s",
+				clusterName, resp.Status)
+			return resp, resp.Status, err
+		},
+	}
+
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[INFO] GKE cluster %s has been updated to %s", d.Id(),
+		desiredNodeVersion)
+
+	return resourceContainerClusterRead(d, meta)
+}
+
+func resourceContainerClusterDelete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	zoneName := d.Get("zone").(string)
+	clusterName := d.Get("name").(string)
+
+	log.Printf("[DEBUG] Deleting GKE cluster %s", d.Get("name").(string))
+	op, err := config.clientContainer.Projects.Zones.Clusters.Delete(
+		config.Project, zoneName, clusterName).Do()
+	if err != nil {
+		return err
+	}
+
+	// Wait until it's deleted
+	wait := resource.StateChangeConf{
+		Pending:    []string{"PENDING", "RUNNING"},
+		Target:     "DONE",
+		Timeout:    10 * time.Minute,
+		MinTimeout: 3 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			log.Printf("[DEBUG] Checking if GKE cluster %s is deleted", clusterName)
+			resp, err := config.clientContainer.Projects.Zones.Operations.Get(
+				config.Project, zoneName, op.Name).Do()
+			log.Printf("[DEBUG] Progress of deleting GKE cluster %s: %s",
+				clusterName, resp.Status)
+			return resp, resp.Status, err
+		},
+	}
+
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[INFO] GKE cluster %s has been deleted", d.Id())
+
+	d.SetId("")
+
+	return nil
+}
+
+func flattenClusterNodeConfig(c *container.NodeConfig) []map[string]interface{} {
+	config := []map[string]interface{}{
+		map[string]interface{}{
+			"machine_type": c.MachineType,
+			"disk_size_gb": c.DiskSizeGb,
+		},
+	}
+
+	if len(c.OauthScopes) > 0 {
+		config[0]["oauth_scopes"] = c.OauthScopes
+	}
+
+	return config
+}
diff --git a/builtin/providers/google/resource_container_cluster_test.go b/builtin/providers/google/resource_container_cluster_test.go
new file mode 100644
index 000000000..daced5513
--- /dev/null
+++ b/builtin/providers/google/resource_container_cluster_test.go
@@ -0,0 +1,85 @@
+package google
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccContainerCluster_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckContainerClusterDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccContainerCluster_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContainerClusterExists(
+						"google_container_cluster.primary"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckContainerClusterDestroy(s *terraform.State) error {
+	config := testAccProvider.Meta().(*Config)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "google_container_cluster" {
+			continue
+		}
+
+		attributes := rs.Primary.Attributes
+		_, err := config.clientContainer.Projects.Zones.Clusters.Get(
+			config.Project, attributes["zone"], attributes["name"]).Do()
+		if err == nil {
+			return fmt.Errorf("Cluster still exists")
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckContainerClusterExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		config := testAccProvider.Meta().(*Config)
+
+		attributes := rs.Primary.Attributes
+		found, err := config.clientContainer.Projects.Zones.Clusters.Get(
+			config.Project, attributes["zone"], attributes["name"]).Do()
+		if err != nil {
+			return err
+		}
+
+		if found.Name != attributes["name"] {
+			return fmt.Errorf("Cluster not found")
+		}
+
+		return nil
+	}
+}
+
+const testAccContainerCluster_basic = `
+resource "google_container_cluster" "primary" {
+	name = "terraform-foo-bar-test"
+	zone = "us-central1-a"
+	initial_node_count = 3
+
+	master_auth {
+		username = "mr.yoda"
+		password = "adoy.rm"
+	}
+}`
diff --git a/builtin/providers/google/resource_dns_managed_zone.go b/builtin/providers/google/resource_dns_managed_zone.go
index 0e10d3b0b..7253297e6 100644
--- a/builtin/providers/google/resource_dns_managed_zone.go
+++ b/builtin/providers/google/resource_dns_managed_zone.go
@@ -50,18 +50,18 @@ func resourceDnsManagedZone() *schema.Resource {
 func resourceDnsManagedZoneCreate(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*Config)
 
-    // Build the parameter
-    zone := &dns.ManagedZone{
-        Name: d.Get("name").(string),
+	// Build the parameter
+	zone := &dns.ManagedZone{
+		Name:    d.Get("name").(string),
 		DnsName: d.Get("dns_name").(string),
-    }
-    // Optional things
-    if v, ok := d.GetOk("description"); ok {
-        zone.Description = v.(string)
-    }
-    if v, ok := d.GetOk("dns_name"); ok {
-        zone.DnsName = v.(string)
-    }
+	}
+	// Optional things
+	if v, ok := d.GetOk("description"); ok {
+		zone.Description = v.(string)
+	}
+	if v, ok := d.GetOk("dns_name"); ok {
+		zone.DnsName = v.(string)
+	}
 
 	log.Printf("[DEBUG] DNS ManagedZone create request: %#v", zone)
 	zone, err := config.clientDns.ManagedZones.Create(config.Project, zone).Do()
@@ -90,7 +90,7 @@ func resourceDnsManagedZoneRead(d *schema.ResourceData, meta interface{}) error
 		return fmt.Errorf("Error reading DNS ManagedZone: %#v", err)
 	}
 
-    d.Set("name_servers", zone.NameServers)
+	d.Set("name_servers", zone.NameServers)
 
 	return nil
 }
diff --git a/builtin/providers/google/resource_dns_record_set.go b/builtin/providers/google/resource_dns_record_set.go
index 795d49985..05fa547f7 100644
--- a/builtin/providers/google/resource_dns_record_set.go
+++ b/builtin/providers/google/resource_dns_record_set.go
@@ -61,17 +61,17 @@ func resourceDnsRecordSetCreate(d *schema.ResourceData, meta interface{}) error
 
 	// Build the change
 	chg := &dns.Change{
-		Additions: []*dns.ResourceRecordSet {
-			&dns.ResourceRecordSet {
-				Name: d.Get("name").(string),
-				Type: d.Get("type").(string),
-				Ttl: int64(d.Get("ttl").(int)),
+		Additions: []*dns.ResourceRecordSet{
+			&dns.ResourceRecordSet{
+				Name:    d.Get("name").(string),
+				Type:    d.Get("type").(string),
+				Ttl:     int64(d.Get("ttl").(int)),
 				Rrdatas: make([]string, rrdatasCount),
 			},
 		},
 	}
 
-	for i := 0; i < rrdatasCount ; i++ {
+	for i := 0; i < rrdatasCount; i++ {
 		rrdata := fmt.Sprintf("rrdatas.%d", i)
 		chg.Additions[0].Rrdatas[i] = d.Get(rrdata).(string)
 	}
@@ -85,9 +85,9 @@ func resourceDnsRecordSetCreate(d *schema.ResourceData, meta interface{}) error
 	d.SetId(chg.Id)
 
 	w := &DnsChangeWaiter{
-		Service: config.clientDns,
-		Change: chg,
-		Project: config.Project,
+		Service:     config.clientDns,
+		Change:      chg,
+		Project:     config.Project,
 		ManagedZone: zone,
 	}
 	state := w.Conf()
@@ -126,7 +126,6 @@ func resourceDnsRecordSetRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("Only expected 1 record set, got %d", len(resp.Rrsets))
 	}
 
-
 	d.Set("ttl", resp.Rrsets[0].Ttl)
 	d.Set("rrdatas", resp.Rrsets[0].Rrdatas)
 
@@ -142,17 +141,17 @@ func resourceDnsRecordSetDelete(d *schema.ResourceData, meta interface{}) error
 
 	// Build the change
 	chg := &dns.Change{
-		Deletions: []*dns.ResourceRecordSet {
-			&dns.ResourceRecordSet {
-				Name: d.Get("name").(string),
-				Type: d.Get("type").(string),
-				Ttl: int64(d.Get("ttl").(int)),
+		Deletions: []*dns.ResourceRecordSet{
+			&dns.ResourceRecordSet{
+				Name:    d.Get("name").(string),
+				Type:    d.Get("type").(string),
+				Ttl:     int64(d.Get("ttl").(int)),
 				Rrdatas: make([]string, rrdatasCount),
 			},
 		},
 	}
 
-	for i := 0; i < rrdatasCount ; i++ {
+	for i := 0; i < rrdatasCount; i++ {
 		rrdata := fmt.Sprintf("rrdatas.%d", i)
 		chg.Deletions[0].Rrdatas[i] = d.Get(rrdata).(string)
 	}
@@ -163,9 +162,9 @@ func resourceDnsRecordSetDelete(d *schema.ResourceData, meta interface{}) error
 	}
 
 	w := &DnsChangeWaiter{
-		Service: config.clientDns,
-		Change: chg,
-		Project: config.Project,
+		Service:     config.clientDns,
+		Change:      chg,
+		Project:     config.Project,
 		ManagedZone: zone,
 	}
 	state := w.Conf()
diff --git a/builtin/providers/google/resource_storage_bucket.go b/builtin/providers/google/resource_storage_bucket.go
new file mode 100644
index 000000000..59370720e
--- /dev/null
+++ b/builtin/providers/google/resource_storage_bucket.go
@@ -0,0 +1,144 @@
+package google
+
+import (
+	"errors"
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"google.golang.org/api/storage/v1"
+)
+
+func resourceStorageBucket() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceStorageBucketCreate,
+		Read:   resourceStorageBucketRead,
+		Update: resourceStorageBucketUpdate,
+		Delete: resourceStorageBucketDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"predefined_acl": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "projectPrivate",
+				Optional: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "US",
+				Optional: true,
+				ForceNew: true,
+			},
+			"force_destroy": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+		},
+	}
+}
+
+func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket and acl
+	bucket := d.Get("name").(string)
+	acl := d.Get("predefined_acl").(string)
+	location := d.Get("location").(string)
+
+	// Create a bucket, setting the acl, location and name.
+	sb := &storage.Bucket{Name: bucket, Location: location}
+	res, err := config.clientStorage.Buckets.Insert(config.Project, sb).PredefinedAcl(acl).Do()
+
+	if err != nil {
+		fmt.Printf("Error creating bucket %s: %v", bucket, err)
+		return err
+	}
+
+	log.Printf("[DEBUG] Created bucket %v at location %v\n\n", res.Name, res.SelfLink)
+
+	// Assign the bucket ID as the resource ID
+	d.SetId(res.Id)
+
+	return nil
+}
+
+func resourceStorageBucketUpdate(d *schema.ResourceData, meta interface{}) error {
+	// Only thing you can currently change is force_delete (all other properties have ForceNew)
+	// which is just terraform object state change, so nothing to do here
+	return nil
+}
+
+func resourceStorageBucketRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket and acl
+	bucket := d.Get("name").(string)
+	res, err := config.clientStorage.Buckets.Get(bucket).Do()
+
+	if err != nil {
+		fmt.Printf("Error reading bucket %s: %v", bucket, err)
+		return err
+	}
+
+	log.Printf("[DEBUG] Read bucket %v at location %v\n\n", res.Name, res.SelfLink)
+
+	// Update the bucket ID according to the resource ID
+	d.SetId(res.Id)
+
+	return nil
+}
+
+func resourceStorageBucketDelete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket
+	bucket := d.Get("name").(string)
+
+	for {
+		res, err := config.clientStorage.Objects.List(bucket).Do()
+		if err != nil {
+			fmt.Printf("Error Objects.List failed: %v", err)
+			return err
+		}
+
+		if len(res.Items) != 0 {
+			if d.Get("force_destroy").(bool) {
+				// purge the bucket...
+				log.Printf("[DEBUG] GCS Bucket attempting to forceDestroy\n\n")
+
+				for _, object := range res.Items {
+					log.Printf("[DEBUG] Found %s", object.Name)
+					if err := config.clientStorage.Objects.Delete(bucket, object.Name).Do(); err != nil {
+						log.Fatalf("Error trying to delete object: %s %s\n\n", object.Name, err)
+					} else {
+						log.Printf("Object deleted: %s \n\n", object.Name)
+					}
+				}
+
+			} else {
+				delete_err := errors.New("Error trying to delete a bucket containing objects without `force_destroy` set to true")
+				log.Printf("Error! %s : %s\n\n", bucket, delete_err)
+				return delete_err
+			}
+		} else {
+			break // 0 items, bucket empty
+		}
+	}
+
+	// remove empty bucket
+	err := config.clientStorage.Buckets.Delete(bucket).Do()
+	if err != nil {
+		fmt.Printf("Error deleting bucket %s: %v\n\n", bucket, err)
+		return err
+	}
+	log.Printf("[DEBUG] Deleted bucket %v\n\n", bucket)
+
+	return nil
+}
diff --git a/builtin/providers/google/resource_storage_bucket_test.go b/builtin/providers/google/resource_storage_bucket_test.go
new file mode 100644
index 000000000..a7b59c61a
--- /dev/null
+++ b/builtin/providers/google/resource_storage_bucket_test.go
@@ -0,0 +1,231 @@
+package google
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"google.golang.org/api/googleapi"
+	storage "google.golang.org/api/storage/v1"
+)
+
+func TestAccStorage_basic(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderDefaults,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "projectPrivate"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "US"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "false"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageCustomAttributes(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "publicReadWrite"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "EU"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageBucketUpdate(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderDefaults,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "projectPrivate"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "US"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "false"),
+				),
+			},
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "publicReadWrite"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "EU"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageForceDestroy(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+				),
+			},
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketPutItem(&bucketName),
+				),
+			},
+			resource.TestStep{
+				Config: "",
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketMissing(&bucketName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStorageBucketExists(n string, bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Project_ID is set")
+		}
+
+		config := testAccProvider.Meta().(*Config)
+
+		found, err := config.clientStorage.Buckets.Get(rs.Primary.ID).Do()
+		if err != nil {
+			return err
+		}
+
+		if found.Id != rs.Primary.ID {
+			return fmt.Errorf("Bucket not found")
+		}
+
+		*bucketName = found.Name
+		return nil
+	}
+}
+
+func testAccCheckCloudStorageBucketPutItem(bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := testAccProvider.Meta().(*Config)
+
+		data := bytes.NewBufferString("test")
+		dataReader := bytes.NewReader(data.Bytes())
+		object := &storage.Object{Name: "bucketDestroyTestFile"}
+
+		// This needs to use Media(io.Reader) call, otherwise it does not go to /upload API and fails
+		if res, err := config.clientStorage.Objects.Insert(*bucketName, object).Media(dataReader).Do(); err == nil {
+			fmt.Printf("Created object %v at location %v\n\n", res.Name, res.SelfLink)
+		} else {
+			return fmt.Errorf("Objects.Insert failed: %v", err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStorageBucketMissing(bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := testAccProvider.Meta().(*Config)
+
+		_, err := config.clientStorage.Buckets.Get(*bucketName).Do()
+		if err == nil {
+			return fmt.Errorf("Found %s", *bucketName)
+		}
+
+		if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == 404 {
+			return nil
+		} else {
+			return err
+		}
+	}
+}
+
+func testAccGoogleStorageDestroy(s *terraform.State) error {
+	config := testAccProvider.Meta().(*Config)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "google_storage_bucket" {
+			continue
+		}
+
+		_, err := config.clientStorage.Buckets.Get(rs.Primary.ID).Do()
+		if err == nil {
+			return fmt.Errorf("Bucket still exists")
+		}
+	}
+
+	return nil
+}
+
+var randInt = rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+
+var testGoogleStorageBucketsReaderDefaults = fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+	name = "tf-test-bucket-%d"
+}
+`, randInt)
+
+var testGoogleStorageBucketsReaderCustomAttributes = fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+	name = "tf-test-bucket-%d"
+	predefined_acl = "publicReadWrite"
+	location = "EU"
+	force_destroy = "true"
+}
+`, randInt)
diff --git a/builtin/providers/openstack/config.go b/builtin/providers/openstack/config.go
index 903345fb6..f18465538 100644
--- a/builtin/providers/openstack/config.go
+++ b/builtin/providers/openstack/config.go
@@ -2,6 +2,7 @@ package openstack
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
 
 	"github.com/rackspace/gophercloud"
@@ -19,11 +20,20 @@ type Config struct {
 	DomainID         string
 	DomainName       string
 	Insecure         bool
+	EndpointType     string
 
 	osClient *gophercloud.ProviderClient
 }
 
 func (c *Config) loadAndValidate() error {
+
+	if c.EndpointType != "internal" && c.EndpointType != "internalURL" &&
+		c.EndpointType != "admin" && c.EndpointType != "adminURL" &&
+		c.EndpointType != "public" && c.EndpointType != "publicURL" &&
+		c.EndpointType != "" {
+		return fmt.Errorf("Invalid endpoint type provided")
+	}
+
 	ao := gophercloud.AuthOptions{
 		Username:         c.Username,
 		UserID:           c.UserID,
@@ -60,24 +70,38 @@ func (c *Config) loadAndValidate() error {
 
 func (c *Config) blockStorageV1Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewBlockStorageV1(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) computeV2Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewComputeV2(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) networkingV2Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewNetworkV2(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) objectStorageV1Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewObjectStorageV1(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
+
+func (c *Config) getEndpointType() gophercloud.Availability {
+	if c.EndpointType == "internal" || c.EndpointType == "internalURL" {
+		return gophercloud.AvailabilityInternal
+	}
+	if c.EndpointType == "admin" || c.EndpointType == "adminURL" {
+		return gophercloud.AvailabilityAdmin
+	}
+	return gophercloud.AvailabilityPublic
+}
diff --git a/builtin/providers/openstack/provider.go b/builtin/providers/openstack/provider.go
index 188beadd7..213acf989 100644
--- a/builtin/providers/openstack/provider.go
+++ b/builtin/providers/openstack/provider.go
@@ -42,9 +42,9 @@ func Provider() terraform.ResourceProvider {
 				DefaultFunc: envDefaultFunc("OS_PASSWORD"),
 			},
 			"api_key": &schema.Schema{
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  "",
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: envDefaultFuncAllowMissing("OS_AUTH_TOKEN"),
 			},
 			"domain_id": &schema.Schema{
 				Type:     schema.TypeString,
@@ -61,6 +61,11 @@ func Provider() terraform.ResourceProvider {
 				Optional: true,
 				Default:  false,
 			},
+			"endpoint_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: envDefaultFuncAllowMissing("OS_ENDPOINT_TYPE"),
+			},
 		},
 
 		ResourcesMap: map[string]*schema.Resource{
@@ -68,6 +73,7 @@ func Provider() terraform.ResourceProvider {
 			"openstack_compute_instance_v2":            resourceComputeInstanceV2(),
 			"openstack_compute_keypair_v2":             resourceComputeKeypairV2(),
 			"openstack_compute_secgroup_v2":            resourceComputeSecGroupV2(),
+			"openstack_compute_servergroup_v2":         resourceComputeServerGroupV2(),
 			"openstack_compute_floatingip_v2":          resourceComputeFloatingIPV2(),
 			"openstack_fw_firewall_v1":                 resourceFWFirewallV1(),
 			"openstack_fw_policy_v1":                   resourceFWPolicyV1(),
@@ -99,6 +105,7 @@ func configureProvider(d *schema.ResourceData) (interface{}, error) {
 		DomainID:         d.Get("domain_id").(string),
 		DomainName:       d.Get("domain_name").(string),
 		Insecure:         d.Get("insecure").(bool),
+		EndpointType:     d.Get("endpoint_type").(string),
 	}
 
 	if err := config.loadAndValidate(); err != nil {
diff --git a/builtin/providers/openstack/resource_openstack_blockstorage_volume_v1.go b/builtin/providers/openstack/resource_openstack_blockstorage_volume_v1.go
index 97a7325c7..2da5ee8bf 100644
--- a/builtin/providers/openstack/resource_openstack_blockstorage_volume_v1.go
+++ b/builtin/providers/openstack/resource_openstack_blockstorage_volume_v1.go
@@ -53,6 +53,7 @@ func resourceBlockStorageVolumeV1() *schema.Resource {
 				Type:     schema.TypeMap,
 				Optional: true,
 				ForceNew: false,
+				Computed: true,
 			},
 			"snapshot_id": &schema.Schema{
 				Type:     schema.TypeString,
diff --git a/builtin/providers/openstack/resource_openstack_compute_instance_v2.go b/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
index 02dafe5ae..f08f94031 100644
--- a/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
+++ b/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
@@ -15,6 +15,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/bootfromvolume"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/floatingip"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/keypairs"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/schedulerhints"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/secgroups"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/tenantnetworks"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/volumeattach"
@@ -209,7 +210,6 @@ func resourceComputeInstanceV2() *schema.Resource {
 					Schema: map[string]*schema.Schema{
 						"id": &schema.Schema{
 							Type:     schema.TypeString,
-							Optional: true,
 							Computed: true,
 						},
 						"volume_id": &schema.Schema{
@@ -225,6 +225,48 @@ func resourceComputeInstanceV2() *schema.Resource {
 				},
 				Set: resourceComputeVolumeAttachmentHash,
 			},
+			"scheduler_hints": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"group": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+						"different_host": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"same_host": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"query": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"target_cell": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+						"build_near_host_ip": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+					},
+				},
+				Set: resourceComputeSchedulerHintsHash,
+			},
 		},
 	}
 }
@@ -290,6 +332,16 @@ func resourceComputeInstanceV2Create(d *schema.ResourceData, meta interface{}) e
 		}
 	}
 
+	schedulerHintsRaw := d.Get("scheduler_hints").(*schema.Set).List()
+	if len(schedulerHintsRaw) > 0 {
+		log.Printf("[DEBUG] schedulerhints: %+v", schedulerHintsRaw)
+		schedulerHints := resourceInstanceSchedulerHintsV2(d, schedulerHintsRaw[0].(map[string]interface{}))
+		createOpts = &schedulerhints.CreateOptsExt{
+			createOpts,
+			schedulerHints,
+		}
+	}
+
 	log.Printf("[DEBUG] Create Options: %#v", createOpts)
 	server, err := servers.Create(computeClient, createOpts).Extract()
 	if err != nil {
@@ -765,13 +817,19 @@ func resourceInstanceSecGroupsV2(d *schema.ResourceData) []string {
 
 func resourceInstanceNetworks(computeClient *gophercloud.ServiceClient, d *schema.ResourceData) ([]map[string]interface{}, error) {
 	rawNetworks := d.Get("network").([]interface{})
-	newNetworks := make([]map[string]interface{}, len(rawNetworks))
+	newNetworks := make([]map[string]interface{}, 0, len(rawNetworks))
 	var tenantnet tenantnetworks.Network
 
 	tenantNetworkExt := true
-	for i, raw := range rawNetworks {
-		rawMap := raw.(map[string]interface{})
+	for _, raw := range rawNetworks {
+		// Not sure what causes this, but it is a possibility (see GH-2323).
+		// Since we call this function to reconcile what we'll save in the
+		// state anyways, we just ignore it.
+		if raw == nil {
+			continue
+		}
 
+		rawMap := raw.(map[string]interface{})
 		allPages, err := tenantnetworks.List(computeClient).AllPages()
 		if err != nil {
 			errCode, ok := err.(*gophercloud.UnexpectedResponseCodeError)
@@ -810,16 +868,15 @@ func resourceInstanceNetworks(computeClient *gophercloud.ServiceClient, d *schem
 			networkName = rawMap["name"].(string)
 		}
 
-		newNetworks[i] = map[string]interface{}{
+		newNetworks = append(newNetworks, map[string]interface{}{
 			"uuid":        networkID,
 			"name":        networkName,
 			"port":        rawMap["port"].(string),
 			"fixed_ip_v4": rawMap["fixed_ip_v4"].(string),
-		}
+		})
 	}
 
 	log.Printf("[DEBUG] networks: %+v", newNetworks)
-
 	return newNetworks, nil
 }
 
@@ -873,6 +930,40 @@ func resourceInstanceBlockDeviceV2(d *schema.ResourceData, bd map[string]interfa
 	return bfvOpts
 }
 
+func resourceInstanceSchedulerHintsV2(d *schema.ResourceData, schedulerHintsRaw map[string]interface{}) schedulerhints.SchedulerHints {
+	differentHost := []string{}
+	if len(schedulerHintsRaw["different_host"].([]interface{})) > 0 {
+		for _, dh := range schedulerHintsRaw["different_host"].([]interface{}) {
+			differentHost = append(differentHost, dh.(string))
+		}
+	}
+
+	sameHost := []string{}
+	if len(schedulerHintsRaw["same_host"].([]interface{})) > 0 {
+		for _, sh := range schedulerHintsRaw["same_host"].([]interface{}) {
+			sameHost = append(sameHost, sh.(string))
+		}
+	}
+
+	query := make([]interface{}, len(schedulerHintsRaw["query"].([]interface{})))
+	if len(schedulerHintsRaw["query"].([]interface{})) > 0 {
+		for _, q := range schedulerHintsRaw["query"].([]interface{}) {
+			query = append(query, q.(string))
+		}
+	}
+
+	schedulerHints := schedulerhints.SchedulerHints{
+		Group:           schedulerHintsRaw["group"].(string),
+		DifferentHost:   differentHost,
+		SameHost:        sameHost,
+		Query:           query,
+		TargetCell:      schedulerHintsRaw["target_cell"].(string),
+		BuildNearHostIP: schedulerHintsRaw["build_near_host_ip"].(string),
+	}
+
+	return schedulerHints
+}
+
 func getImageID(client *gophercloud.ServiceClient, d *schema.ResourceData) (string, error) {
 	imageId := d.Get("image_id").(string)
 
@@ -955,7 +1046,29 @@ func resourceComputeVolumeAttachmentHash(v interface{}) int {
 	var buf bytes.Buffer
 	m := v.(map[string]interface{})
 	buf.WriteString(fmt.Sprintf("%s-", m["volume_id"].(string)))
-	buf.WriteString(fmt.Sprintf("%s-", m["device"].(string)))
+	return hashcode.String(buf.String())
+}
+
+func resourceComputeSchedulerHintsHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+
+	if m["group"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["group"].(string)))
+	}
+
+	if m["target_cell"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["target_cell"].(string)))
+	}
+
+	if m["build_host_near_ip"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["build_host_near_ip"].(string)))
+	}
+
+	buf.WriteString(fmt.Sprintf("%s-", m["different_host"].([]interface{})))
+	buf.WriteString(fmt.Sprintf("%s-", m["same_host"].([]interface{})))
+	buf.WriteString(fmt.Sprintf("%s-", m["query"].([]interface{})))
+
 	return hashcode.String(buf.String())
 }
 
diff --git a/builtin/providers/openstack/resource_openstack_compute_instance_v2_test.go b/builtin/providers/openstack/resource_openstack_compute_instance_v2_test.go
index 540232da5..95b3b446f 100644
--- a/builtin/providers/openstack/resource_openstack_compute_instance_v2_test.go
+++ b/builtin/providers/openstack/resource_openstack_compute_instance_v2_test.go
@@ -46,7 +46,7 @@ func TestAccComputeV2Instance_basic(t *testing.T) {
 	})
 }
 
-func _TestAccComputeV2Instance_volumeAttach(t *testing.T) {
+func TestAccComputeV2Instance_volumeAttach(t *testing.T) {
 	var instance servers.Server
 	var volume volumes.Volume
 
@@ -229,6 +229,7 @@ var testAccComputeV2Instance_volumeAttach = fmt.Sprintf(`
   resource "openstack_compute_instance_v2" "foo" {
     region = "%s"
     name = "terraform-test"
+    security_groups = ["default"]
     volume {
       volume_id = "${openstack_blockstorage_volume_v1.myvol.id}"
     }
diff --git a/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go
new file mode 100644
index 000000000..59fef25f7
--- /dev/null
+++ b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go
@@ -0,0 +1,123 @@
+package openstack
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/servergroups"
+)
+
+func resourceComputeServerGroupV2() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceComputeServerGroupV2Create,
+		Read:   resourceComputeServerGroupV2Read,
+		Update: nil,
+		Delete: resourceComputeServerGroupV2Delete,
+
+		Schema: map[string]*schema.Schema{
+			"region": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				DefaultFunc: envDefaultFuncAllowMissing("OS_REGION_NAME"),
+			},
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"policies": &schema.Schema{
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"members": &schema.Schema{
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func resourceComputeServerGroupV2Create(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	createOpts := &servergroups.CreateOpts{
+		Name:     d.Get("name").(string),
+		Policies: resourceServerGroupPoliciesV2(d),
+	}
+	log.Printf("[DEBUG] Create Options: %#v", createOpts)
+	newSG, err := servergroups.Create(computeClient, createOpts).Extract()
+	if err != nil {
+		return fmt.Errorf("Error creating ServerGroup: %s", err)
+	}
+
+	d.SetId(newSG.ID)
+
+	return resourceComputeServerGroupV2Read(d, meta)
+}
+
+func resourceComputeServerGroupV2Read(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	sg, err := servergroups.Get(computeClient, d.Id()).Extract()
+	if err != nil {
+		return CheckDeleted(d, err, "server group")
+	}
+
+	log.Printf("[DEBUG] Retrieved ServerGroup %s: %+v", d.Id(), sg)
+
+	// Set the name
+	d.Set("name", sg.Name)
+
+	// Set the policies
+	policies := []string{}
+	for _, p := range sg.Policies {
+		policies = append(policies, p)
+	}
+	d.Set("policies", policies)
+
+	// Set the members
+	members := []string{}
+	for _, m := range sg.Members {
+		members = append(members, m)
+	}
+	d.Set("members", members)
+
+	return nil
+}
+
+func resourceComputeServerGroupV2Delete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	log.Printf("[DEBUG] Deleting ServerGroup %s", d.Id())
+	if err := servergroups.Delete(computeClient, d.Id()).ExtractErr(); err != nil {
+		return fmt.Errorf("Error deleting ServerGroup: %s", err)
+	}
+
+	return nil
+}
+
+func resourceServerGroupPoliciesV2(d *schema.ResourceData) []string {
+	rawPolicies := d.Get("policies").([]interface{})
+	policies := make([]string, len(rawPolicies))
+	for i, raw := range rawPolicies {
+		policies[i] = raw.(string)
+	}
+	return policies
+}
diff --git a/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go
new file mode 100644
index 000000000..3672820a4
--- /dev/null
+++ b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go
@@ -0,0 +1,138 @@
+package openstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/servergroups"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/servers"
+)
+
+func TestAccComputeV2ServerGroup_basic(t *testing.T) {
+	var serverGroup servergroups.ServerGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeV2ServerGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccComputeV2ServerGroup_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeV2ServerGroupExists(t, "openstack_compute_servergroup_v2.mysg", &serverGroup),
+				),
+			},
+		},
+	})
+}
+
+func TestAccComputeV2ServerGroup_affinity(t *testing.T) {
+	var instance servers.Server
+	var sg servergroups.ServerGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeV2ServerGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccComputeV2ServerGroup_affinity,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeV2ServerGroupExists(t, "openstack_compute_servergroup_v2.mysg", &sg),
+					testAccCheckComputeV2InstanceExists(t, "openstack_compute_instance_v2.myinstance", &instance),
+					testAccCheckComputeV2InstanceInServerGroup(&instance, &sg),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckComputeV2ServerGroupDestroy(s *terraform.State) error {
+	config := testAccProvider.Meta().(*Config)
+	computeClient, err := config.computeV2Client(OS_REGION_NAME)
+	if err != nil {
+		return fmt.Errorf("(testAccCheckComputeV2ServerGroupDestroy) Error creating OpenStack compute client: %s", err)
+	}
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "openstack_compute_servergroup_v2" {
+			continue
+		}
+
+		_, err := servergroups.Get(computeClient, rs.Primary.ID).Extract()
+		if err == nil {
+			return fmt.Errorf("ServerGroup still exists")
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckComputeV2ServerGroupExists(t *testing.T, n string, kp *servergroups.ServerGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		config := testAccProvider.Meta().(*Config)
+		computeClient, err := config.computeV2Client(OS_REGION_NAME)
+		if err != nil {
+			return fmt.Errorf("(testAccCheckComputeV2ServerGroupExists) Error creating OpenStack compute client: %s", err)
+		}
+
+		found, err := servergroups.Get(computeClient, rs.Primary.ID).Extract()
+		if err != nil {
+			return err
+		}
+
+		if found.ID != rs.Primary.ID {
+			return fmt.Errorf("ServerGroup not found")
+		}
+
+		*kp = *found
+
+		return nil
+	}
+}
+
+func testAccCheckComputeV2InstanceInServerGroup(instance *servers.Server, sg *servergroups.ServerGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if len(sg.Members) > 0 {
+			for _, m := range sg.Members {
+				if m == instance.ID {
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Instance %s is not part of Server Group %s", instance.ID, sg.ID)
+	}
+}
+
+var testAccComputeV2ServerGroup_basic = `
+  resource "openstack_compute_servergroup_v2" "mysg" {
+		name = "mysg"
+		policies = ["affinity"]
+  }`
+
+var testAccComputeV2ServerGroup_affinity = `
+	resource "openstack_compute_servergroup_v2" "mysg" {
+		name = "mysg"
+		policies = ["affinity"]
+	}
+
+	resource "openstack_compute_instance_v2" "myinstance" {
+		name = "myinstance"
+		security_groups = ["default"]
+		scheduler_hints {
+			group = "${openstack_compute_servergroup_v2.mysg.id}"
+		}
+	}`
diff --git a/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go b/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
index 34112f778..43318db19 100644
--- a/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
+++ b/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/networking/v2/extensions/fwaas/firewalls"
 )
 
-func TestAccFWFirewallV1(t *testing.T) {
+func TestAccFWFirewallV1_basic(t *testing.T) {
 
 	var policyID *string
 
diff --git a/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go b/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
index ba96bb8b1..677e7cd01 100644
--- a/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
+++ b/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/networking/v2/extensions/fwaas/rules"
 )
 
-func TestAccFWRuleV1(t *testing.T) {
+func TestAccFWRuleV1_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/openstack/resource_openstack_networking_router_v2.go b/builtin/providers/openstack/resource_openstack_networking_router_v2.go
index e30f220a6..9a370d7f3 100644
--- a/builtin/providers/openstack/resource_openstack_networking_router_v2.go
+++ b/builtin/providers/openstack/resource_openstack_networking_router_v2.go
@@ -3,7 +3,6 @@ package openstack
 import (
 	"fmt"
 	"log"
-	"strconv"
 
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/rackspace/gophercloud"
@@ -30,7 +29,7 @@ func resourceNetworkingRouterV2() *schema.Resource {
 				ForceNew: false,
 			},
 			"admin_state_up": &schema.Schema{
-				Type:     schema.TypeString,
+				Type:     schema.TypeBool,
 				Optional: true,
 				ForceNew: false,
 			},
@@ -61,12 +60,8 @@ func resourceNetworkingRouterV2Create(d *schema.ResourceData, meta interface{})
 		TenantID: d.Get("tenant_id").(string),
 	}
 
-	asuRaw := d.Get("admin_state_up").(string)
-	if asuRaw != "" {
-		asu, err := strconv.ParseBool(asuRaw)
-		if err != nil {
-			return fmt.Errorf("admin_state_up, if provided, must be either 'true' or 'false'")
-		}
+	if asuRaw, ok := d.GetOk("admin_state_up"); ok {
+		asu := asuRaw.(bool)
 		createOpts.AdminStateUp = &asu
 	}
 
@@ -114,7 +109,7 @@ func resourceNetworkingRouterV2Read(d *schema.ResourceData, meta interface{}) er
 	log.Printf("[DEBUG] Retreived Router %s: %+v", d.Id(), n)
 
 	d.Set("name", n.Name)
-	d.Set("admin_state_up", strconv.FormatBool(n.AdminStateUp))
+	d.Set("admin_state_up", n.AdminStateUp)
 	d.Set("tenant_id", n.TenantID)
 	d.Set("external_gateway", n.GatewayInfo.NetworkID)
 
@@ -133,14 +128,8 @@ func resourceNetworkingRouterV2Update(d *schema.ResourceData, meta interface{})
 		updateOpts.Name = d.Get("name").(string)
 	}
 	if d.HasChange("admin_state_up") {
-		asuRaw := d.Get("admin_state_up").(string)
-		if asuRaw != "" {
-			asu, err := strconv.ParseBool(asuRaw)
-			if err != nil {
-				return fmt.Errorf("admin_state_up, if provided, must be either 'true' or 'false'")
-			}
-			updateOpts.AdminStateUp = &asu
-		}
+		asu := d.Get("admin_state_up").(bool)
+		updateOpts.AdminStateUp = &asu
 	}
 
 	log.Printf("[DEBUG] Updating Router %s with options: %+v", d.Id(), updateOpts)
diff --git a/builtin/providers/template/resource.go b/builtin/providers/template/resource.go
index d1a8176be..9019dcfc9 100644
--- a/builtin/providers/template/resource.go
+++ b/builtin/providers/template/resource.go
@@ -5,6 +5,9 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io/ioutil"
+	"log"
+	"os"
+	"path/filepath"
 
 	"github.com/hashicorp/terraform/config"
 	"github.com/hashicorp/terraform/config/lang"
@@ -26,6 +29,18 @@ func resource() *schema.Resource {
 				Required:    true,
 				Description: "file to read template from",
 				ForceNew:    true,
+				// Make a "best effort" attempt to relativize the file path.
+				StateFunc: func(v interface{}) string {
+					pwd, err := os.Getwd()
+					if err != nil {
+						return v.(string)
+					}
+					rel, err := filepath.Rel(pwd, v.(string))
+					if err != nil {
+						return v.(string)
+					}
+					return rel
+				},
 			},
 			"vars": &schema.Schema{
 				Type:        schema.TypeMap,
@@ -61,7 +76,13 @@ func Delete(d *schema.ResourceData, meta interface{}) error {
 func Exists(d *schema.ResourceData, meta interface{}) (bool, error) {
 	rendered, err := render(d)
 	if err != nil {
-		return false, err
+		if _, ok := err.(templateRenderError); ok {
+			log.Printf("[DEBUG] Got error while rendering in Exists: %s", err)
+			log.Printf("[DEBUG] Returning false so the template re-renders using latest variables from config.")
+			return false, nil
+		} else {
+			return false, err
+		}
 	}
 	return hash(rendered) == d.Id(), nil
 }
@@ -73,6 +94,8 @@ func Read(d *schema.ResourceData, meta interface{}) error {
 	return nil
 }
 
+type templateRenderError error
+
 var readfile func(string) ([]byte, error) = ioutil.ReadFile // testing hook
 
 func render(d *schema.ResourceData) (string, error) {
@@ -91,7 +114,9 @@ func render(d *schema.ResourceData) (string, error) {
 
 	rendered, err := execute(string(buf), vars)
 	if err != nil {
-		return "", fmt.Errorf("failed to render %v: %v", filename, err)
+		return "", templateRenderError(
+			fmt.Errorf("failed to render %v: %v", filename, err),
+		)
 	}
 
 	return rendered, nil
diff --git a/builtin/providers/template/resource_test.go b/builtin/providers/template/resource_test.go
index 13b6cf052..7f461325a 100644
--- a/builtin/providers/template/resource_test.go
+++ b/builtin/providers/template/resource_test.go
@@ -34,15 +34,7 @@ func TestTemplateRendering(t *testing.T) {
 			Providers: testProviders,
 			Steps: []r.TestStep{
 				r.TestStep{
-					Config: `
-resource "template_file" "t0" {
-	filename = "mock"
-	vars = ` + tt.vars + `
-}
-output "rendered" {
-    value = "${template_file.t0.rendered}"
-}
-`,
+					Config: testTemplateConfig(tt.vars),
 					Check: func(s *terraform.State) error {
 						got := s.RootModule().Outputs["rendered"]
 						if tt.want != got {
@@ -55,3 +47,55 @@ output "rendered" {
 		})
 	}
 }
+
+// https://github.com/hashicorp/terraform/issues/2344
+func TestTemplateVariableChange(t *testing.T) {
+	steps := []struct {
+		vars     string
+		template string
+		want     string
+	}{
+		{`{a="foo"}`, `${a}`, `foo`},
+		{`{b="bar"}`, `${b}`, `bar`},
+	}
+
+	var testSteps []r.TestStep
+	for i, step := range steps {
+		testSteps = append(testSteps, r.TestStep{
+			PreConfig: func(template string) func() {
+				return func() {
+					readfile = func(string) ([]byte, error) {
+						return []byte(template), nil
+					}
+				}
+			}(step.template),
+			Config: testTemplateConfig(step.vars),
+			Check: func(i int, want string) r.TestCheckFunc {
+				return func(s *terraform.State) error {
+					got := s.RootModule().Outputs["rendered"]
+					if want != got {
+						return fmt.Errorf("[%d] got:\n%q\nwant:\n%q\n", i, got, want)
+					}
+					return nil
+				}
+			}(i, step.want),
+		})
+	}
+
+	r.Test(t, r.TestCase{
+		Providers: testProviders,
+		Steps:     testSteps,
+	})
+}
+
+func testTemplateConfig(vars string) string {
+	return `
+resource "template_file" "t0" {
+	filename = "mock"
+	vars = ` + vars + `
+}
+output "rendered" {
+    value = "${template_file.t0.rendered}"
+}
+	`
+}
diff --git a/builtin/provisioners/chef/linux_provisioner.go b/builtin/provisioners/chef/linux_provisioner.go
new file mode 100644
index 000000000..2a1e92eab
--- /dev/null
+++ b/builtin/provisioners/chef/linux_provisioner.go
@@ -0,0 +1,90 @@
+package chef
+
+import (
+	"fmt"
+	"path"
+	"strings"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+const (
+	installURL = "https://www.chef.io/chef/install.sh"
+)
+
+func (p *Provisioner) linuxInstallChefClient(
+	o terraform.UIOutput,
+	comm communicator.Communicator) error {
+
+	// Build up the command prefix
+	prefix := ""
+	if p.HTTPProxy != "" {
+		prefix += fmt.Sprintf("http_proxy='%s' ", p.HTTPProxy)
+	}
+	if p.HTTPSProxy != "" {
+		prefix += fmt.Sprintf("https_proxy='%s' ", p.HTTPSProxy)
+	}
+	if p.NOProxy != nil {
+		prefix += fmt.Sprintf("no_proxy='%s' ", strings.Join(p.NOProxy, ","))
+	}
+
+	// First download the install.sh script from Chef
+	err := p.runCommand(o, comm, fmt.Sprintf("%scurl -LO %s", prefix, installURL))
+	if err != nil {
+		return err
+	}
+
+	// Then execute the install.sh scrip to download and install Chef Client
+	err = p.runCommand(o, comm, fmt.Sprintf("%sbash ./install.sh -v %q", prefix, p.Version))
+	if err != nil {
+		return err
+	}
+
+	// And finally cleanup the install.sh script again
+	return p.runCommand(o, comm, fmt.Sprintf("%srm -f install.sh", prefix))
+}
+
+func (p *Provisioner) linuxCreateConfigFiles(
+	o terraform.UIOutput,
+	comm communicator.Communicator) error {
+	// Make sure the config directory exists
+	if err := p.runCommand(o, comm, "mkdir -p "+linuxConfDir); err != nil {
+		return err
+	}
+
+	// Make sure we have enough rights to upload the files if using sudo
+	if p.useSudo {
+		if err := p.runCommand(o, comm, "chmod 777 "+linuxConfDir); err != nil {
+			return err
+		}
+	}
+
+	if err := p.deployConfigFiles(o, comm, linuxConfDir); err != nil {
+		return err
+	}
+
+	if len(p.OhaiHints) > 0 {
+		// Make sure the hits directory exists
+		hintsDir := path.Join(linuxConfDir, "ohai/hints")
+		if err := p.runCommand(o, comm, "mkdir -p "+hintsDir); err != nil {
+			return err
+		}
+
+		if err := p.deployOhaiHints(o, comm, hintsDir); err != nil {
+			return err
+		}
+	}
+
+	// When done copying the files restore the rights and make sure root is owner
+	if p.useSudo {
+		if err := p.runCommand(o, comm, "chmod 755 "+linuxConfDir); err != nil {
+			return err
+		}
+		if err := p.runCommand(o, comm, "chown -R root.root "+linuxConfDir); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/provisioners/chef/linux_provisioner_test.go b/builtin/provisioners/chef/linux_provisioner_test.go
new file mode 100644
index 000000000..2d509f3cb
--- /dev/null
+++ b/builtin/provisioners/chef/linux_provisioner_test.go
@@ -0,0 +1,321 @@
+package chef
+
+import (
+	"path"
+	"testing"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestResourceProvider_linuxInstallChefClient(t *testing.T) {
+	cases := map[string]struct {
+		Config   *terraform.ResourceConfig
+		Commands map[string]bool
+	}{
+		"Sudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"sudo curl -LO https://www.chef.io/chef/install.sh": true,
+				"sudo bash ./install.sh -v \"\"":                    true,
+				"sudo rm -f install.sh":                             true,
+			},
+		},
+
+		"NoSudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+				"secret_key_path":        "encrypted_data_bag_secret",
+			}),
+
+			Commands: map[string]bool{
+				"curl -LO https://www.chef.io/chef/install.sh": true,
+				"bash ./install.sh -v \"\"":                    true,
+				"rm -f install.sh":                             true,
+			},
+		},
+
+		"HTTPProxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"http_proxy":             "http://proxy.local",
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"http_proxy='http://proxy.local' curl -LO https://www.chef.io/chef/install.sh": true,
+				"http_proxy='http://proxy.local' bash ./install.sh -v \"\"":                    true,
+				"http_proxy='http://proxy.local' rm -f install.sh":                             true,
+			},
+		},
+
+		"HTTPSProxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"https_proxy":            "https://proxy.local",
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"https_proxy='https://proxy.local' curl -LO https://www.chef.io/chef/install.sh": true,
+				"https_proxy='https://proxy.local' bash ./install.sh -v \"\"":                    true,
+				"https_proxy='https://proxy.local' rm -f install.sh":                             true,
+			},
+		},
+
+		"NoProxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"http_proxy":             "http://proxy.local",
+				"no_proxy":               []interface{}{"http://local.local", "http://local.org"},
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"http_proxy='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
+					"curl -LO https://www.chef.io/chef/install.sh": true,
+				"http_proxy='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
+					"bash ./install.sh -v \"\"": true,
+				"http_proxy='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
+					"rm -f install.sh": true,
+			},
+		},
+
+		"Version": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+				"version":                "11.18.6",
+			}),
+
+			Commands: map[string]bool{
+				"curl -LO https://www.chef.io/chef/install.sh": true,
+				"bash ./install.sh -v \"11.18.6\"":             true,
+				"rm -f install.sh":                             true,
+			},
+		},
+	}
+
+	r := new(ResourceProvisioner)
+	o := new(terraform.MockUIOutput)
+	c := new(communicator.MockCommunicator)
+
+	for k, tc := range cases {
+		c.Commands = tc.Commands
+
+		p, err := r.decodeConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("Error: %v", err)
+		}
+
+		p.useSudo = !p.PreventSudo
+
+		err = p.linuxInstallChefClient(o, c)
+		if err != nil {
+			t.Fatalf("Test %q failed: %v", k, err)
+		}
+	}
+}
+
+func TestResourceProvider_linuxCreateConfigFiles(t *testing.T) {
+	cases := map[string]struct {
+		Config   *terraform.ResourceConfig
+		Commands map[string]bool
+		Uploads  map[string]string
+	}{
+		"Sudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"ohai_hints":             []interface{}{"test-fixtures/ohaihint.json"},
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"sudo mkdir -p " + linuxConfDir:                          true,
+				"sudo chmod 777 " + linuxConfDir:                         true,
+				"sudo mkdir -p " + path.Join(linuxConfDir, "ohai/hints"): true,
+				"sudo chmod 755 " + linuxConfDir:                         true,
+				"sudo chown -R root.root " + linuxConfDir:                true,
+			},
+
+			Uploads: map[string]string{
+				linuxConfDir + "/client.rb":                 defaultLinuxClientConf,
+				linuxConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				linuxConfDir + "/first-boot.json":           `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/ohai/hints/ohaihint.json":  "OHAI-HINT-FILE",
+				linuxConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+			},
+		},
+
+		"NoSudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"mkdir -p " + linuxConfDir: true,
+			},
+
+			Uploads: map[string]string{
+				linuxConfDir + "/client.rb":                 defaultLinuxClientConf,
+				linuxConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				linuxConfDir + "/first-boot.json":           `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+			},
+		},
+
+		"Proxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"http_proxy":             "http://proxy.local",
+				"https_proxy":            "https://proxy.local",
+				"no_proxy":               []interface{}{"http://local.local", "https://local.local"},
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"mkdir -p " + linuxConfDir: true,
+			},
+
+			Uploads: map[string]string{
+				linuxConfDir + "/client.rb":                 proxyLinuxClientConf,
+				linuxConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				linuxConfDir + "/first-boot.json":           `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+			},
+		},
+
+		"Attributes": {
+			Config: testConfig(t, map[string]interface{}{
+				"attributes": []map[string]interface{}{
+					map[string]interface{}{
+						"key1": []map[string]interface{}{
+							map[string]interface{}{
+								"subkey1": []map[string]interface{}{
+									map[string]interface{}{
+										"subkey2a": []interface{}{
+											"val1", "val2", "val3",
+										},
+										"subkey2b": []map[string]interface{}{
+											map[string]interface{}{
+												"subkey3": "value3",
+											},
+										},
+									},
+								},
+							},
+						},
+						"key2": "value2",
+					},
+				},
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"mkdir -p " + linuxConfDir: true,
+			},
+
+			Uploads: map[string]string{
+				linuxConfDir + "/client.rb":                 defaultLinuxClientConf,
+				linuxConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				linuxConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+				linuxConfDir + "/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
+					`"subkey2b":{"subkey3":"value3"}}},"key2":"value2","run_list":["cookbook::recipe"]}`,
+			},
+		},
+	}
+
+	r := new(ResourceProvisioner)
+	o := new(terraform.MockUIOutput)
+	c := new(communicator.MockCommunicator)
+
+	for k, tc := range cases {
+		c.Commands = tc.Commands
+		c.Uploads = tc.Uploads
+
+		p, err := r.decodeConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("Error: %v", err)
+		}
+
+		p.useSudo = !p.PreventSudo
+
+		err = p.linuxCreateConfigFiles(o, c)
+		if err != nil {
+			t.Fatalf("Test %q failed: %v", k, err)
+		}
+	}
+}
+
+const defaultLinuxClientConf = `log_location            STDOUT
+chef_server_url         "https://chef.local"
+validation_client_name  "validator"
+node_name               "nodename1"`
+
+const proxyLinuxClientConf = `log_location            STDOUT
+chef_server_url         "https://chef.local"
+validation_client_name  "validator"
+node_name               "nodename1"
+
+
+http_proxy          "http://proxy.local"
+ENV['http_proxy'] = "http://proxy.local"
+ENV['HTTP_PROXY'] = "http://proxy.local"
+
+
+
+https_proxy          "https://proxy.local"
+ENV['https_proxy'] = "https://proxy.local"
+ENV['HTTPS_PROXY'] = "https://proxy.local"
+
+
+no_proxy "http://local.local,https://local.local"`
diff --git a/builtin/provisioners/chef/resource_provisioner.go b/builtin/provisioners/chef/resource_provisioner.go
new file mode 100644
index 000000000..8ff5a255b
--- /dev/null
+++ b/builtin/provisioners/chef/resource_provisioner.go
@@ -0,0 +1,501 @@
+package chef
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path"
+	"regexp"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/communicator/remote"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/mitchellh/go-homedir"
+	"github.com/mitchellh/go-linereader"
+	"github.com/mitchellh/mapstructure"
+)
+
+const (
+	clienrb        = "client.rb"
+	defaultEnv     = "_default"
+	firstBoot      = "first-boot.json"
+	logfileDir     = "logfiles"
+	linuxChefCmd   = "chef-client"
+	linuxConfDir   = "/etc/chef"
+	secretKey      = "encrypted_data_bag_secret"
+	validationKey  = "validation.pem"
+	windowsChefCmd = "cmd /c chef-client"
+	windowsConfDir = "C:/chef"
+)
+
+const clientConf = `
+log_location            STDOUT
+chef_server_url         "{{ .ServerURL }}"
+validation_client_name  "{{ .ValidationClientName }}"
+node_name               "{{ .NodeName }}"
+
+{{ if .HTTPProxy }}
+http_proxy          "{{ .HTTPProxy }}"
+ENV['http_proxy'] = "{{ .HTTPProxy }}"
+ENV['HTTP_PROXY'] = "{{ .HTTPProxy }}"
+{{ end }}
+
+{{ if .HTTPSProxy }}
+https_proxy          "{{ .HTTPSProxy }}"
+ENV['https_proxy'] = "{{ .HTTPSProxy }}"
+ENV['HTTPS_PROXY'] = "{{ .HTTPSProxy }}"
+{{ end }}
+
+{{ if .NOProxy }}no_proxy "{{ join .NOProxy "," }}"{{ end }}
+{{ if .SSLVerifyMode }}ssl_verify_mode {{ .SSLVerifyMode }}{{ end }}
+`
+
+// Provisioner represents a specificly configured chef provisioner
+type Provisioner struct {
+	Attributes           interface{} `mapstructure:"attributes"`
+	Environment          string      `mapstructure:"environment"`
+	LogToFile            bool        `mapstructure:"log_to_file"`
+	HTTPProxy            string      `mapstructure:"http_proxy"`
+	HTTPSProxy           string      `mapstructure:"https_proxy"`
+	NOProxy              []string    `mapstructure:"no_proxy"`
+	NodeName             string      `mapstructure:"node_name"`
+	OhaiHints            []string    `mapstructure:"ohai_hints"`
+	OSType               string      `mapstructure:"os_type"`
+	PreventSudo          bool        `mapstructure:"prevent_sudo"`
+	RunList              []string    `mapstructure:"run_list"`
+	SecretKeyPath        string      `mapstructure:"secret_key_path"`
+	ServerURL            string      `mapstructure:"server_url"`
+	SkipInstall          bool        `mapstructure:"skip_install"`
+	SSLVerifyMode        string      `mapstructure:"ssl_verify_mode"`
+	ValidationClientName string      `mapstructure:"validation_client_name"`
+	ValidationKeyPath    string      `mapstructure:"validation_key_path"`
+	Version              string      `mapstructure:"version"`
+
+	installChefClient func(terraform.UIOutput, communicator.Communicator) error
+	createConfigFiles func(terraform.UIOutput, communicator.Communicator) error
+	runChefClient     func(terraform.UIOutput, communicator.Communicator) error
+	useSudo           bool
+}
+
+// ResourceProvisioner represents a generic chef provisioner
+type ResourceProvisioner struct{}
+
+// Apply executes the file provisioner
+func (r *ResourceProvisioner) Apply(
+	o terraform.UIOutput,
+	s *terraform.InstanceState,
+	c *terraform.ResourceConfig) error {
+	// Decode the raw config for this provisioner
+	p, err := r.decodeConfig(c)
+	if err != nil {
+		return err
+	}
+
+	if p.OSType == "" {
+		switch s.Ephemeral.ConnInfo["type"] {
+		case "ssh", "": // The default connection type is ssh, so if the type is empty assume ssh
+			p.OSType = "linux"
+		case "winrm":
+			p.OSType = "windows"
+		default:
+			return fmt.Errorf("Unsupported connection type: %s", s.Ephemeral.ConnInfo["type"])
+		}
+	}
+
+	// Set some values based on the targeted OS
+	switch p.OSType {
+	case "linux":
+		p.installChefClient = p.linuxInstallChefClient
+		p.createConfigFiles = p.linuxCreateConfigFiles
+		p.runChefClient = p.runChefClientFunc(linuxChefCmd, linuxConfDir)
+		p.useSudo = !p.PreventSudo && s.Ephemeral.ConnInfo["user"] != "root"
+	case "windows":
+		p.installChefClient = p.windowsInstallChefClient
+		p.createConfigFiles = p.windowsCreateConfigFiles
+		p.runChefClient = p.runChefClientFunc(windowsChefCmd, windowsConfDir)
+		p.useSudo = false
+	default:
+		return fmt.Errorf("Unsupported os type: %s", p.OSType)
+	}
+
+	// Get a new communicator
+	comm, err := communicator.New(s)
+	if err != nil {
+		return err
+	}
+
+	// Wait and retry until we establish the connection
+	err = retryFunc(comm.Timeout(), func() error {
+		err := comm.Connect(o)
+		return err
+	})
+	if err != nil {
+		return err
+	}
+	defer comm.Disconnect()
+
+	if !p.SkipInstall {
+		if err := p.installChefClient(o, comm); err != nil {
+			return err
+		}
+	}
+
+	o.Output("Creating configuration files...")
+	if err := p.createConfigFiles(o, comm); err != nil {
+		return err
+	}
+
+	o.Output("Starting initial Chef-Client run...")
+	if err := p.runChefClient(o, comm); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Validate checks if the required arguments are configured
+func (r *ResourceProvisioner) Validate(c *terraform.ResourceConfig) (ws []string, es []error) {
+	p, err := r.decodeConfig(c)
+	if err != nil {
+		es = append(es, err)
+		return ws, es
+	}
+
+	if p.NodeName == "" {
+		es = append(es, fmt.Errorf("Key not found: node_name"))
+	}
+	if p.RunList == nil {
+		es = append(es, fmt.Errorf("Key not found: run_list"))
+	}
+	if p.ServerURL == "" {
+		es = append(es, fmt.Errorf("Key not found: server_url"))
+	}
+	if p.ValidationClientName == "" {
+		es = append(es, fmt.Errorf("Key not found: validation_client_name"))
+	}
+	if p.ValidationKeyPath == "" {
+		es = append(es, fmt.Errorf("Key not found: validation_key_path"))
+	}
+
+	return ws, es
+}
+
+func (r *ResourceProvisioner) decodeConfig(c *terraform.ResourceConfig) (*Provisioner, error) {
+	p := new(Provisioner)
+
+	decConf := &mapstructure.DecoderConfig{
+		ErrorUnused:      true,
+		WeaklyTypedInput: true,
+		Result:           p,
+	}
+	dec, err := mapstructure.NewDecoder(decConf)
+	if err != nil {
+		return nil, err
+	}
+
+	// We need to decode this twice. Once for the Raw config and once
+	// for the parsed Config. This makes sure that all values are there
+	// even if some still need to be interpolated later on.
+	// Without this the validation will fail when using a variable for
+	// a required parameter (the node_name for example).
+	if err := dec.Decode(c.Raw); err != nil {
+		return nil, err
+	}
+
+	if err := dec.Decode(c.Config); err != nil {
+		return nil, err
+	}
+
+	if p.Environment == "" {
+		p.Environment = defaultEnv
+	}
+
+	for i, hint := range p.OhaiHints {
+		hintPath, err := homedir.Expand(hint)
+		if err != nil {
+			return nil, fmt.Errorf("Error expanding the path %s: %v", hint, err)
+		}
+		p.OhaiHints[i] = hintPath
+	}
+
+	if p.ValidationKeyPath != "" {
+		keyPath, err := homedir.Expand(p.ValidationKeyPath)
+		if err != nil {
+			return nil, fmt.Errorf("Error expanding the validation key path: %v", err)
+		}
+		p.ValidationKeyPath = keyPath
+	}
+
+	if p.SecretKeyPath != "" {
+		keyPath, err := homedir.Expand(p.SecretKeyPath)
+		if err != nil {
+			return nil, fmt.Errorf("Error expanding the secret key path: %v", err)
+		}
+		p.SecretKeyPath = keyPath
+	}
+
+	if attrs, ok := c.Config["attributes"]; ok {
+		p.Attributes, err = rawToJSON(attrs)
+		if err != nil {
+			return nil, fmt.Errorf("Error parsing the attributes: %v", err)
+		}
+	}
+
+	return p, nil
+}
+
+func rawToJSON(raw interface{}) (interface{}, error) {
+	switch s := raw.(type) {
+	case []map[string]interface{}:
+		if len(s) != 1 {
+			return nil, errors.New("unexpected input while parsing raw config to JSON")
+		}
+
+		var err error
+		for k, v := range s[0] {
+			s[0][k], err = rawToJSON(v)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		return s[0], nil
+	default:
+		return raw, nil
+	}
+}
+
+// retryFunc is used to retry a function for a given duration
+func retryFunc(timeout time.Duration, f func() error) error {
+	finish := time.After(timeout)
+	for {
+		err := f()
+		if err == nil {
+			return nil
+		}
+		log.Printf("Retryable error: %v", err)
+
+		select {
+		case <-finish:
+			return err
+		case <-time.After(3 * time.Second):
+		}
+	}
+}
+
+func (p *Provisioner) runChefClientFunc(
+	chefCmd string,
+	confDir string) func(terraform.UIOutput, communicator.Communicator) error {
+	return func(o terraform.UIOutput, comm communicator.Communicator) error {
+		fb := path.Join(confDir, firstBoot)
+		cmd := fmt.Sprintf("%s -j %q -E %q", chefCmd, fb, p.Environment)
+
+		if p.LogToFile {
+			if err := os.MkdirAll(logfileDir, 0755); err != nil {
+				return fmt.Errorf("Error creating logfile directory %s: %v", logfileDir, err)
+			}
+
+			logFile := path.Join(logfileDir, p.NodeName)
+			f, err := os.Create(path.Join(logFile))
+			if err != nil {
+				return fmt.Errorf("Error creating logfile %s: %v", logFile, err)
+			}
+			f.Close()
+
+			o.Output("Writing Chef Client output to " + logFile)
+			o = p
+		}
+
+		return p.runCommand(o, comm, cmd)
+	}
+}
+
+// Output implementation of terraform.UIOutput interface
+func (p *Provisioner) Output(output string) {
+	logFile := path.Join(logfileDir, p.NodeName)
+	f, err := os.OpenFile(logFile, os.O_APPEND|os.O_WRONLY, 0666)
+	if err != nil {
+		log.Printf("Error creating logfile %s: %v", logFile, err)
+		return
+	}
+	defer f.Close()
+
+	// These steps are needed to remove any ANSI escape codes used to colorize
+	// the output and to make sure we have proper line endings before writing
+	// the string to the logfile.
+	re := regexp.MustCompile(`\x1b\[[0-9;]+m`)
+	output = re.ReplaceAllString(output, "")
+	output = strings.Replace(output, "\r", "\n", -1)
+
+	if _, err := f.WriteString(output); err != nil {
+		log.Printf("Error writing output to logfile %s: %v", logFile, err)
+	}
+
+	if err := f.Sync(); err != nil {
+		log.Printf("Error saving logfile %s to disk: %v", logFile, err)
+	}
+}
+
+func (p *Provisioner) deployConfigFiles(
+	o terraform.UIOutput,
+	comm communicator.Communicator,
+	confDir string) error {
+	// Open the validation key file
+	f, err := os.Open(p.ValidationKeyPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// Copy the validation key to the new instance
+	if err := comm.Upload(path.Join(confDir, validationKey), f); err != nil {
+		return fmt.Errorf("Uploading %s failed: %v", validationKey, err)
+	}
+
+	if p.SecretKeyPath != "" {
+		// Open the secret key file
+		s, err := os.Open(p.SecretKeyPath)
+		if err != nil {
+			return err
+		}
+		defer s.Close()
+
+		// Copy the secret key to the new instance
+		if err := comm.Upload(path.Join(confDir, secretKey), s); err != nil {
+			return fmt.Errorf("Uploading %s failed: %v", secretKey, err)
+		}
+	}
+
+	// Make strings.Join available for use within the template
+	funcMap := template.FuncMap{
+		"join": strings.Join,
+	}
+
+	// Create a new template and parse the client config into it
+	t := template.Must(template.New(clienrb).Funcs(funcMap).Parse(clientConf))
+
+	var buf bytes.Buffer
+	err = t.Execute(&buf, p)
+	if err != nil {
+		return fmt.Errorf("Error executing %s template: %s", clienrb, err)
+	}
+
+	// Copy the client config to the new instance
+	if err := comm.Upload(path.Join(confDir, clienrb), &buf); err != nil {
+		return fmt.Errorf("Uploading %s failed: %v", clienrb, err)
+	}
+
+	// Create a map with first boot settings
+	fb := make(map[string]interface{})
+	if p.Attributes != nil {
+		fb = p.Attributes.(map[string]interface{})
+	}
+
+	// Check if the run_list was also in the attributes and if so log a warning
+	// that it will be overwritten with the value of the run_list argument.
+	if _, found := fb["run_list"]; found {
+		log.Printf("[WARNING] Found a 'run_list' specified in the configured attributes! " +
+			"This value will be overwritten by the value of the `run_list` argument!")
+	}
+
+	// Add the initial runlist to the first boot settings
+	fb["run_list"] = p.RunList
+
+	// Marshal the first boot settings to JSON
+	d, err := json.Marshal(fb)
+	if err != nil {
+		return fmt.Errorf("Failed to create %s data: %s", firstBoot, err)
+	}
+
+	// Copy the first-boot.json to the new instance
+	if err := comm.Upload(path.Join(confDir, firstBoot), bytes.NewReader(d)); err != nil {
+		return fmt.Errorf("Uploading %s failed: %v", firstBoot, err)
+	}
+
+	return nil
+}
+
+func (p *Provisioner) deployOhaiHints(
+	o terraform.UIOutput,
+	comm communicator.Communicator,
+	hintDir string) error {
+	for _, hint := range p.OhaiHints {
+		// Open the hint file
+		f, err := os.Open(hint)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		// Copy the hint to the new instance
+		if err := comm.Upload(path.Join(hintDir, path.Base(hint)), f); err != nil {
+			return fmt.Errorf("Uploading %s failed: %v", path.Base(hint), err)
+		}
+	}
+
+	return nil
+}
+
+// runCommand is used to run already prepared commands
+func (p *Provisioner) runCommand(
+	o terraform.UIOutput,
+	comm communicator.Communicator,
+	command string) error {
+	var err error
+
+	// Unless prevented, prefix the command with sudo
+	if p.useSudo {
+		command = "sudo " + command
+	}
+
+	outR, outW := io.Pipe()
+	errR, errW := io.Pipe()
+	outDoneCh := make(chan struct{})
+	errDoneCh := make(chan struct{})
+	go p.copyOutput(o, outR, outDoneCh)
+	go p.copyOutput(o, errR, errDoneCh)
+
+	cmd := &remote.Cmd{
+		Command: command,
+		Stdout:  outW,
+		Stderr:  errW,
+	}
+
+	if err := comm.Start(cmd); err != nil {
+		return fmt.Errorf("Error executing command %q: %v", cmd.Command, err)
+	}
+
+	cmd.Wait()
+	if cmd.ExitStatus != 0 {
+		err = fmt.Errorf(
+			"Command %q exited with non-zero exit status: %d", cmd.Command, cmd.ExitStatus)
+	}
+
+	// Wait for output to clean up
+	outW.Close()
+	errW.Close()
+	<-outDoneCh
+	<-errDoneCh
+
+	// If we have an error, return it out now that we've cleaned up
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (p *Provisioner) copyOutput(o terraform.UIOutput, r io.Reader, doneCh chan<- struct{}) {
+	defer close(doneCh)
+	lr := linereader.New(r)
+	for line := range lr.Ch {
+		o.Output(line)
+	}
+}
diff --git a/builtin/provisioners/chef/resource_provisioner_test.go b/builtin/provisioners/chef/resource_provisioner_test.go
new file mode 100644
index 000000000..78c44c7ea
--- /dev/null
+++ b/builtin/provisioners/chef/resource_provisioner_test.go
@@ -0,0 +1,151 @@
+package chef
+
+import (
+	"fmt"
+	"path"
+	"testing"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/config"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestResourceProvisioner_impl(t *testing.T) {
+	var _ terraform.ResourceProvisioner = new(ResourceProvisioner)
+}
+
+func TestResourceProvider_Validate_good(t *testing.T) {
+	c := testConfig(t, map[string]interface{}{
+		"attributes":             []interface{}{"key1 { subkey1 = value1 }"},
+		"environment":            "_default",
+		"node_name":              "nodename1",
+		"run_list":               []interface{}{"cookbook::recipe"},
+		"server_url":             "https://chef.local",
+		"validation_client_name": "validator",
+		"validation_key_path":    "validator.pem",
+	})
+	r := new(ResourceProvisioner)
+	warn, errs := r.Validate(c)
+	if len(warn) > 0 {
+		t.Fatalf("Warnings: %v", warn)
+	}
+	if len(errs) > 0 {
+		t.Fatalf("Errors: %v", errs)
+	}
+}
+
+func TestResourceProvider_Validate_bad(t *testing.T) {
+	c := testConfig(t, map[string]interface{}{
+		"invalid": "nope",
+	})
+	p := new(ResourceProvisioner)
+	warn, errs := p.Validate(c)
+	if len(warn) > 0 {
+		t.Fatalf("Warnings: %v", warn)
+	}
+	if len(errs) == 0 {
+		t.Fatalf("Should have errors")
+	}
+}
+
+func testConfig(t *testing.T, c map[string]interface{}) *terraform.ResourceConfig {
+	r, err := config.NewRawConfig(c)
+	if err != nil {
+		t.Fatalf("bad: %s", err)
+	}
+
+	return terraform.NewResourceConfig(r)
+}
+
+func TestResourceProvider_runChefClient(t *testing.T) {
+	cases := map[string]struct {
+		Config   *terraform.ResourceConfig
+		ChefCmd  string
+		ConfDir  string
+		Commands map[string]bool
+	}{
+		"Sudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			ChefCmd: linuxChefCmd,
+
+			ConfDir: linuxConfDir,
+
+			Commands: map[string]bool{
+				fmt.Sprintf(`sudo %s -j %q -E "_default"`,
+					linuxChefCmd,
+					path.Join(linuxConfDir, "first-boot.json")): true,
+			},
+		},
+
+		"NoSudo": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			ChefCmd: linuxChefCmd,
+
+			ConfDir: linuxConfDir,
+
+			Commands: map[string]bool{
+				fmt.Sprintf(`%s -j %q -E "_default"`,
+					linuxChefCmd,
+					path.Join(linuxConfDir, "first-boot.json")): true,
+			},
+		},
+
+		"Environment": {
+			Config: testConfig(t, map[string]interface{}{
+				"environment":            "production",
+				"node_name":              "nodename1",
+				"prevent_sudo":           true,
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			ChefCmd: windowsChefCmd,
+
+			ConfDir: windowsConfDir,
+
+			Commands: map[string]bool{
+				fmt.Sprintf(`%s -j %q -E "production"`,
+					windowsChefCmd,
+					path.Join(windowsConfDir, "first-boot.json")): true,
+			},
+		},
+	}
+
+	r := new(ResourceProvisioner)
+	o := new(terraform.MockUIOutput)
+	c := new(communicator.MockCommunicator)
+
+	for k, tc := range cases {
+		c.Commands = tc.Commands
+
+		p, err := r.decodeConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("Error: %v", err)
+		}
+
+		p.runChefClient = p.runChefClientFunc(tc.ChefCmd, tc.ConfDir)
+		p.useSudo = !p.PreventSudo
+
+		err = p.runChefClient(o, c)
+		if err != nil {
+			t.Fatalf("Test %q failed: %v", k, err)
+		}
+	}
+}
diff --git a/builtin/provisioners/chef/test-fixtures/encrypted_data_bag_secret b/builtin/provisioners/chef/test-fixtures/encrypted_data_bag_secret
new file mode 100644
index 000000000..97249fae5
--- /dev/null
+++ b/builtin/provisioners/chef/test-fixtures/encrypted_data_bag_secret
@@ -0,0 +1 @@
+SECRET-KEY-FILE
diff --git a/builtin/provisioners/chef/test-fixtures/ohaihint.json b/builtin/provisioners/chef/test-fixtures/ohaihint.json
new file mode 100644
index 000000000..9aabc3287
--- /dev/null
+++ b/builtin/provisioners/chef/test-fixtures/ohaihint.json
@@ -0,0 +1 @@
+OHAI-HINT-FILE
diff --git a/builtin/provisioners/chef/test-fixtures/validator.pem b/builtin/provisioners/chef/test-fixtures/validator.pem
new file mode 100644
index 000000000..03e6d6de7
--- /dev/null
+++ b/builtin/provisioners/chef/test-fixtures/validator.pem
@@ -0,0 +1 @@
+VALIDATOR-PEM-FILE
diff --git a/builtin/provisioners/chef/windows_provisioner.go b/builtin/provisioners/chef/windows_provisioner.go
new file mode 100644
index 000000000..953734021
--- /dev/null
+++ b/builtin/provisioners/chef/windows_provisioner.go
@@ -0,0 +1,88 @@
+package chef
+
+import (
+	"fmt"
+	"path"
+	"strings"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+const installScript = `
+$winver = [System.Environment]::OSVersion.Version | %% {"{0}.{1}" -f $_.Major,$_.Minor}
+
+switch ($winver)
+{
+  "6.0" {$machine_os = "2008"}
+  "6.1" {$machine_os = "2008r2"}
+  "6.2" {$machine_os = "2012"}
+  "6.3" {$machine_os = "2012"}
+  default {$machine_os = "2008r2"}
+}
+
+if ([System.IntPtr]::Size -eq 4) {$machine_arch = "i686"} else {$machine_arch = "x86_64"}
+
+$url = "http://www.chef.io/chef/download?p=windows&pv=$machine_os&m=$machine_arch&v=%s"
+$dest = [System.IO.Path]::GetTempFileName()
+$dest = [System.IO.Path]::ChangeExtension($dest, ".msi")
+$downloader = New-Object System.Net.WebClient
+
+$http_proxy = '%s'
+if ($http_proxy -ne '') {
+	$no_proxy = '%s'
+  if ($no_proxy -eq ''){
+    $no_proxy = "127.0.0.1"
+  }
+
+  $proxy = New-Object System.Net.WebProxy($http_proxy, $true, ,$no_proxy.Split(','))
+  $downloader.proxy = $proxy
+}
+
+Write-Host 'Downloading Chef Client...'
+$downloader.DownloadFile($url, $dest)
+
+Write-Host 'Installing Chef Client...'
+Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
+`
+
+func (p *Provisioner) windowsInstallChefClient(
+	o terraform.UIOutput,
+	comm communicator.Communicator) error {
+	script := path.Join(path.Dir(comm.ScriptPath()), "ChefClient.ps1")
+	content := fmt.Sprintf(installScript, p.Version, p.HTTPProxy, strings.Join(p.NOProxy, ","))
+
+	// Copy the script to the new instance
+	if err := comm.UploadScript(script, strings.NewReader(content)); err != nil {
+		return fmt.Errorf("Uploading client.rb failed: %v", err)
+	}
+
+	// Execute the script to install Chef Client
+	installCmd := fmt.Sprintf("powershell -NoProfile -ExecutionPolicy Bypass -File %s", script)
+	return p.runCommand(o, comm, installCmd)
+}
+
+func (p *Provisioner) windowsCreateConfigFiles(
+	o terraform.UIOutput,
+	comm communicator.Communicator) error {
+	// Make sure the config directory exists
+	cmd := fmt.Sprintf("cmd /c if not exist %q mkdir %q", windowsConfDir, windowsConfDir)
+	if err := p.runCommand(o, comm, cmd); err != nil {
+		return err
+	}
+
+	if len(p.OhaiHints) > 0 {
+		// Make sure the hits directory exists
+		hintsDir := path.Join(windowsConfDir, "ohai/hints")
+		cmd := fmt.Sprintf("cmd /c if not exist %q mkdir %q", hintsDir, hintsDir)
+		if err := p.runCommand(o, comm, cmd); err != nil {
+			return err
+		}
+
+		if err := p.deployOhaiHints(o, comm, hintsDir); err != nil {
+			return err
+		}
+	}
+
+	return p.deployConfigFiles(o, comm, windowsConfDir)
+}
diff --git a/builtin/provisioners/chef/windows_provisioner_test.go b/builtin/provisioners/chef/windows_provisioner_test.go
new file mode 100644
index 000000000..a01599a30
--- /dev/null
+++ b/builtin/provisioners/chef/windows_provisioner_test.go
@@ -0,0 +1,356 @@
+package chef
+
+import (
+	"fmt"
+	"path"
+	"testing"
+
+	"github.com/hashicorp/terraform/communicator"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestResourceProvider_windowsInstallChefClient(t *testing.T) {
+	cases := map[string]struct {
+		Config        *terraform.ResourceConfig
+		Commands      map[string]bool
+		UploadScripts map[string]string
+	}{
+		"Default": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"powershell -NoProfile -ExecutionPolicy Bypass -File ChefClient.ps1": true,
+			},
+
+			UploadScripts: map[string]string{
+				"ChefClient.ps1": defaultWindowsInstallScript,
+			},
+		},
+
+		"Proxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"http_proxy":             "http://proxy.local",
+				"no_proxy":               []interface{}{"http://local.local", "http://local.org"},
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				"powershell -NoProfile -ExecutionPolicy Bypass -File ChefClient.ps1": true,
+			},
+
+			UploadScripts: map[string]string{
+				"ChefClient.ps1": proxyWindowsInstallScript,
+			},
+		},
+
+		"Version": {
+			Config: testConfig(t, map[string]interface{}{
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "validator.pem",
+				"version":                "11.18.6",
+			}),
+
+			Commands: map[string]bool{
+				"powershell -NoProfile -ExecutionPolicy Bypass -File ChefClient.ps1": true,
+			},
+
+			UploadScripts: map[string]string{
+				"ChefClient.ps1": versionWindowsInstallScript,
+			},
+		},
+	}
+
+	r := new(ResourceProvisioner)
+	o := new(terraform.MockUIOutput)
+	c := new(communicator.MockCommunicator)
+
+	for k, tc := range cases {
+		c.Commands = tc.Commands
+		c.UploadScripts = tc.UploadScripts
+
+		p, err := r.decodeConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("Error: %v", err)
+		}
+
+		p.useSudo = false
+
+		err = p.windowsInstallChefClient(o, c)
+		if err != nil {
+			t.Fatalf("Test %q failed: %v", k, err)
+		}
+	}
+}
+
+func TestResourceProvider_windowsCreateConfigFiles(t *testing.T) {
+	cases := map[string]struct {
+		Config   *terraform.ResourceConfig
+		Commands map[string]bool
+		Uploads  map[string]string
+	}{
+		"Default": {
+			Config: testConfig(t, map[string]interface{}{
+				"ohai_hints":             []interface{}{"test-fixtures/ohaihint.json"},
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				fmt.Sprintf("cmd /c if not exist %q mkdir %q", windowsConfDir, windowsConfDir): true,
+				fmt.Sprintf("cmd /c if not exist %q mkdir %q",
+					path.Join(windowsConfDir, "ohai/hints"),
+					path.Join(windowsConfDir, "ohai/hints")): true,
+			},
+
+			Uploads: map[string]string{
+				windowsConfDir + "/client.rb":                 defaultWindowsClientConf,
+				windowsConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				windowsConfDir + "/first-boot.json":           `{"run_list":["cookbook::recipe"]}`,
+				windowsConfDir + "/ohai/hints/ohaihint.json":  "OHAI-HINT-FILE",
+				windowsConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+			},
+		},
+
+		"Proxy": {
+			Config: testConfig(t, map[string]interface{}{
+				"http_proxy":             "http://proxy.local",
+				"https_proxy":            "https://proxy.local",
+				"no_proxy":               []interface{}{"http://local.local", "https://local.local"},
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				fmt.Sprintf("cmd /c if not exist %q mkdir %q", windowsConfDir, windowsConfDir): true,
+			},
+
+			Uploads: map[string]string{
+				windowsConfDir + "/client.rb":                 proxyWindowsClientConf,
+				windowsConfDir + "/first-boot.json":           `{"run_list":["cookbook::recipe"]}`,
+				windowsConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				windowsConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+			},
+		},
+
+		"Attributes": {
+			Config: testConfig(t, map[string]interface{}{
+				"attributes": []map[string]interface{}{
+					map[string]interface{}{
+						"key1": []map[string]interface{}{
+							map[string]interface{}{
+								"subkey1": []map[string]interface{}{
+									map[string]interface{}{
+										"subkey2a": []interface{}{
+											"val1", "val2", "val3",
+										},
+										"subkey2b": []map[string]interface{}{
+											map[string]interface{}{
+												"subkey3": "value3",
+											},
+										},
+									},
+								},
+							},
+						},
+						"key2": "value2",
+					},
+				},
+				"node_name":              "nodename1",
+				"run_list":               []interface{}{"cookbook::recipe"},
+				"secret_key_path":        "test-fixtures/encrypted_data_bag_secret",
+				"server_url":             "https://chef.local",
+				"validation_client_name": "validator",
+				"validation_key_path":    "test-fixtures/validator.pem",
+			}),
+
+			Commands: map[string]bool{
+				fmt.Sprintf("cmd /c if not exist %q mkdir %q", windowsConfDir, windowsConfDir): true,
+			},
+
+			Uploads: map[string]string{
+				windowsConfDir + "/client.rb":                 defaultWindowsClientConf,
+				windowsConfDir + "/encrypted_data_bag_secret": "SECRET-KEY-FILE",
+				windowsConfDir + "/validation.pem":            "VALIDATOR-PEM-FILE",
+				windowsConfDir + "/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
+					`"subkey2b":{"subkey3":"value3"}}},"key2":"value2","run_list":["cookbook::recipe"]}`,
+			},
+		},
+	}
+
+	r := new(ResourceProvisioner)
+	o := new(terraform.MockUIOutput)
+	c := new(communicator.MockCommunicator)
+
+	for k, tc := range cases {
+		c.Commands = tc.Commands
+		c.Uploads = tc.Uploads
+
+		p, err := r.decodeConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("Error: %v", err)
+		}
+
+		p.useSudo = false
+
+		err = p.windowsCreateConfigFiles(o, c)
+		if err != nil {
+			t.Fatalf("Test %q failed: %v", k, err)
+		}
+	}
+}
+
+const defaultWindowsInstallScript = `
+$winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
+
+switch ($winver)
+{
+  "6.0" {$machine_os = "2008"}
+  "6.1" {$machine_os = "2008r2"}
+  "6.2" {$machine_os = "2012"}
+  "6.3" {$machine_os = "2012"}
+  default {$machine_os = "2008r2"}
+}
+
+if ([System.IntPtr]::Size -eq 4) {$machine_arch = "i686"} else {$machine_arch = "x86_64"}
+
+$url = "http://www.chef.io/chef/download?p=windows&pv=$machine_os&m=$machine_arch&v="
+$dest = [System.IO.Path]::GetTempFileName()
+$dest = [System.IO.Path]::ChangeExtension($dest, ".msi")
+$downloader = New-Object System.Net.WebClient
+
+$http_proxy = ''
+if ($http_proxy -ne '') {
+	$no_proxy = ''
+  if ($no_proxy -eq ''){
+    $no_proxy = "127.0.0.1"
+  }
+
+  $proxy = New-Object System.Net.WebProxy($http_proxy, $true, ,$no_proxy.Split(','))
+  $downloader.proxy = $proxy
+}
+
+Write-Host 'Downloading Chef Client...'
+$downloader.DownloadFile($url, $dest)
+
+Write-Host 'Installing Chef Client...'
+Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
+`
+
+const proxyWindowsInstallScript = `
+$winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
+
+switch ($winver)
+{
+  "6.0" {$machine_os = "2008"}
+  "6.1" {$machine_os = "2008r2"}
+  "6.2" {$machine_os = "2012"}
+  "6.3" {$machine_os = "2012"}
+  default {$machine_os = "2008r2"}
+}
+
+if ([System.IntPtr]::Size -eq 4) {$machine_arch = "i686"} else {$machine_arch = "x86_64"}
+
+$url = "http://www.chef.io/chef/download?p=windows&pv=$machine_os&m=$machine_arch&v="
+$dest = [System.IO.Path]::GetTempFileName()
+$dest = [System.IO.Path]::ChangeExtension($dest, ".msi")
+$downloader = New-Object System.Net.WebClient
+
+$http_proxy = 'http://proxy.local'
+if ($http_proxy -ne '') {
+	$no_proxy = 'http://local.local,http://local.org'
+  if ($no_proxy -eq ''){
+    $no_proxy = "127.0.0.1"
+  }
+
+  $proxy = New-Object System.Net.WebProxy($http_proxy, $true, ,$no_proxy.Split(','))
+  $downloader.proxy = $proxy
+}
+
+Write-Host 'Downloading Chef Client...'
+$downloader.DownloadFile($url, $dest)
+
+Write-Host 'Installing Chef Client...'
+Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
+`
+
+const versionWindowsInstallScript = `
+$winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
+
+switch ($winver)
+{
+  "6.0" {$machine_os = "2008"}
+  "6.1" {$machine_os = "2008r2"}
+  "6.2" {$machine_os = "2012"}
+  "6.3" {$machine_os = "2012"}
+  default {$machine_os = "2008r2"}
+}
+
+if ([System.IntPtr]::Size -eq 4) {$machine_arch = "i686"} else {$machine_arch = "x86_64"}
+
+$url = "http://www.chef.io/chef/download?p=windows&pv=$machine_os&m=$machine_arch&v=11.18.6"
+$dest = [System.IO.Path]::GetTempFileName()
+$dest = [System.IO.Path]::ChangeExtension($dest, ".msi")
+$downloader = New-Object System.Net.WebClient
+
+$http_proxy = ''
+if ($http_proxy -ne '') {
+	$no_proxy = ''
+  if ($no_proxy -eq ''){
+    $no_proxy = "127.0.0.1"
+  }
+
+  $proxy = New-Object System.Net.WebProxy($http_proxy, $true, ,$no_proxy.Split(','))
+  $downloader.proxy = $proxy
+}
+
+Write-Host 'Downloading Chef Client...'
+$downloader.DownloadFile($url, $dest)
+
+Write-Host 'Installing Chef Client...'
+Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
+`
+
+const defaultWindowsClientConf = `log_location            STDOUT
+chef_server_url         "https://chef.local"
+validation_client_name  "validator"
+node_name               "nodename1"`
+
+const proxyWindowsClientConf = `log_location            STDOUT
+chef_server_url         "https://chef.local"
+validation_client_name  "validator"
+node_name               "nodename1"
+
+
+http_proxy          "http://proxy.local"
+ENV['http_proxy'] = "http://proxy.local"
+ENV['HTTP_PROXY'] = "http://proxy.local"
+
+
+
+https_proxy          "https://proxy.local"
+ENV['https_proxy'] = "https://proxy.local"
+ENV['HTTPS_PROXY'] = "https://proxy.local"
+
+
+no_proxy "http://local.local,https://local.local"`
diff --git a/builtin/provisioners/remote-exec/resource_provisioner.go b/builtin/provisioners/remote-exec/resource_provisioner.go
index f0905b4ef..39e5f9583 100644
--- a/builtin/provisioners/remote-exec/resource_provisioner.go
+++ b/builtin/provisioners/remote-exec/resource_provisioner.go
@@ -51,11 +51,7 @@ func (p *ResourceProvisioner) Validate(c *terraform.ResourceConfig) (ws []string
 	num := 0
 	for name := range c.Raw {
 		switch name {
-		case "scripts":
-			fallthrough
-		case "script":
-			fallthrough
-		case "inline":
+		case "scripts", "script", "inline":
 			num++
 		default:
 			es = append(es, fmt.Errorf("Unknown configuration '%s'", name))
diff --git a/command/apply.go b/command/apply.go
index 529d6e701..5c07e7140 100644
--- a/command/apply.go
+++ b/command/apply.go
@@ -7,6 +7,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform/config/module"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -207,7 +208,7 @@ func (c *ApplyCommand) Run(args []string) int {
 				"Instead, your Terraform state file has been partially updated with\n"+
 				"any resources that successfully completed. Please address the error\n"+
 				"above and apply again to incrementally change your infrastructure.",
-			applyErr))
+			multierror.Flatten(applyErr)))
 		return 1
 	}
 
@@ -229,38 +230,10 @@ func (c *ApplyCommand) Run(args []string) int {
 			c.Meta.StateOutPath())))
 	}
 
-	// If we have outputs, then output those at the end.
-	var outputs map[string]string
-	if !c.Destroy && state != nil {
-		outputs = state.RootModule().Outputs
-	}
-	if len(outputs) > 0 {
-		outputBuf := new(bytes.Buffer)
-		outputBuf.WriteString("[reset][bold][green]\nOutputs:\n\n")
-
-		// Output the outputs in alphabetical order
-		keyLen := 0
-		keys := make([]string, 0, len(outputs))
-		for key, _ := range outputs {
-			keys = append(keys, key)
-			if len(key) > keyLen {
-				keyLen = len(key)
-			}
+	if !c.Destroy {
+		if outputs := outputsAsString(state); outputs != "" {
+			c.Ui.Output(c.Colorize().Color(outputs))
 		}
-		sort.Strings(keys)
-
-		for _, k := range keys {
-			v := outputs[k]
-
-			outputBuf.WriteString(fmt.Sprintf(
-				"  %s%s = %s\n",
-				k,
-				strings.Repeat(" ", keyLen-len(k)),
-				v))
-		}
-
-		c.Ui.Output(c.Colorize().Color(
-			strings.TrimSpace(outputBuf.String())))
 	}
 
 	return 0
@@ -372,3 +345,38 @@ Options:
 `
 	return strings.TrimSpace(helpText)
 }
+
+func outputsAsString(state *terraform.State) string {
+	if state == nil {
+		return ""
+	}
+
+	outputs := state.RootModule().Outputs
+	outputBuf := new(bytes.Buffer)
+	if len(outputs) > 0 {
+		outputBuf.WriteString("[reset][bold][green]\nOutputs:\n\n")
+
+		// Output the outputs in alphabetical order
+		keyLen := 0
+		keys := make([]string, 0, len(outputs))
+		for key, _ := range outputs {
+			keys = append(keys, key)
+			if len(key) > keyLen {
+				keyLen = len(key)
+			}
+		}
+		sort.Strings(keys)
+
+		for _, k := range keys {
+			v := outputs[k]
+
+			outputBuf.WriteString(fmt.Sprintf(
+				"  %s%s = %s\n",
+				k,
+				strings.Repeat(" ", keyLen-len(k)),
+				v))
+		}
+	}
+
+	return strings.TrimSpace(outputBuf.String())
+}
diff --git a/command/counthookaction_string.go b/command/counthookaction_string.go
new file mode 100644
index 000000000..8b90dc50b
--- /dev/null
+++ b/command/counthookaction_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type=countHookAction hook_count_action.go; DO NOT EDIT
+
+package command
+
+import "fmt"
+
+const _countHookAction_name = "countHookActionAddcountHookActionChangecountHookActionRemove"
+
+var _countHookAction_index = [...]uint8{0, 18, 39, 60}
+
+func (i countHookAction) String() string {
+	if i >= countHookAction(len(_countHookAction_index)-1) {
+		return fmt.Sprintf("countHookAction(%d)", i)
+	}
+	return _countHookAction_name[_countHookAction_index[i]:_countHookAction_index[i+1]]
+}
diff --git a/command/flag_kv.go b/command/flag_kv.go
index 6e0198778..492cc66be 100644
--- a/command/flag_kv.go
+++ b/command/flag_kv.go
@@ -80,7 +80,11 @@ func loadKVFile(rawPath string) (map[string]string, error) {
 
 	var result map[string]string
 	if err := hcl.DecodeObject(&result, obj); err != nil {
-		return nil, err
+		return nil, fmt.Errorf(
+			"Error decoding Terraform vars file: %s\n\n"+
+				"The vars file should be in the format of `key = \"value\"`.\n"+
+				"Decoding errors are usually caused by an invalid format.",
+			err)
 	}
 
 	return result, nil
diff --git a/command/get.go b/command/get.go
index 1ca3b1305..91d13bbcd 100644
--- a/command/get.go
+++ b/command/get.go
@@ -77,6 +77,8 @@ Options:
   -update=false       If true, modules already downloaded will be checked
                       for updates and updated if necessary.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/graph.go b/command/graph.go
index 802c3c805..5719a8900 100644
--- a/command/graph.go
+++ b/command/graph.go
@@ -103,6 +103,9 @@ Options:
 
   -verbose             Generate a verbose, "worst-case" graph, with all nodes
                        for potential operations in place.
+
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/hook_count.go b/command/hook_count.go
index 21e1ea160..5f3f514c2 100644
--- a/command/hook_count.go
+++ b/command/hook_count.go
@@ -13,20 +13,17 @@ type CountHook struct {
 	Changed int
 	Removed int
 
+	ToAdd          int
+	ToChange       int
+	ToRemove       int
+	ToRemoveAndAdd int
+
 	pending map[string]countHookAction
 
 	sync.Mutex
 	terraform.NilHook
 }
 
-type countHookAction byte
-
-const (
-	countHookActionAdd countHookAction = iota
-	countHookActionChange
-	countHookActionRemove
-)
-
 func (h *CountHook) Reset() {
 	h.Lock()
 	defer h.Unlock()
@@ -86,3 +83,23 @@ func (h *CountHook) PostApply(
 
 	return terraform.HookActionContinue, nil
 }
+
+func (h *CountHook) PostDiff(
+	n *terraform.InstanceInfo, d *terraform.InstanceDiff) (
+	terraform.HookAction, error) {
+	h.Lock()
+	defer h.Unlock()
+
+	switch d.ChangeType() {
+	case terraform.DiffDestroyCreate:
+		h.ToRemoveAndAdd += 1
+	case terraform.DiffCreate:
+		h.ToAdd += 1
+	case terraform.DiffDestroy:
+		h.ToRemove += 1
+	case terraform.DiffUpdate:
+		h.ToChange += 1
+	}
+
+	return terraform.HookActionContinue, nil
+}
diff --git a/command/hook_count_action.go b/command/hook_count_action.go
new file mode 100644
index 000000000..344431dea
--- /dev/null
+++ b/command/hook_count_action.go
@@ -0,0 +1,11 @@
+package command
+
+//go:generate stringer -type=countHookAction hook_count_action.go
+
+type countHookAction byte
+
+const (
+	countHookActionAdd countHookAction = iota
+	countHookActionChange
+	countHookActionRemove
+)
diff --git a/command/hook_count_test.go b/command/hook_count_test.go
index 37fc72b69..deb822699 100644
--- a/command/hook_count_test.go
+++ b/command/hook_count_test.go
@@ -1,6 +1,7 @@
 package command
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/hashicorp/terraform/terraform"
@@ -9,3 +10,175 @@ import (
 func TestCountHook_impl(t *testing.T) {
 	var _ terraform.Hook = new(CountHook)
 }
+
+func TestCountHookPostDiff_DestroyOnly(t *testing.T) {
+	h := new(CountHook)
+
+	resources := map[string]*terraform.InstanceDiff{
+		"foo":   &terraform.InstanceDiff{Destroy: true},
+		"bar":   &terraform.InstanceDiff{Destroy: true},
+		"lorem": &terraform.InstanceDiff{Destroy: true},
+		"ipsum": &terraform.InstanceDiff{Destroy: true},
+	}
+
+	n := &terraform.InstanceInfo{} // TODO
+
+	for _, d := range resources {
+		h.PostDiff(n, d)
+	}
+
+	expected := new(CountHook)
+	expected.ToAdd = 0
+	expected.ToChange = 0
+	expected.ToRemoveAndAdd = 0
+	expected.ToRemove = 4
+
+	if !reflect.DeepEqual(expected, h) {
+		t.Fatalf("Expected %#v, got %#v instead.",
+			expected, h)
+	}
+}
+
+func TestCountHookPostDiff_AddOnly(t *testing.T) {
+	h := new(CountHook)
+
+	resources := map[string]*terraform.InstanceDiff{
+		"foo": &terraform.InstanceDiff{
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{RequiresNew: true},
+			},
+		},
+		"bar": &terraform.InstanceDiff{
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{RequiresNew: true},
+			},
+		},
+		"lorem": &terraform.InstanceDiff{
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{RequiresNew: true},
+			},
+		},
+	}
+
+	n := &terraform.InstanceInfo{}
+
+	for _, d := range resources {
+		h.PostDiff(n, d)
+	}
+
+	expected := new(CountHook)
+	expected.ToAdd = 3
+	expected.ToChange = 0
+	expected.ToRemoveAndAdd = 0
+	expected.ToRemove = 0
+
+	if !reflect.DeepEqual(expected, h) {
+		t.Fatalf("Expected %#v, got %#v instead.",
+			expected, h)
+	}
+}
+
+func TestCountHookPostDiff_ChangeOnly(t *testing.T) {
+	h := new(CountHook)
+
+	resources := map[string]*terraform.InstanceDiff{
+		"foo": &terraform.InstanceDiff{
+			Destroy: false,
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{},
+			},
+		},
+		"bar": &terraform.InstanceDiff{
+			Destroy: false,
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{},
+			},
+		},
+		"lorem": &terraform.InstanceDiff{
+			Destroy: false,
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{},
+			},
+		},
+	}
+
+	n := &terraform.InstanceInfo{}
+
+	for _, d := range resources {
+		h.PostDiff(n, d)
+	}
+
+	expected := new(CountHook)
+	expected.ToAdd = 0
+	expected.ToChange = 3
+	expected.ToRemoveAndAdd = 0
+	expected.ToRemove = 0
+
+	if !reflect.DeepEqual(expected, h) {
+		t.Fatalf("Expected %#v, got %#v instead.",
+			expected, h)
+	}
+}
+
+func TestCountHookPostDiff_Mixed(t *testing.T) {
+	h := new(CountHook)
+
+	resources := map[string]*terraform.InstanceDiff{
+		"foo": &terraform.InstanceDiff{
+			Destroy: true,
+		},
+		"bar": &terraform.InstanceDiff{},
+		"lorem": &terraform.InstanceDiff{
+			Destroy: false,
+			Attributes: map[string]*terraform.ResourceAttrDiff{
+				"foo": &terraform.ResourceAttrDiff{},
+			},
+		},
+		"ipsum": &terraform.InstanceDiff{Destroy: true},
+	}
+
+	n := &terraform.InstanceInfo{}
+
+	for _, d := range resources {
+		h.PostDiff(n, d)
+	}
+
+	expected := new(CountHook)
+	expected.ToAdd = 0
+	expected.ToChange = 1
+	expected.ToRemoveAndAdd = 0
+	expected.ToRemove = 2
+
+	if !reflect.DeepEqual(expected, h) {
+		t.Fatalf("Expected %#v, got %#v instead.",
+			expected, h)
+	}
+}
+
+func TestCountHookPostDiff_NoChange(t *testing.T) {
+	h := new(CountHook)
+
+	resources := map[string]*terraform.InstanceDiff{
+		"foo":   &terraform.InstanceDiff{},
+		"bar":   &terraform.InstanceDiff{},
+		"lorem": &terraform.InstanceDiff{},
+		"ipsum": &terraform.InstanceDiff{},
+	}
+
+	n := &terraform.InstanceInfo{}
+
+	for _, d := range resources {
+		h.PostDiff(n, d)
+	}
+
+	expected := new(CountHook)
+	expected.ToAdd = 0
+	expected.ToChange = 0
+	expected.ToRemoveAndAdd = 0
+	expected.ToRemove = 0
+
+	if !reflect.DeepEqual(expected, h) {
+		t.Fatalf("Expected %#v, got %#v instead.",
+			expected, h)
+	}
+}
diff --git a/command/init.go b/command/init.go
index 328c473d0..fb842d08d 100644
--- a/command/init.go
+++ b/command/init.go
@@ -149,6 +149,8 @@ Options:
   -backend-config="k=v"  Specifies configuration for the remote storage
                          backend. This can be specified multiple times.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/meta.go b/command/meta.go
index 7237a8d61..1a6ca47f4 100644
--- a/command/meta.go
+++ b/command/meta.go
@@ -190,7 +190,7 @@ func (m *Meta) InputMode() terraform.InputMode {
 
 	var mode terraform.InputMode
 	mode |= terraform.InputModeProvider
-	if len(m.variables) == 0 && m.autoKey == "" {
+	if len(m.variables) == 0 {
 		mode |= terraform.InputModeVar
 		mode |= terraform.InputModeVarUnset
 	}
@@ -351,6 +351,7 @@ func (m *Meta) process(args []string, vars bool) []string {
 	for i, v := range args {
 		if v == "-no-color" {
 			m.color = false
+			m.Color = false
 			args = append(args[:i], args[i+1:]...)
 			break
 		}
diff --git a/command/meta_test.go b/command/meta_test.go
index bb3b34107..23b817203 100644
--- a/command/meta_test.go
+++ b/command/meta_test.go
@@ -158,7 +158,7 @@ func TestMetaInputMode_defaultVars(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
-	if m.InputMode()&terraform.InputModeVar != 0 {
+	if m.InputMode()&terraform.InputModeVar == 0 {
 		t.Fatalf("bad: %#v", m.InputMode())
 	}
 }
diff --git a/command/output.go b/command/output.go
index 2e3c1bee0..63a6926f3 100644
--- a/command/output.go
+++ b/command/output.go
@@ -15,9 +15,12 @@ type OutputCommand struct {
 func (c *OutputCommand) Run(args []string) int {
 	args = c.Meta.process(args, false)
 
+	var module string
 	cmdFlags := flag.NewFlagSet("output", flag.ContinueOnError)
 	cmdFlags.StringVar(&c.Meta.statePath, "state", DefaultStateFilename, "path")
+	cmdFlags.StringVar(&module, "module", "", "module")
 	cmdFlags.Usage = func() { c.Ui.Error(c.Help()) }
+
 	if err := cmdFlags.Parse(args); err != nil {
 		return 1
 	}
@@ -38,15 +41,34 @@ func (c *OutputCommand) Run(args []string) int {
 		return 1
 	}
 
+	if module == "" {
+		module = "root"
+	} else {
+		module = "root." + module
+	}
+
+	// Get the proper module we want to get outputs for
+	modPath := strings.Split(module, ".")
+
 	state := stateStore.State()
-	if state.Empty() || len(state.RootModule().Outputs) == 0 {
+	mod := state.ModuleByPath(modPath)
+
+	if mod == nil {
+		c.Ui.Error(fmt.Sprintf(
+			"The module %s could not be found. There is nothing to output.",
+			module))
+		return 1
+	}
+
+	if state.Empty() || len(mod.Outputs) == 0 {
 		c.Ui.Error(fmt.Sprintf(
 			"The state file has no outputs defined. Define an output\n" +
 				"in your configuration with the `output` directive and re-run\n" +
 				"`terraform apply` for it to become available."))
 		return 1
 	}
-	v, ok := state.RootModule().Outputs[name]
+
+	v, ok := mod.Outputs[name]
 	if !ok {
 		c.Ui.Error(fmt.Sprintf(
 			"The output variable requested could not be found in the state\n" +
@@ -72,6 +94,8 @@ Options:
   -state=path      Path to the state file to read. Defaults to
                    "terraform.tfstate".
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/output_test.go b/command/output_test.go
index d3444c389..f84642269 100644
--- a/command/output_test.go
+++ b/command/output_test.go
@@ -47,6 +47,83 @@ func TestOutput(t *testing.T) {
 	}
 }
 
+func TestModuleOutput(t *testing.T) {
+	originalState := &terraform.State{
+		Modules: []*terraform.ModuleState{
+			&terraform.ModuleState{
+				Path: []string{"root"},
+				Outputs: map[string]string{
+					"foo": "bar",
+				},
+			},
+			&terraform.ModuleState{
+				Path: []string{"root", "my_module"},
+				Outputs: map[string]string{
+					"blah": "tastatur",
+				},
+			},
+		},
+	}
+
+	statePath := testStateFile(t, originalState)
+
+	ui := new(cli.MockUi)
+	c := &OutputCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		"-module", "my_module",
+		"blah",
+	}
+
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: \n%s", ui.ErrorWriter.String())
+	}
+
+	actual := strings.TrimSpace(ui.OutputWriter.String())
+	if actual != "tastatur" {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestMissingModuleOutput(t *testing.T) {
+	originalState := &terraform.State{
+		Modules: []*terraform.ModuleState{
+			&terraform.ModuleState{
+				Path: []string{"root"},
+				Outputs: map[string]string{
+					"foo": "bar",
+				},
+			},
+		},
+	}
+
+	statePath := testStateFile(t, originalState)
+
+	ui := new(cli.MockUi)
+	c := &OutputCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		"-module", "not_existing_module",
+		"blah",
+	}
+
+	if code := c.Run(args); code != 1 {
+		t.Fatalf("bad: \n%s", ui.ErrorWriter.String())
+	}
+}
+
 func TestOutput_badVar(t *testing.T) {
 	originalState := &terraform.State{
 		Modules: []*terraform.ModuleState{
diff --git a/command/plan.go b/command/plan.go
index 083373c3a..f5a478873 100644
--- a/command/plan.go
+++ b/command/plan.go
@@ -53,6 +53,9 @@ func (c *PlanCommand) Run(args []string) int {
 		}
 	}
 
+	countHook := new(CountHook)
+	c.Meta.extraHooks = []terraform.Hook{countHook}
+
 	ctx, _, err := c.Context(contextOpts{
 		Destroy:   destroy,
 		Path:      path,
@@ -130,6 +133,13 @@ func (c *PlanCommand) Run(args []string) int {
 		ModuleDepth: moduleDepth,
 	}))
 
+	c.Ui.Output(c.Colorize().Color(fmt.Sprintf(
+		"[reset][bold]Plan:[reset] "+
+			"%d to add, %d to change, %d to destroy.",
+		countHook.ToAdd,
+		(countHook.ToChange + countHook.ToRemoveAndAdd),
+		countHook.ToRemove)))
+
 	if detailed {
 		return 2
 	}
@@ -189,7 +199,6 @@ Options:
   -var-file=foo       Set variables in the Terraform configuration from
                       a file. If "terraform.tfvars" is present, it will be
                       automatically loaded if this flag is not specified.
-
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/push.go b/command/push.go
index a4649a822..7695adf21 100644
--- a/command/push.go
+++ b/command/push.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 
 	"github.com/hashicorp/atlas-go/archive"
@@ -24,6 +25,7 @@ func (c *PushCommand) Run(args []string) int {
 	var atlasAddress, atlasToken string
 	var archiveVCS, moduleUpload bool
 	var name string
+	var overwrite []string
 	args = c.Meta.process(args, true)
 	cmdFlags := c.Meta.flagSet("push")
 	cmdFlags.StringVar(&atlasAddress, "atlas-address", "", "")
@@ -32,11 +34,18 @@ func (c *PushCommand) Run(args []string) int {
 	cmdFlags.BoolVar(&moduleUpload, "upload-modules", true, "")
 	cmdFlags.StringVar(&name, "name", "", "")
 	cmdFlags.BoolVar(&archiveVCS, "vcs", true, "")
+	cmdFlags.Var((*FlagStringSlice)(&overwrite), "overwrite", "")
 	cmdFlags.Usage = func() { c.Ui.Error(c.Help()) }
 	if err := cmdFlags.Parse(args); err != nil {
 		return 1
 	}
 
+	// Make a map of the set values
+	overwriteMap := make(map[string]struct{}, len(overwrite))
+	for _, v := range overwrite {
+		overwriteMap[v] = struct{}{}
+	}
+
 	// The pwd is used for the configuration path if one is not given
 	pwd, err := os.Getwd()
 	if err != nil {
@@ -125,17 +134,17 @@ func (c *PushCommand) Run(args []string) int {
 	}
 
 	// Get the variables we might already have
-	vars, err := c.client.Get(name)
+	atlasVars, err := c.client.Get(name)
 	if err != nil {
 		c.Ui.Error(fmt.Sprintf(
 			"Error looking up previously pushed configuration: %s", err))
 		return 1
 	}
-	for k, v := range vars {
-		// Local variables override remote ones
-		if _, exists := ctx.Variables()[k]; exists {
+	for k, v := range atlasVars {
+		if _, ok := overwriteMap[k]; ok {
 			continue
 		}
+
 		ctx.SetVariable(k, v)
 	}
 
@@ -169,12 +178,41 @@ func (c *PushCommand) Run(args []string) int {
 		return 1
 	}
 
+	// Output to the user the variables that will be uploaded
+	var setVars []string
+	for k, _ := range ctx.Variables() {
+		if _, ok := overwriteMap[k]; !ok {
+			if _, ok := atlasVars[k]; ok {
+				// Atlas variable not within override, so it came from Atlas
+				continue
+			}
+		}
+
+		// This variable was set from the local value
+		setVars = append(setVars, k)
+	}
+	sort.Strings(setVars)
+	if len(setVars) > 0 {
+		c.Ui.Output(
+			"The following variables will be set or overwritten within Atlas from\n" +
+				"their local values. All other variables are already set within Atlas.\n" +
+				"If you want to modify the value of a variable, use the Atlas web\n" +
+				"interface or set it locally and use the -overwrite flag.\n\n")
+		for _, v := range setVars {
+			c.Ui.Output(fmt.Sprintf("  * %s", v))
+		}
+
+		// Newline
+		c.Ui.Output("")
+	}
+
 	// Upsert!
 	opts := &pushUpsertOptions{
 		Name:      name,
 		Archive:   archiveR,
 		Variables: ctx.Variables(),
 	}
+	c.Ui.Output("Uploading Terraform configuration...")
 	vsn, err := c.client.Upsert(opts)
 	if err != nil {
 		c.Ui.Error(fmt.Sprintf(
@@ -211,9 +249,22 @@ Options:
   -token=<token>       Access token to use to upload. If blank or unspecified,
                        the ATLAS_TOKEN environmental variable will be used.
 
+  -overwrite=foo       Variable keys that should overwrite values in Atlas.
+                       Otherwise, variables already set in Atlas will overwrite
+                       local values. This flag can be repeated.
+
+  -var 'foo=bar'       Set a variable in the Terraform configuration. This
+                       flag can be set multiple times.
+
+  -var-file=foo        Set variables in the Terraform configuration from
+                       a file. If "terraform.tfvars" is present, it will be
+                       automatically loaded if this flag is not specified.
+
   -vcs=true            If true (default), push will upload only files
                        comitted to your VCS, if detected.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/push_test.go b/command/push_test.go
index ccb7bc222..a3d171a61 100644
--- a/command/push_test.go
+++ b/command/push_test.go
@@ -119,7 +119,7 @@ func TestPush_input(t *testing.T) {
 		"foo": "foo",
 	}
 	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
-		t.Fatalf("bad: %#v", client.UpsertOptions)
+		t.Fatalf("bad: %#v", client.UpsertOptions.Variables)
 	}
 }
 
@@ -179,7 +179,9 @@ func TestPush_inputPartial(t *testing.T) {
 	}
 }
 
-func TestPush_inputTfvars(t *testing.T) {
+// This tests that the push command will override Atlas variables
+// if requested.
+func TestPush_localOverride(t *testing.T) {
 	// Disable test mode so input would be asked and setup the
 	// input reader/writers.
 	test = false
@@ -219,6 +221,154 @@ func TestPush_inputTfvars(t *testing.T) {
 		client: client,
 	}
 
+	path := testFixturePath("push-tfvars")
+	args := []string{
+		"-var-file", path + "/terraform.tfvars",
+		"-vcs=false",
+		"-overwrite=foo",
+		path,
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	actual := testArchiveStr(t, archivePath)
+	expected := []string{
+		".terraform/",
+		".terraform/terraform.tfstate",
+		"main.tf",
+		"terraform.tfvars",
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	if client.UpsertOptions.Name != "foo" {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+
+	variables := map[string]string{
+		"foo": "bar",
+		"bar": "foo",
+	}
+	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+}
+
+// This tests that the push command prefers Atlas variables over
+// local ones.
+func TestPush_preferAtlas(t *testing.T) {
+	// Disable test mode so input would be asked and setup the
+	// input reader/writers.
+	test = false
+	defer func() { test = true }()
+	defaultInputReader = bytes.NewBufferString("nope\n")
+	defaultInputWriter = new(bytes.Buffer)
+
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Create remote state file, this should be pulled
+	conf, srv := testRemoteState(t, testState(), 200)
+	defer srv.Close()
+
+	// Persist local remote state
+	s := terraform.NewState()
+	s.Serial = 5
+	s.Remote = conf
+	testStateFileRemote(t, s)
+
+	// Path where the archive will be "uploaded" to
+	archivePath := testTempFile(t)
+	defer os.Remove(archivePath)
+
+	client := &mockPushClient{File: archivePath}
+	// Provided vars should override existing ones
+	client.GetResult = map[string]string{
+		"foo": "old",
+	}
+	ui := new(cli.MockUi)
+	c := &PushCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+
+		client: client,
+	}
+
+	path := testFixturePath("push-tfvars")
+	args := []string{
+		"-var-file", path + "/terraform.tfvars",
+		"-vcs=false",
+		path,
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	actual := testArchiveStr(t, archivePath)
+	expected := []string{
+		".terraform/",
+		".terraform/terraform.tfstate",
+		"main.tf",
+		"terraform.tfvars",
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	if client.UpsertOptions.Name != "foo" {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+
+	variables := map[string]string{
+		"foo": "old",
+		"bar": "foo",
+	}
+	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+}
+
+// This tests that the push command will send the variables in tfvars
+func TestPush_tfvars(t *testing.T) {
+	// Disable test mode so input would be asked and setup the
+	// input reader/writers.
+	test = false
+	defer func() { test = true }()
+	defaultInputReader = bytes.NewBufferString("nope\n")
+	defaultInputWriter = new(bytes.Buffer)
+
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Create remote state file, this should be pulled
+	conf, srv := testRemoteState(t, testState(), 200)
+	defer srv.Close()
+
+	// Persist local remote state
+	s := terraform.NewState()
+	s.Serial = 5
+	s.Remote = conf
+	testStateFileRemote(t, s)
+
+	// Path where the archive will be "uploaded" to
+	archivePath := testTempFile(t)
+	defer os.Remove(archivePath)
+
+	client := &mockPushClient{File: archivePath}
+	ui := new(cli.MockUi)
+	c := &PushCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+
+		client: client,
+	}
+
 	path := testFixturePath("push-tfvars")
 	args := []string{
 		"-var-file", path + "/terraform.tfvars",
diff --git a/command/refresh.go b/command/refresh.go
index 32e795047..ee3cd7007 100644
--- a/command/refresh.go
+++ b/command/refresh.go
@@ -105,6 +105,10 @@ func (c *RefreshCommand) Run(args []string) int {
 		return 1
 	}
 
+	if outputs := outputsAsString(newState); outputs != "" {
+		c.Ui.Output(c.Colorize().Color(outputs))
+	}
+
 	return 0
 }
 
diff --git a/command/refresh_test.go b/command/refresh_test.go
index 6ff99f9f1..530bde073 100644
--- a/command/refresh_test.go
+++ b/command/refresh_test.go
@@ -581,6 +581,35 @@ func TestRefresh_disableBackup(t *testing.T) {
 	}
 }
 
+func TestRefresh_displaysOutputs(t *testing.T) {
+	state := testState()
+	statePath := testStateFile(t, state)
+
+	p := testProvider()
+	ui := new(cli.MockUi)
+	c := &RefreshCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(p),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		testFixturePath("refresh-output"),
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	// Test that outputs were displayed
+	outputValue := "foo.example.com"
+	actual := ui.OutputWriter.String()
+	if !strings.Contains(actual, outputValue) {
+		t.Fatalf("Expected:\n%s\n\nTo include: %q", actual, outputValue)
+	}
+}
+
 const refreshVarFile = `
 foo = "bar"
 `
diff --git a/command/remote.go b/command/remote.go
index 3e9e05f1b..05d119341 100644
--- a/command/remote.go
+++ b/command/remote.go
@@ -42,6 +42,10 @@ Usage: terraform remote <subcommand> [options]
 
   Configure remote state storage with Terraform.
 
+Options:
+
+  -no-color   If specified, output won't contain any color.
+
 Available subcommands:
 
   config      Configure the remote storage settings.
diff --git a/command/remote_config.go b/command/remote_config.go
index 92017c484..265d1bff4 100644
--- a/command/remote_config.go
+++ b/command/remote_config.go
@@ -368,6 +368,8 @@ Options:
   -state=path            Path to read state. Defaults to "terraform.tfstate"
                          unless remote state is enabled.
 
+  -no-color              If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/remote_pull.go b/command/remote_pull.go
index bf757ccf1..b159d5a3b 100644
--- a/command/remote_pull.go
+++ b/command/remote_pull.go
@@ -74,6 +74,9 @@ Usage: terraform pull [options]
 
   Refreshes the cached state file from the remote server.
 
+Options:
+
+  -no-color           If specified, output won't contain any color.
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/remote_push.go b/command/remote_push.go
index 81e50c6ba..97ff8f951 100644
--- a/command/remote_push.go
+++ b/command/remote_push.go
@@ -81,6 +81,8 @@ Usage: terraform push [options]
 
 Options:
 
+  -no-color              If specified, output won't contain any color.
+
   -force                 Forces the upload of the local state, ignoring any
                          conflicts. This should be used carefully, as force pushing
 						 can cause remote state information to be lost.
diff --git a/command/show.go b/command/show.go
index cf7b6cfa6..624ee659d 100644
--- a/command/show.go
+++ b/command/show.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"strings"
 
-	statelib "github.com/hashicorp/terraform/state"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -66,16 +65,15 @@ func (c *ShowCommand) Run(args []string) int {
 				stateErr = err
 			}
 		}
-
 	} else {
-		// We should use the default state if it exists.
-		stateStore := &statelib.LocalState{Path: DefaultStateFilename}
-		if err := stateStore.RefreshState(); err != nil {
+		stateOpts := c.StateOpts()
+		stateOpts.RemoteCacheOnly = true
+		result, err := State(stateOpts)
+		if err != nil {
 			c.Ui.Error(fmt.Sprintf("Error reading state: %s", err))
 			return 1
 		}
-
-		state = stateStore.State()
+		state = result.State.State()
 		if state == nil {
 			c.Ui.Output("No state.")
 			return 0
diff --git a/command/show_test.go b/command/show_test.go
index 245b24def..eb73ebe2f 100644
--- a/command/show_test.go
+++ b/command/show_test.go
@@ -4,6 +4,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/hashicorp/terraform/config/module"
@@ -124,6 +125,45 @@ func TestShow_plan(t *testing.T) {
 	}
 }
 
+func TestShow_noArgsRemoteState(t *testing.T) {
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Pretend like we have a local cache of remote state
+	remoteStatePath := filepath.Join(tmp, DefaultDataDir, DefaultStateFilename)
+	if err := os.MkdirAll(filepath.Dir(remoteStatePath), 0755); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	f, err := os.Create(remoteStatePath)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	err = terraform.WriteState(testState(), f)
+	f.Close()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	ui := new(cli.MockUi)
+	c := &ShowCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: \n%s", ui.OutputWriter.String())
+	}
+
+	expected := "test_instance.foo"
+	actual := ui.OutputWriter.String()
+	if !strings.Contains(actual, expected) {
+		t.Fatalf("expected:\n%s\n\nto include: %q", actual, expected)
+	}
+}
+
 func TestShow_state(t *testing.T) {
 	originalState := testState()
 	statePath := testStateFile(t, originalState)
diff --git a/command/test-fixtures/refresh-output/main.tf b/command/test-fixtures/refresh-output/main.tf
new file mode 100644
index 000000000..d7efff6e4
--- /dev/null
+++ b/command/test-fixtures/refresh-output/main.tf
@@ -0,0 +1,7 @@
+resource "test_instance" "foo" {
+    ami = "bar"
+}
+
+output "endpoint" {
+  value = "foo.example.com"
+}
diff --git a/communicator/communicator_mock.go b/communicator/communicator_mock.go
new file mode 100644
index 000000000..f1c5ad5e6
--- /dev/null
+++ b/communicator/communicator_mock.go
@@ -0,0 +1,91 @@
+package communicator
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/hashicorp/terraform/communicator/remote"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+// MockCommunicator is an implementation of Communicator that can be used for tests.
+type MockCommunicator struct {
+	RemoteScriptPath string
+	Commands         map[string]bool
+	Uploads          map[string]string
+	UploadScripts    map[string]string
+	UploadDirs       map[string]string
+}
+
+// Connect implementation of communicator.Communicator interface
+func (c *MockCommunicator) Connect(o terraform.UIOutput) error {
+	return nil
+}
+
+// Disconnect implementation of communicator.Communicator interface
+func (c *MockCommunicator) Disconnect() error {
+	return nil
+}
+
+// Timeout implementation of communicator.Communicator interface
+func (c *MockCommunicator) Timeout() time.Duration {
+	return time.Duration(5 * time.Second)
+}
+
+// ScriptPath implementation of communicator.Communicator interface
+func (c *MockCommunicator) ScriptPath() string {
+	return c.RemoteScriptPath
+}
+
+// Start implementation of communicator.Communicator interface
+func (c *MockCommunicator) Start(r *remote.Cmd) error {
+	if !c.Commands[r.Command] {
+		return fmt.Errorf("Command not found!")
+	}
+
+	r.SetExited(0)
+
+	return nil
+}
+
+// Upload implementation of communicator.Communicator interface
+func (c *MockCommunicator) Upload(path string, input io.Reader) error {
+	f, ok := c.Uploads[path]
+	if !ok {
+		return fmt.Errorf("Path %q not found!", path)
+	}
+
+	var buf bytes.Buffer
+	buf.ReadFrom(input)
+	content := strings.TrimSpace(buf.String())
+
+	f = strings.TrimSpace(f)
+	if f != content {
+		return fmt.Errorf("expected: %q\n\ngot: %q\n", f, content)
+	}
+
+	return nil
+}
+
+// UploadScript implementation of communicator.Communicator interface
+func (c *MockCommunicator) UploadScript(path string, input io.Reader) error {
+	c.Uploads = c.UploadScripts
+	return c.Upload(path, input)
+}
+
+// UploadDir implementation of communicator.Communicator interface
+func (c *MockCommunicator) UploadDir(dst string, src string) error {
+	v, ok := c.UploadDirs[src]
+	if !ok {
+		return fmt.Errorf("Directory not found!")
+	}
+
+	if v != dst {
+		return fmt.Errorf("expected: %q\n\ngot: %q\n", v, dst)
+	}
+
+	return nil
+}
diff --git a/communicator/ssh/communicator.go b/communicator/ssh/communicator.go
index ea6aa6887..7e04bb446 100644
--- a/communicator/ssh/communicator.go
+++ b/communicator/ssh/communicator.go
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform/communicator/remote"
 	"github.com/hashicorp/terraform/terraform"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 )
 
 const (
@@ -47,9 +48,9 @@ type sshConfig struct {
 	// noPty, if true, will not request a pty from the remote end.
 	noPty bool
 
-	// sshAgentConn is a pointer to the UNIX connection for talking with the
-	// ssh-agent.
-	sshAgentConn net.Conn
+	// sshAgent is a struct surrounding the agent.Agent client and the net.Conn
+	// to the SSH Agent. It is nil if no SSH agent is configured
+	sshAgent *sshAgent
 }
 
 // New creates a new communicator implementation over SSH.
@@ -95,6 +96,21 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 			c.connInfo.KeyFile != "",
 			c.connInfo.Agent,
 		))
+
+		if c.connInfo.BastionHost != "" {
+			o.Output(fmt.Sprintf(
+				"Using configured bastion host...\n"+
+					"  Host: %s\n"+
+					"  User: %s\n"+
+					"  Password: %t\n"+
+					"  Private key: %t\n"+
+					"  SSH Agent: %t",
+				c.connInfo.BastionHost, c.connInfo.BastionUser,
+				c.connInfo.BastionPassword != "",
+				c.connInfo.BastionKeyFile != "",
+				c.connInfo.Agent,
+			))
+		}
 	}
 
 	log.Printf("connecting to TCP connection for SSH")
@@ -122,6 +138,28 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 
 	c.client = ssh.NewClient(sshConn, sshChan, req)
 
+	if c.config.sshAgent != nil {
+		log.Printf("[DEBUG] Telling SSH config to foward to agent")
+		if err := c.config.sshAgent.ForwardToAgent(c.client); err != nil {
+			return err
+		}
+
+		log.Printf("[DEBUG] Setting up a session to request agent forwarding")
+		session, err := c.newSession()
+		if err != nil {
+			return err
+		}
+		defer session.Close()
+
+		err = agent.RequestAgentForwarding(session)
+
+		if err == nil {
+			log.Printf("[INFO] agent forwarding enabled")
+		} else {
+			log.Printf("[WARN] error forwarding agent: %s", err)
+		}
+	}
+
 	if o != nil {
 		o.Output("Connected!")
 	}
@@ -131,8 +169,8 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 
 // Disconnect implementation of communicator.Communicator interface
 func (c *Communicator) Disconnect() error {
-	if c.config.sshAgentConn != nil {
-		return c.config.sshAgentConn.Close()
+	if c.config.sshAgent != nil {
+		return c.config.sshAgent.Close()
 	}
 
 	return nil
@@ -222,10 +260,19 @@ func (c *Communicator) Upload(path string, input io.Reader) error {
 
 // UploadScript implementation of communicator.Communicator interface
 func (c *Communicator) UploadScript(path string, input io.Reader) error {
-	script := bytes.NewBufferString(DefaultShebang)
-	script.ReadFrom(input)
+	reader := bufio.NewReader(input)
+	prefix, err := reader.Peek(2)
+	if err != nil {
+		return fmt.Errorf("Error reading script: %s", err)
+	}
 
-	if err := c.Upload(path, script); err != nil {
+	var script bytes.Buffer
+	if string(prefix) != "#!" {
+		script.WriteString(DefaultShebang)
+	}
+
+	script.ReadFrom(reader)
+	if err := c.Upload(path, &script); err != nil {
 		return err
 	}
 
@@ -252,7 +299,7 @@ func (c *Communicator) UploadScript(path string, input io.Reader) error {
 
 // UploadDir implementation of communicator.Communicator interface
 func (c *Communicator) UploadDir(dst string, src string) error {
-	log.Printf("Upload dir '%s' to '%s'", src, dst)
+	log.Printf("Uploading dir '%s' to '%s'", src, dst)
 	scpFunc := func(w io.Writer, r *bufio.Reader) error {
 		uploadEntries := func() error {
 			f, err := os.Open(src)
@@ -554,3 +601,43 @@ func ConnectFunc(network, addr string) func() (net.Conn, error) {
 		return c, nil
 	}
 }
+
+// BastionConnectFunc is a convenience method for returning a function
+// that connects to a host over a bastion connection.
+func BastionConnectFunc(
+	bProto string,
+	bAddr string,
+	bConf *ssh.ClientConfig,
+	proto string,
+	addr string) func() (net.Conn, error) {
+	return func() (net.Conn, error) {
+		log.Printf("[DEBUG] Connecting to bastion: %s", bAddr)
+		bastion, err := ssh.Dial(bProto, bAddr, bConf)
+		if err != nil {
+			return nil, fmt.Errorf("Error connecting to bastion: %s", err)
+		}
+
+		log.Printf("[DEBUG] Connecting via bastion (%s) to host: %s", bAddr, addr)
+		conn, err := bastion.Dial(proto, addr)
+		if err != nil {
+			bastion.Close()
+			return nil, err
+		}
+
+		// Wrap it up so we close both things properly
+		return &bastionConn{
+			Conn:    conn,
+			Bastion: bastion,
+		}, nil
+	}
+}
+
+type bastionConn struct {
+	net.Conn
+	Bastion *ssh.Client
+}
+
+func (c *bastionConn) Close() error {
+	c.Conn.Close()
+	return c.Bastion.Close()
+}
diff --git a/communicator/ssh/communicator_test.go b/communicator/ssh/communicator_test.go
index 24571f0af..28755b6db 100644
--- a/communicator/ssh/communicator_test.go
+++ b/communicator/ssh/communicator_test.go
@@ -5,7 +5,9 @@ package ssh
 import (
 	"bytes"
 	"fmt"
+	"io/ioutil"
 	"net"
+	"os"
 	"regexp"
 	"strings"
 	"testing"
@@ -45,12 +47,8 @@ NsZoFj52ponUM6+99A2CmezFCN16c4mbA//luWF+k3VVqR6BpkrhKw==
 -----END RSA PRIVATE KEY-----`
 
 var serverConfig = &ssh.ServerConfig{
-	PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
-		if c.User() == "user" && string(pass) == "pass" {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("password rejected for %q", c.User())
-	},
+	PasswordCallback:  acceptUserPass("user", "pass"),
+	PublicKeyCallback: acceptPublicKey(testClientPublicKey),
 }
 
 func init() {
@@ -169,6 +167,48 @@ func TestStart(t *testing.T) {
 	}
 }
 
+func TestStart_KeyFile(t *testing.T) {
+	address := newMockLineServer(t)
+	parts := strings.Split(address, ":")
+
+	keyFile, err := ioutil.TempFile("", "tf")
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	keyFilePath := keyFile.Name()
+	keyFile.Write([]byte(testClientPrivateKey))
+	keyFile.Close()
+	defer os.Remove(keyFilePath)
+
+	r := &terraform.InstanceState{
+		Ephemeral: terraform.EphemeralState{
+			ConnInfo: map[string]string{
+				"type":     "ssh",
+				"user":     "user",
+				"key_file": keyFilePath,
+				"host":     parts[0],
+				"port":     parts[1],
+				"timeout":  "30s",
+			},
+		},
+	}
+
+	c, err := New(r)
+	if err != nil {
+		t.Fatalf("error creating communicator: %s", err)
+	}
+
+	var cmd remote.Cmd
+	stdout := new(bytes.Buffer)
+	cmd.Command = "echo foo"
+	cmd.Stdout = stdout
+
+	err = c.Start(&cmd)
+	if err != nil {
+		t.Fatalf("error executing remote command: %s", err)
+	}
+}
+
 func TestScriptPath(t *testing.T) {
 	cases := []struct {
 		Input   string
@@ -197,3 +237,56 @@ func TestScriptPath(t *testing.T) {
 		}
 	}
 }
+
+const testClientPrivateKey = `-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAxOgNXOJ/jrRDxBZTSk2X9otNy9zcpUmJr5ifDi5sy7j2ZiQS
+beBt1Wf+tLNWis8Cyq06ttEvjjRuM75yucyD6GrqDTXVCSm4PeOIQeDhPhw26wYZ
+O0h/mFgrAiCwaEl8AFXVBInOhVn/0nqgUpkwckh76bjTsNeifkiugK3cfJOuBdrU
+ZGbgugJjmYo4Cmv7ECo1gCFT5N+BAjOji3z3N5ClBH5HaWC77jH7kTH0k5cZ+ZRQ
+tG9EqLyvWlnzTAR/Yly0JInkOa16Ms1Au5sIJwEoJfHKsNVK06IlLob53nblwYW0
+H5gv1Kb/rS+nUkpPtA5YFShB7iZnPLPPv6qXSwIDAQABAoIBAC0UY1rMkB9/rbQK
+2G6+bPgI1HrDydAdkeQdsOxyPH43jlG8GGwHYZ3l/S4pkLqewijcmACay6Rm5IP8
+Kg/XfquLLqJvnKJIZuHkYaGTdn3dv8T21Hf6FRwvs0j9auW1TSpWfDpZwmpNPIBX
+irTeVXUUmynbIrvt4km/IhRbuYrbbb964CLYD1DCl3XssXxoRNvPpc5EtOuyDorA
+5g1hvZR1FqbOAmOuNQMYJociMuWB8mCaHb+o1Sg4A65OLXxoKs0cuwInJ/n/R4Z3
++GrV+x5ypBMxXgjjQtKMLEOujkvxs1cp34hkbhKMHHXxbMu5jl74YtGGsLLk90rq
+ieZGIgECgYEA49OM9mMCrDoFUTZdJaSARA/MOXkdQgrqVTv9kUHee7oeMZZ6lS0i
+bPU7g+Bq+UAN0qcw9x992eAElKjBA71Q5UbZYWh29BDMZd8bRJmwz4P6aSMoYLWI
+Sr31caJU9LdmPFatarNeehjSJtlTuoZD9+NElnnUwNaTeOOo5UdhTQsCgYEA3UGm
+QWoDUttFwK9oL2KL8M54Bx6EzNhnyk03WrqBbR7PJcPKnsF0R/0soQ+y0FW0r8RJ
+TqG6ze5fUJII72B4GlMTQdP+BIvaKQttwWQTNIjbbv4NksF445gdVOO1xi9SvQ7k
+uvMVxOb+1jL3HAFa3furWu2tJRDs6dhuaILLxsECgYEAhnhlKUBDYZhVbxvhWsh/
+lKymY/3ikQqUSX7BKa1xPiIalDY3YDllql4MpMgfG8L85asdMZ96ztB0o7H/Ss/B
+IbLxt5bLLz+DBVXsaE82lyVU9h10RbCgI01/w3SHJHHjfBXFAcehKfvgfmGkE+IP
+2A5ie1aphrCgFqh5FetNuQUCgYEAibL42I804FUtFR1VduAa/dRRqQSaW6528dWa
+lLGsKRBalUNEEAeP6dmr89UEUVp1qEo94V0QGGe5FDi+rNPaC3AWdQqNdaDgNlkx
+hoFU3oYqIuqj4ejc5rBd2N4a2+vJz3W8bokozDGC+iYf2mMRfUPKwj1XW9Er0OFs
+3UhBsEECgYEAto/iJB7ZlCM7EyV9JW0tsEt83rbKMQ/Ex0ShbBIejej0Xx7bwx60
+tVgay+bzJnNkXu6J4XVI98A/WsdI2kW4hL0STYdHV5HVA1l87V4ZbvTF2Bx8a8RJ
+OF3UjpMTWKqOprw9nAu5VuwNRVzORF8ER8rgGeaR2/gsSvIYFy9VXq8=
+-----END RSA PRIVATE KEY-----`
+
+var testClientPublicKey = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE6A1c4n+OtEPEFlNKTZf2i03L3NylSYmvmJ8OLmzLuPZmJBJt4G3VZ/60s1aKzwLKrTq20S+ONG4zvnK5zIPoauoNNdUJKbg944hB4OE+HDbrBhk7SH+YWCsCILBoSXwAVdUEic6FWf/SeqBSmTBySHvpuNOw16J+SK6Ardx8k64F2tRkZuC6AmOZijgKa/sQKjWAIVPk34ECM6OLfPc3kKUEfkdpYLvuMfuRMfSTlxn5lFC0b0SovK9aWfNMBH9iXLQkieQ5rXoyzUC7mwgnASgl8cqw1UrToiUuhvneduXBhbQfmC/Upv+tL6dSSk+0DlgVKEHuJmc8s8+/qpdL`
+
+func acceptUserPass(goodUser, goodPass string) func(ssh.ConnMetadata, []byte) (*ssh.Permissions, error) {
+	return func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
+		if c.User() == goodUser && string(pass) == goodPass {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("password rejected for %q", c.User())
+	}
+}
+
+func acceptPublicKey(keystr string) func(ssh.ConnMetadata, ssh.PublicKey) (*ssh.Permissions, error) {
+	goodkey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(keystr))
+	if err != nil {
+		panic(fmt.Errorf("error parsing key: %s", err))
+	}
+	return func(_ ssh.ConnMetadata, inkey ssh.PublicKey) (*ssh.Permissions, error) {
+		if bytes.Compare(inkey.Marshal(), goodkey.Marshal()) == 0 {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("public key rejected")
+	}
+}
diff --git a/communicator/ssh/provisioner.go b/communicator/ssh/provisioner.go
index 12d7048e7..813db5728 100644
--- a/communicator/ssh/provisioner.go
+++ b/communicator/ssh/provisioner.go
@@ -44,6 +44,12 @@ type connectionInfo struct {
 	Timeout    string
 	ScriptPath string        `mapstructure:"script_path"`
 	TimeoutVal time.Duration `mapstructure:"-"`
+
+	BastionUser     string `mapstructure:"bastion_user"`
+	BastionPassword string `mapstructure:"bastion_password"`
+	BastionKeyFile  string `mapstructure:"bastion_key_file"`
+	BastionHost     string `mapstructure:"bastion_host"`
+	BastionPort     int    `mapstructure:"bastion_port"`
 }
 
 // parseConnectionInfo is used to convert the ConnInfo of the InstanceState into
@@ -62,6 +68,15 @@ func parseConnectionInfo(s *terraform.InstanceState) (*connectionInfo, error) {
 		return nil, err
 	}
 
+	// To default Agent to true, we need to check the raw string, since the
+	// decoded boolean can't represent "absence of config".
+	//
+	// And if SSH_AUTH_SOCK is not set, there's no agent to connect to, so we
+	// shouldn't try.
+	if s.Ephemeral.ConnInfo["agent"] == "" && os.Getenv("SSH_AUTH_SOCK") != "" {
+		connInfo.Agent = true
+	}
+
 	if connInfo.User == "" {
 		connInfo.User = DefaultUser
 	}
@@ -77,6 +92,22 @@ func parseConnectionInfo(s *terraform.InstanceState) (*connectionInfo, error) {
 		connInfo.TimeoutVal = DefaultTimeout
 	}
 
+	// Default all bastion config attrs to their non-bastion counterparts
+	if connInfo.BastionHost != "" {
+		if connInfo.BastionUser == "" {
+			connInfo.BastionUser = connInfo.User
+		}
+		if connInfo.BastionPassword == "" {
+			connInfo.BastionPassword = connInfo.Password
+		}
+		if connInfo.BastionKeyFile == "" {
+			connInfo.BastionKeyFile = connInfo.KeyFile
+		}
+		if connInfo.BastionPort == 0 {
+			connInfo.BastionPort = connInfo.Port
+		}
+	}
+
 	return connInfo, nil
 }
 
@@ -93,73 +124,152 @@ func safeDuration(dur string, defaultDur time.Duration) time.Duration {
 // prepareSSHConfig is used to turn the *ConnectionInfo provided into a
 // usable *SSHConfig for client initialization.
 func prepareSSHConfig(connInfo *connectionInfo) (*sshConfig, error) {
-	var conn net.Conn
-	var err error
-
-	sshConf := &ssh.ClientConfig{
-		User: connInfo.User,
+	sshAgent, err := connectToAgent(connInfo)
+	if err != nil {
+		return nil, err
 	}
-	if connInfo.Agent {
-		sshAuthSock := os.Getenv("SSH_AUTH_SOCK")
 
-		if sshAuthSock == "" {
-			return nil, fmt.Errorf("SSH Requested but SSH_AUTH_SOCK not-specified")
-		}
-
-		conn, err = net.Dial("unix", sshAuthSock)
-		if err != nil {
-			return nil, fmt.Errorf("Error connecting to SSH_AUTH_SOCK: %v", err)
-		}
-		// I need to close this but, later after all connections have been made
-		// defer conn.Close()
-		signers, err := agent.NewClient(conn).Signers()
-		if err != nil {
-			return nil, fmt.Errorf("Error getting keys from ssh agent: %v", err)
-		}
-
-		sshConf.Auth = append(sshConf.Auth, ssh.PublicKeys(signers...))
+	sshConf, err := buildSSHClientConfig(sshClientConfigOpts{
+		user:     connInfo.User,
+		keyFile:  connInfo.KeyFile,
+		password: connInfo.Password,
+		sshAgent: sshAgent,
+	})
+	if err != nil {
+		return nil, err
 	}
-	if connInfo.KeyFile != "" {
-		fullPath, err := homedir.Expand(connInfo.KeyFile)
-		if err != nil {
-			return nil, fmt.Errorf("Failed to expand home directory: %v", err)
-		}
-		key, err := ioutil.ReadFile(fullPath)
-		if err != nil {
-			return nil, fmt.Errorf("Failed to read key file '%s': %v", connInfo.KeyFile, err)
-		}
 
-		// We parse the private key on our own first so that we can
-		// show a nicer error if the private key has a password.
-		block, _ := pem.Decode(key)
-		if block == nil {
-			return nil, fmt.Errorf(
-				"Failed to read key '%s': no key found", connInfo.KeyFile)
-		}
-		if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
-			return nil, fmt.Errorf(
-				"Failed to read key '%s': password protected keys are\n"+
-					"not supported. Please decrypt the key prior to use.", connInfo.KeyFile)
-		}
-
-		signer, err := ssh.ParsePrivateKey(key)
+	var bastionConf *ssh.ClientConfig
+	if connInfo.BastionHost != "" {
+		bastionConf, err = buildSSHClientConfig(sshClientConfigOpts{
+			user:     connInfo.BastionUser,
+			keyFile:  connInfo.BastionKeyFile,
+			password: connInfo.BastionPassword,
+			sshAgent: sshAgent,
+		})
 		if err != nil {
-			return nil, fmt.Errorf("Failed to parse key file '%s': %v", connInfo.KeyFile, err)
+			return nil, err
 		}
-
-		sshConf.Auth = append(sshConf.Auth, ssh.PublicKeys(signer))
-	}
-	if connInfo.Password != "" {
-		sshConf.Auth = append(sshConf.Auth,
-			ssh.Password(connInfo.Password))
-		sshConf.Auth = append(sshConf.Auth,
-			ssh.KeyboardInteractive(PasswordKeyboardInteractive(connInfo.Password)))
 	}
+
 	host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port)
+	connectFunc := ConnectFunc("tcp", host)
+
+	if bastionConf != nil {
+		bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort)
+		connectFunc = BastionConnectFunc("tcp", bastionHost, bastionConf, "tcp", host)
+	}
+
 	config := &sshConfig{
-		config:       sshConf,
-		connection:   ConnectFunc("tcp", host),
-		sshAgentConn: conn,
+		config:     sshConf,
+		connection: connectFunc,
+		sshAgent:   sshAgent,
 	}
 	return config, nil
 }
+
+type sshClientConfigOpts struct {
+	keyFile  string
+	password string
+	sshAgent *sshAgent
+	user     string
+}
+
+func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {
+	conf := &ssh.ClientConfig{
+		User: opts.user,
+	}
+
+	if opts.keyFile != "" {
+		pubKeyAuth, err := readPublicKeyFromPath(opts.keyFile)
+		if err != nil {
+			return nil, err
+		}
+		conf.Auth = append(conf.Auth, pubKeyAuth)
+	}
+
+	if opts.password != "" {
+		conf.Auth = append(conf.Auth, ssh.Password(opts.password))
+		conf.Auth = append(conf.Auth, ssh.KeyboardInteractive(
+			PasswordKeyboardInteractive(opts.password)))
+	}
+
+	if opts.sshAgent != nil {
+		conf.Auth = append(conf.Auth, opts.sshAgent.Auth())
+	}
+
+	return conf, nil
+}
+
+func readPublicKeyFromPath(path string) (ssh.AuthMethod, error) {
+	fullPath, err := homedir.Expand(path)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to expand home directory: %s", err)
+	}
+	key, err := ioutil.ReadFile(fullPath)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to read key file %q: %s", path, err)
+	}
+
+	// We parse the private key on our own first so that we can
+	// show a nicer error if the private key has a password.
+	block, _ := pem.Decode(key)
+	if block == nil {
+		return nil, fmt.Errorf("Failed to read key %q: no key found", path)
+	}
+	if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+		return nil, fmt.Errorf(
+			"Failed to read key %q: password protected keys are\n"+
+				"not supported. Please decrypt the key prior to use.", path)
+	}
+
+	signer, err := ssh.ParsePrivateKey(key)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to parse key file %q: %s", path, err)
+	}
+
+	return ssh.PublicKeys(signer), nil
+}
+
+func connectToAgent(connInfo *connectionInfo) (*sshAgent, error) {
+	if connInfo.Agent != true {
+		// No agent configured
+		return nil, nil
+	}
+
+	sshAuthSock := os.Getenv("SSH_AUTH_SOCK")
+
+	if sshAuthSock == "" {
+		return nil, fmt.Errorf("SSH Requested but SSH_AUTH_SOCK not-specified")
+	}
+
+	conn, err := net.Dial("unix", sshAuthSock)
+	if err != nil {
+		return nil, fmt.Errorf("Error connecting to SSH_AUTH_SOCK: %v", err)
+	}
+
+	// connection close is handled over in Communicator
+	return &sshAgent{
+		agent: agent.NewClient(conn),
+		conn:  conn,
+	}, nil
+}
+
+// A tiny wrapper around an agent.Agent to expose the ability to close its
+// associated connection on request.
+type sshAgent struct {
+	agent agent.Agent
+	conn  net.Conn
+}
+
+func (a *sshAgent) Close() error {
+	return a.conn.Close()
+}
+
+func (a *sshAgent) Auth() ssh.AuthMethod {
+	return ssh.PublicKeysCallback(a.agent.Signers)
+}
+
+func (a *sshAgent) ForwardToAgent(client *ssh.Client) error {
+	return agent.ForwardToAgent(client, a.agent)
+}
diff --git a/communicator/ssh/provisioner_test.go b/communicator/ssh/provisioner_test.go
index 33c2b7b7b..fc6b686fb 100644
--- a/communicator/ssh/provisioner_test.go
+++ b/communicator/ssh/provisioner_test.go
@@ -17,6 +17,8 @@ func TestProvisioner_connInfo(t *testing.T) {
 				"host":     "127.0.0.1",
 				"port":     "22",
 				"timeout":  "30s",
+
+				"bastion_host": "127.0.1.1",
 			},
 		},
 	}
@@ -47,4 +49,19 @@ func TestProvisioner_connInfo(t *testing.T) {
 	if conf.ScriptPath != DefaultScriptPath {
 		t.Fatalf("bad: %v", conf)
 	}
+	if conf.BastionHost != "127.0.1.1" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionPort != 22 {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionUser != "root" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionPassword != "supersecret" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionKeyFile != "/my/key/file.pem" {
+		t.Fatalf("bad: %v", conf)
+	}
 }
diff --git a/communicator/winrm/communicator.go b/communicator/winrm/communicator.go
index ad1d1d30e..27ba31a83 100644
--- a/communicator/winrm/communicator.go
+++ b/communicator/winrm/communicator.go
@@ -125,8 +125,6 @@ func (c *Communicator) ScriptPath() string {
 
 // Start implementation of communicator.Communicator interface
 func (c *Communicator) Start(rc *remote.Cmd) error {
-	log.Printf("starting remote command: %s", rc.Command)
-
 	err := c.Connect(nil)
 	if err != nil {
 		return err
@@ -137,6 +135,7 @@ func (c *Communicator) Start(rc *remote.Cmd) error {
 		return err
 	}
 
+	log.Printf("starting remote command: %s", rc.Command)
 	cmd, err := shell.Execute(rc.Command)
 	if err != nil {
 		return err
@@ -162,6 +161,7 @@ func (c *Communicator) Upload(path string, input io.Reader) error {
 	if err != nil {
 		return err
 	}
+	log.Printf("Uploading file to '%s'", path)
 	return wcp.Write(path, input)
 }
 
@@ -172,7 +172,7 @@ func (c *Communicator) UploadScript(path string, input io.Reader) error {
 
 // UploadDir implementation of communicator.Communicator interface
 func (c *Communicator) UploadDir(dst string, src string) error {
-	log.Printf("Upload dir '%s' to '%s'", src, dst)
+	log.Printf("Uploading dir '%s' to '%s'", src, dst)
 	wcp, err := c.newCopyClient()
 	if err != nil {
 		return err
diff --git a/config/config.go b/config/config.go
index c085e1f26..811b77ec7 100644
--- a/config/config.go
+++ b/config/config.go
@@ -84,8 +84,8 @@ type Resource struct {
 // ResourceLifecycle is used to store the lifecycle tuning parameters
 // to allow customized behavior
 type ResourceLifecycle struct {
-	CreateBeforeDestroy bool `hcl:"create_before_destroy"`
-	PreventDestroy      bool `hcl:"prevent_destroy"`
+	CreateBeforeDestroy bool `mapstructure:"create_before_destroy"`
+	PreventDestroy      bool `mapstructure:"prevent_destroy"`
 }
 
 // Provisioner is a configured provisioner step on a resource.
@@ -683,6 +683,10 @@ func (o *Output) mergerMerge(m merger) merger {
 	return &result
 }
 
+func (c *ProviderConfig) GoString() string {
+	return fmt.Sprintf("*%#v", *c)
+}
+
 func (c *ProviderConfig) FullName() string {
 	if c.Alias == "" {
 		return c.Name
diff --git a/config/config_test.go b/config/config_test.go
index 88dbdc6c5..2c9791877 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -450,7 +450,7 @@ func TestVariableDefaultsMap(t *testing.T) {
 }
 
 func testConfig(t *testing.T, name string) *Config {
-	c, err := Load(filepath.Join(fixtureDir, name, "main.tf"))
+	c, err := LoadFile(filepath.Join(fixtureDir, name, "main.tf"))
 	if err != nil {
 		t.Fatalf("file: %s\n\nerr: %s", name, err)
 	}
diff --git a/config/import_tree.go b/config/import_tree.go
index 829046c49..37ec11a15 100644
--- a/config/import_tree.go
+++ b/config/import_tree.go
@@ -33,9 +33,7 @@ type fileLoaderFunc func(path string) (configurable, []string, error)
 func loadTree(root string) (*importTree, error) {
 	var f fileLoaderFunc
 	switch ext(root) {
-	case ".tf":
-		fallthrough
-	case ".tf.json":
+	case ".tf", ".tf.json":
 		f = loadFileHcl
 	default:
 	}
diff --git a/config/interpolate_funcs.go b/config/interpolate_funcs.go
index af1d2b0a4..9b26c24ff 100644
--- a/config/interpolate_funcs.go
+++ b/config/interpolate_funcs.go
@@ -2,9 +2,11 @@ package config
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 
@@ -17,17 +19,15 @@ var Funcs map[string]ast.Function
 
 func init() {
 	Funcs = map[string]ast.Function{
-		"file":    interpolationFuncFile(),
-		"format":  interpolationFuncFormat(),
-		"join":    interpolationFuncJoin(),
-		"element": interpolationFuncElement(),
-		"replace": interpolationFuncReplace(),
-		"split":   interpolationFuncSplit(),
-		"length":  interpolationFuncLength(),
-
-		// Concat is a little useless now since we supported embeddded
-		// interpolations but we keep it around for backwards compat reasons.
-		"concat": interpolationFuncConcat(),
+		"concat":     interpolationFuncConcat(),
+		"element":    interpolationFuncElement(),
+		"file":       interpolationFuncFile(),
+		"format":     interpolationFuncFormat(),
+		"formatlist": interpolationFuncFormatList(),
+		"join":       interpolationFuncJoin(),
+		"length":     interpolationFuncLength(),
+		"replace":    interpolationFuncReplace(),
+		"split":      interpolationFuncSplit(),
 	}
 }
 
@@ -43,11 +43,33 @@ func interpolationFuncConcat() ast.Function {
 		VariadicType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
 			var b bytes.Buffer
-			for _, v := range args {
-				b.WriteString(v.(string))
+			var finalList []string
+
+			var isDeprecated = true
+
+			for _, arg := range args {
+				argument := arg.(string)
+
+				if len(argument) == 0 {
+					continue
+				}
+
+				if IsStringList(argument) {
+					isDeprecated = false
+					finalList = append(finalList, StringList(argument).Slice()...)
+				} else {
+					finalList = append(finalList, argument)
+				}
+
+				// Deprecated concat behaviour
+				b.WriteString(argument)
 			}
 
-			return b.String(), nil
+			if isDeprecated {
+				return b.String(), nil
+			}
+
+			return NewStringList(finalList).String(), nil
 		},
 	}
 }
@@ -73,8 +95,8 @@ func interpolationFuncFile() ast.Function {
 	}
 }
 
-// interpolationFuncFormat implements the "replace" function that does
-// string replacement.
+// interpolationFuncFormat implements the "format" function that does
+// string formatting.
 func interpolationFuncFormat() ast.Function {
 	return ast.Function{
 		ArgTypes:     []ast.Type{ast.TypeString},
@@ -88,6 +110,74 @@ func interpolationFuncFormat() ast.Function {
 	}
 }
 
+// interpolationFuncFormatList implements the "formatlist" function that does
+// string formatting on lists.
+func interpolationFuncFormatList() ast.Function {
+	return ast.Function{
+		ArgTypes:     []ast.Type{ast.TypeString},
+		Variadic:     true,
+		VariadicType: ast.TypeAny,
+		ReturnType:   ast.TypeString,
+		Callback: func(args []interface{}) (interface{}, error) {
+			// Make a copy of the variadic part of args
+			// to avoid modifying the original.
+			varargs := make([]interface{}, len(args)-1)
+			copy(varargs, args[1:])
+
+			// Convert arguments that are lists into slices.
+			// Confirm along the way that all lists have the same length (n).
+			var n int
+			for i := 1; i < len(args); i++ {
+				s, ok := args[i].(string)
+				if !ok {
+					continue
+				}
+				if !IsStringList(s) {
+					continue
+				}
+
+				parts := StringList(s).Slice()
+
+				// otherwise the list is sent down to be indexed
+				varargs[i-1] = parts
+
+				// Check length
+				if n == 0 {
+					// first list we've seen
+					n = len(parts)
+					continue
+				}
+				if n != len(parts) {
+					return nil, fmt.Errorf("format: mismatched list lengths: %d != %d", n, len(parts))
+				}
+			}
+
+			if n == 0 {
+				return nil, errors.New("no lists in arguments to formatlist")
+			}
+
+			// Do the formatting.
+			format := args[0].(string)
+
+			// Generate a list of formatted strings.
+			list := make([]string, n)
+			fmtargs := make([]interface{}, len(varargs))
+			for i := 0; i < n; i++ {
+				for j, arg := range varargs {
+					switch arg := arg.(type) {
+					default:
+						fmtargs[j] = arg
+					case []string:
+						fmtargs[j] = arg[i]
+					}
+				}
+				list[i] = fmt.Sprintf(format, fmtargs...)
+			}
+			return NewStringList(list).String(), nil
+		},
+	}
+}
+
 // interpolationFuncJoin implements the "join" function that allows
 // multi-variable values to be joined by some character.
 func interpolationFuncJoin() ast.Function {
@@ -97,7 +187,7 @@ func interpolationFuncJoin() ast.Function {
 		Callback: func(args []interface{}) (interface{}, error) {
 			var list []string
 			for _, arg := range args[1:] {
-				parts := strings.Split(arg.(string), InterpSplitDelim)
+				parts := StringList(arg.(string)).Slice()
 				list = append(list, parts...)
 			}
 
@@ -139,18 +229,15 @@ func interpolationFuncLength() ast.Function {
 		ReturnType: ast.TypeInt,
 		Variadic:   false,
 		Callback: func(args []interface{}) (interface{}, error) {
-			if !strings.Contains(args[0].(string), InterpSplitDelim) {
+			if !IsStringList(args[0].(string)) {
 				return len(args[0].(string)), nil
 			}
 
-			var list []string
+			length := 0
 			for _, arg := range args {
-				parts := strings.Split(arg.(string), InterpSplitDelim)
-				for _, part := range parts {
-					list = append(list, part)
-				}
+				length += StringList(arg.(string)).Length()
 			}
-			return len(list), nil
+			return length, nil
 		},
 	}
 }
@@ -162,7 +249,9 @@ func interpolationFuncSplit() ast.Function {
 		ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
 		ReturnType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
-			return strings.Replace(args[1].(string), args[0].(string), InterpSplitDelim, -1), nil
+			sep := args[0].(string)
+			s := args[1].(string)
+			return NewStringList(strings.Split(s, sep)).String(), nil
 		},
 	}
 }
@@ -200,7 +289,7 @@ func interpolationFuncElement() ast.Function {
 		ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
 		ReturnType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
-			list := strings.Split(args[0].(string), InterpSplitDelim)
+			list := StringList(args[0].(string))
 
 			index, err := strconv.Atoi(args[1].(string))
 			if err != nil {
@@ -208,8 +297,78 @@ func interpolationFuncElement() ast.Function {
 					"invalid number for index, got %s", args[1])
 			}
 
-			v := list[index%len(list)]
+			v := list.Element(index)
 			return v, nil
 		},
 	}
 }
+
+// interpolationFuncKeys implements the "keys" function that yields a list of
+// keys of map types within a Terraform configuration.
+func interpolationFuncKeys(vs map[string]ast.Variable) ast.Function {
+	return ast.Function{
+		ArgTypes:   []ast.Type{ast.TypeString},
+		ReturnType: ast.TypeString,
+		Callback: func(args []interface{}) (interface{}, error) {
+			// Prefix must include ending dot to be a map
+			prefix := fmt.Sprintf("var.%s.", args[0].(string))
+			keys := make([]string, 0, len(vs))
+			for k, _ := range vs {
+				if !strings.HasPrefix(k, prefix) {
+					continue
+				}
+				keys = append(keys, k[len(prefix):])
+			}
+
+			if len(keys) <= 0 {
+				return "", fmt.Errorf(
+					"failed to find map '%s'",
+					args[0].(string))
+			}
+
+			sort.Strings(keys)
+
+			return NewStringList(keys).String(), nil
+		},
+	}
+}
+
+// interpolationFuncValues implements the "values" function that yields a list of
+// keys of map types within a Terraform configuration.
+func interpolationFuncValues(vs map[string]ast.Variable) ast.Function {
+	return ast.Function{
+		ArgTypes:   []ast.Type{ast.TypeString},
+		ReturnType: ast.TypeString,
+		Callback: func(args []interface{}) (interface{}, error) {
+			// Prefix must include ending dot to be a map
+			prefix := fmt.Sprintf("var.%s.", args[0].(string))
+			keys := make([]string, 0, len(vs))
+			for k, _ := range vs {
+				if !strings.HasPrefix(k, prefix) {
+					continue
+				}
+				keys = append(keys, k)
+			}
+
+			if len(keys) <= 0 {
+				return "", fmt.Errorf(
+					"failed to find map '%s'",
+					args[0].(string))
+			}
+
+			sort.Strings(keys)
+
+			vals := make([]string, 0, len(keys))
+
+			for _, k := range keys {
+				v := vs[k]
+				if v.Type != ast.TypeString {
+					return "", fmt.Errorf("values(): %q has bad type %s", k, v.Type)
+				}
+				vals = append(vals, vs[k].Value.(string))
+			}
+
+			return NewStringList(vals).String(), nil
+		},
+	}
+}
diff --git a/config/interpolate_funcs_test.go b/config/interpolate_funcs_test.go
index 044d4f843..3258bda5c 100644
--- a/config/interpolate_funcs_test.go
+++ b/config/interpolate_funcs_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/hashicorp/terraform/config/lang/ast"
 )
 
-func TestInterpolateFuncConcat(t *testing.T) {
+func TestInterpolateFuncDeprecatedConcat(t *testing.T) {
 	testFunction(t, testFunctionConfig{
 		Cases: []testFunctionCase{
 			{
@@ -35,6 +35,58 @@ func TestInterpolateFuncConcat(t *testing.T) {
 	})
 }
 
+func TestInterpolateFuncConcat(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Cases: []testFunctionCase{
+			// String + list
+			{
+				`${concat("a", split(",", "b,c"))}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// List + string
+			{
+				`${concat(split(",", "a,b"), "c")}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// Single list
+			{
+				`${concat(split(",", ",foo,"))}`,
+				NewStringList([]string{"", "foo", ""}).String(),
+				false,
+			},
+			{
+				`${concat(split(",", "a,b,c"))}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// Two lists
+			{
+				`${concat(split(",", "a,b,c"), split(",", "d,e"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e"}).String(),
+				false,
+			},
+			// Two lists with different separators
+			{
+				`${concat(split(",", "a,b,c"), split(" ", "d e"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e"}).String(),
+				false,
+			},
+
+			// More lists
+			{
+				`${concat(split(",", "a,b"), split(",", "c,d"), split(",", "e,f"), split(",", "0,1"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e", "f", "0", "1"}).String(),
+				false,
+			},
+		},
+	})
+}
+
 func TestInterpolateFuncFile(t *testing.T) {
 	tf, err := ioutil.TempFile("", "tf")
 	if err != nil {
@@ -106,6 +158,54 @@ func TestInterpolateFuncFormat(t *testing.T) {
 	})
 }
 
+func TestInterpolateFuncFormatList(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Cases: []testFunctionCase{
+			// formatlist requires at least one list
+			{
+				`${formatlist("hello")}`,
+				nil,
+				true,
+			},
+			{
+				`${formatlist("hello %s", "world")}`,
+				nil,
+				true,
+			},
+			// formatlist applies to each list element in turn
+			{
+				`${formatlist("<%s>", split(",", "A,B"))}`,
+				NewStringList([]string{"<A>", "<B>"}).String(),
+				false,
+			},
+			// formatlist repeats scalar elements
+			{
+				`${join(", ", formatlist("%s=%s", "x", split(",", "A,B,C")))}`,
+				"x=A, x=B, x=C",
+				false,
+			},
+			// Multiple lists are walked in parallel
+			{
+				`${join(", ", formatlist("%s=%s", split(",", "A,B,C"), split(",", "1,2,3")))}`,
+				"A=1, B=2, C=3",
+				false,
+			},
+			// Mismatched list lengths generate an error
+			{
+				`${formatlist("%s=%2s", split(",", "A,B,C,D"), split(",", "1,2,3"))}`,
+				nil,
+				true,
+			},
+			// Works with lists of length 1 [GH-2240]
+			{
+				`${formatlist("%s.id", split(",", "demo-rest-elb"))}`,
+				NewStringList([]string{"demo-rest-elb.id"}).String(),
+				false,
+			},
+		},
+	})
+}
+
 func TestInterpolateFuncJoin(t *testing.T) {
 	testFunction(t, testFunctionConfig{
 		Cases: []testFunctionCase{
@@ -116,7 +216,8 @@ func TestInterpolateFuncJoin(t *testing.T) {
 			},
 
 			{
-				`${join(",", "foo")}`,
+				fmt.Sprintf(`${join(",", "%s")}`,
+					NewStringList([]string{"foo"}).String()),
 				"foo",
 				false,
 			},
@@ -132,10 +233,7 @@ func TestInterpolateFuncJoin(t *testing.T) {
 
 			{
 				fmt.Sprintf(`${join(".", "%s")}`,
-					fmt.Sprintf(
-						"foo%sbar%sbaz",
-						InterpSplitDelim,
-						InterpSplitDelim)),
+					NewStringList([]string{"foo", "bar", "baz"}).String()),
 				"foo.bar.baz",
 				false,
 			},
@@ -252,47 +350,39 @@ func TestInterpolateFuncSplit(t *testing.T) {
 				true,
 			},
 
+			{
+				`${split(",", "")}`,
+				NewStringList([]string{""}).String(),
+				false,
+			},
+
 			{
 				`${split(",", "foo")}`,
-				"foo",
+				NewStringList([]string{"foo"}).String(),
 				false,
 			},
 
 			{
 				`${split(",", ",,,")}`,
-				fmt.Sprintf(
-					"%s%s%s",
-					InterpSplitDelim,
-					InterpSplitDelim,
-					InterpSplitDelim),
+				NewStringList([]string{"", "", "", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(",", "foo,")}`,
-				fmt.Sprintf(
-					"%s%s",
-					"foo",
-					InterpSplitDelim),
+				NewStringList([]string{"foo", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(",", ",foo,")}`,
-				fmt.Sprintf(
-					"%s%s%s",
-					InterpSplitDelim,
-					"foo",
-					InterpSplitDelim),
+				NewStringList([]string{"", "foo", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(".", "foo.bar.baz")}`,
-				fmt.Sprintf(
-					"foo%sbar%sbaz",
-					InterpSplitDelim,
-					InterpSplitDelim),
+				NewStringList([]string{"foo", "bar", "baz"}).String(),
 				false,
 			},
 		},
@@ -331,18 +421,113 @@ func TestInterpolateFuncLookup(t *testing.T) {
 	})
 }
 
+func TestInterpolateFuncKeys(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Vars: map[string]ast.Variable{
+			"var.foo.bar": ast.Variable{
+				Value: "baz",
+				Type:  ast.TypeString,
+			},
+			"var.foo.qux": ast.Variable{
+				Value: "quack",
+				Type:  ast.TypeString,
+			},
+			"var.str": ast.Variable{
+				Value: "astring",
+				Type:  ast.TypeString,
+			},
+		},
+		Cases: []testFunctionCase{
+			{
+				`${keys("foo")}`,
+				NewStringList([]string{"bar", "qux"}).String(),
+				false,
+			},
+
+			// Invalid key
+			{
+				`${keys("not")}`,
+				nil,
+				true,
+			},
+
+			// Too many args
+			{
+				`${keys("foo", "bar")}`,
+				nil,
+				true,
+			},
+
+			// Not a map
+			{
+				`${keys("str")}`,
+				nil,
+				true,
+			},
+		},
+	})
+}
+
+func TestInterpolateFuncValues(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Vars: map[string]ast.Variable{
+			"var.foo.bar": ast.Variable{
+				Value: "quack",
+				Type:  ast.TypeString,
+			},
+			"var.foo.qux": ast.Variable{
+				Value: "baz",
+				Type:  ast.TypeString,
+			},
+			"var.str": ast.Variable{
+				Value: "astring",
+				Type:  ast.TypeString,
+			},
+		},
+		Cases: []testFunctionCase{
+			{
+				`${values("foo")}`,
+				NewStringList([]string{"quack", "baz"}).String(),
+				false,
+			},
+
+			// Invalid key
+			{
+				`${values("not")}`,
+				nil,
+				true,
+			},
+
+			// Too many args
+			{
+				`${values("foo", "bar")}`,
+				nil,
+				true,
+			},
+
+			// Not a map
+			{
+				`${values("str")}`,
+				nil,
+				true,
+			},
+		},
+	})
+}
+
 func TestInterpolateFuncElement(t *testing.T) {
 	testFunction(t, testFunctionConfig{
 		Cases: []testFunctionCase{
 			{
 				fmt.Sprintf(`${element("%s", "1")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				"baz",
 				false,
 			},
 
 			{
-				`${element("foo", "0")}`,
+				fmt.Sprintf(`${element("%s", "0")}`,
+					NewStringList([]string{"foo"}).String()),
 				"foo",
 				false,
 			},
@@ -350,7 +535,7 @@ func TestInterpolateFuncElement(t *testing.T) {
 			// Invalid index should wrap vs. out-of-bounds
 			{
 				fmt.Sprintf(`${element("%s", "2")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				"foo",
 				false,
 			},
@@ -358,7 +543,7 @@ func TestInterpolateFuncElement(t *testing.T) {
 			// Too many args
 			{
 				fmt.Sprintf(`${element("%s", "0", "2")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				nil,
 				true,
 			},
@@ -381,12 +566,12 @@ func testFunction(t *testing.T, config testFunctionConfig) {
 	for i, tc := range config.Cases {
 		ast, err := lang.Parse(tc.Input)
 		if err != nil {
-			t.Fatalf("%d: err: %s", i, err)
+			t.Fatalf("Case #%d: input: %#v\nerr: %s", i, tc.Input, err)
 		}
 
 		out, _, err := lang.Eval(ast, langEvalConfig(config.Vars))
 		if (err != nil) != tc.Error {
-			t.Fatalf("%d: err: %s", i, err)
+			t.Fatalf("Case #%d:\ninput: %#v\nerr: %s", i, tc.Input, err)
 		}
 
 		if !reflect.DeepEqual(out, tc.Result) {
diff --git a/config/interpolate_walk.go b/config/interpolate_walk.go
index 17329e5a8..adcb5e32c 100644
--- a/config/interpolate_walk.go
+++ b/config/interpolate_walk.go
@@ -10,11 +10,6 @@ import (
 	"github.com/mitchellh/reflectwalk"
 )
 
-// InterpSplitDelim is the delimeter that is looked for to split when
-// it is returned. This is a comma right now but should eventually become
-// a value that a user is very unlikely to use (such as UUID).
-const InterpSplitDelim = `B780FFEC-B661-4EB8-9236-A01737AD98B6`
-
 // interpolationWalker implements interfaces for the reflectwalk package
 // (github.com/mitchellh/reflectwalk) that can be used to automatically
 // execute a callback for an interpolation.
@@ -149,8 +144,8 @@ func (w *interpolationWalker) Primitive(v reflect.Value) error {
 		// set if it is computed. This behavior is different if we're
 		// splitting (in a SliceElem) or not.
 		remove := false
-		if w.loc == reflectwalk.SliceElem {
-			parts := strings.Split(replaceVal, InterpSplitDelim)
+		if w.loc == reflectwalk.SliceElem && IsStringList(replaceVal) {
+			parts := StringList(replaceVal).Slice()
 			for _, p := range parts {
 				if p == UnknownVariableValue {
 					remove = true
@@ -248,7 +243,7 @@ func (w *interpolationWalker) splitSlice() {
 		if !ok {
 			continue
 		}
-		if idx := strings.Index(sv, InterpSplitDelim); idx >= 0 {
+		if IsStringList(sv) {
 			split = true
 			break
 		}
@@ -270,10 +265,15 @@ func (w *interpolationWalker) splitSlice() {
 			continue
 		}
 
-		// Split on the delimiter
-		for _, p := range strings.Split(sv, InterpSplitDelim) {
-			result = append(result, p)
+		if IsStringList(sv) {
+			for _, p := range StringList(sv).Slice() {
+				result = append(result, p)
+			}
+			continue
 		}
+
+		// Not a string list, so just set it
+		result = append(result, sv)
 	}
 
 	// Our slice is now done, we have to replace the slice now
diff --git a/config/interpolate_walk_test.go b/config/interpolate_walk_test.go
index 9b2c34133..fc7c8b549 100644
--- a/config/interpolate_walk_test.go
+++ b/config/interpolate_walk_test.go
@@ -157,7 +157,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 					"bing",
 				},
 			},
-			Value: "bar" + InterpSplitDelim + "baz",
+			Value: NewStringList([]string{"bar", "baz"}).String(),
 		},
 
 		{
@@ -168,7 +168,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 				},
 			},
 			Output: map[string]interface{}{},
-			Value:  UnknownVariableValue + InterpSplitDelim + "baz",
+			Value:  NewStringList([]string{UnknownVariableValue, "baz"}).String(),
 		},
 	}
 
@@ -183,7 +183,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 		}
 
 		if !reflect.DeepEqual(tc.Input, tc.Output) {
-			t.Fatalf("%d: bad:\n\n%#v", i, tc.Input)
+			t.Fatalf("%d: bad:\n\nexpected:%#v\ngot:%#v", i, tc.Output, tc.Input)
 		}
 	}
 }
diff --git a/config/lang/ast/call.go b/config/lang/ast/call.go
index ace1147a6..055701102 100644
--- a/config/lang/ast/call.go
+++ b/config/lang/ast/call.go
@@ -41,3 +41,7 @@ func (n *Call) Type(s Scope) (Type, error) {
 
 	return f.ReturnType, nil
 }
+
+func (n *Call) GoString() string {
+	return fmt.Sprintf("*%#v", *n)
+}
diff --git a/config/lang/lex.go b/config/lang/lex.go
index 6e70acfbc..0dbe16c9f 100644
--- a/config/lang/lex.go
+++ b/config/lang/lex.go
@@ -192,12 +192,20 @@ func (x *parserLex) lexModeInterpolation(yylval *parserSymType) int {
 
 func (x *parserLex) lexId(yylval *parserSymType) int {
 	var b bytes.Buffer
+	var last rune
 	for {
 		c := x.next()
 		if c == lexEOF {
 			break
 		}
 
+		// We only allow * after a '.' for resource splast: type.name.*.id
+		// Otherwise, its probably multiplication.
+		if c == '*' && last != '.' {
+			x.backup()
+			break
+		}
+
 		// If this isn't a character we want in an ID, return out.
 		// One day we should make this a regexp.
 		if c != '_' &&
@@ -214,6 +222,8 @@ func (x *parserLex) lexId(yylval *parserSymType) int {
 			x.Error(err.Error())
 			return lexEOF
 		}
+
+		last = c
 	}
 
 	yylval.token = &parserToken{Value: b.String()}
@@ -299,9 +309,7 @@ func (x *parserLex) lexString(yylval *parserSymType, quoted bool) (int, bool) {
 			// Let's check to see if we're escaping anything.
 			if c == '\\' {
 				switch n := x.next(); n {
-				case '\\':
-					fallthrough
-				case '"':
+				case '\\', '"':
 					c = n
 				case 'n':
 					c = '\n'
diff --git a/config/lang/parse_test.go b/config/lang/parse_test.go
index d2671e233..8d705dccb 100644
--- a/config/lang/parse_test.go
+++ b/config/lang/parse_test.go
@@ -183,6 +183,41 @@ func TestParse(t *testing.T) {
 			},
 		},
 
+		{
+			"foo ${var.bar*1} baz",
+			false,
+			&ast.Concat{
+				Posx: ast.Pos{Column: 1, Line: 1},
+				Exprs: []ast.Node{
+					&ast.LiteralNode{
+						Value: "foo ",
+						Typex: ast.TypeString,
+						Posx:  ast.Pos{Column: 1, Line: 1},
+					},
+					&ast.Arithmetic{
+						Op: ast.ArithmeticOpMul,
+						Exprs: []ast.Node{
+							&ast.VariableAccess{
+								Name: "var.bar",
+								Posx: ast.Pos{Column: 7, Line: 1},
+							},
+							&ast.LiteralNode{
+								Value: 1,
+								Typex: ast.TypeInt,
+								Posx:  ast.Pos{Column: 15, Line: 1},
+							},
+						},
+						Posx: ast.Pos{Column: 7, Line: 1},
+					},
+					&ast.LiteralNode{
+						Value: " baz",
+						Typex: ast.TypeString,
+						Posx:  ast.Pos{Column: 17, Line: 1},
+					},
+				},
+			},
+		},
+
 		{
 			"${foo()}",
 			false,
diff --git a/config/loader.go b/config/loader.go
index 1848f314d..4f5d8e765 100644
--- a/config/loader.go
+++ b/config/loader.go
@@ -1,19 +1,41 @@
 package config
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
+
+	"github.com/hashicorp/hcl"
 )
 
-// Load loads the Terraform configuration from a given file.
+// LoadJSON loads a single Terraform configuration from a given JSON document.
+//
+// The document must be a complete Terraform configuration. This function will
+// NOT try to load any additional modules so only the given document is loaded.
+func LoadJSON(raw json.RawMessage) (*Config, error) {
+	obj, err := hcl.Parse(string(raw))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"Error parsing JSON document as HCL: %s", err)
+	}
+
+	// Start building the result
+	hclConfig := &hclConfigurable{
+		Object: obj,
+	}
+
+	return hclConfig.Config()
+}
+
+// LoadFile loads the Terraform configuration from a given file.
 //
 // This file can be any format that Terraform recognizes, and import any
 // other format that Terraform recognizes.
-func Load(path string) (*Config, error) {
+func LoadFile(path string) (*Config, error) {
 	importTree, err := loadTree(path)
 	if err != nil {
 		return nil, err
@@ -66,7 +88,7 @@ func LoadDir(root string) (*Config, error) {
 
 	// Load all the regular files, append them to each other.
 	for _, f := range files {
-		c, err := Load(f)
+		c, err := LoadFile(f)
 		if err != nil {
 			return nil, err
 		}
@@ -83,7 +105,7 @@ func LoadDir(root string) (*Config, error) {
 
 	// Load all the overrides, and merge them into the config
 	for _, f := range overrides {
-		c, err := Load(f)
+		c, err := LoadFile(f)
 		if err != nil {
 			return nil, err
 		}
diff --git a/config/loader_hcl.go b/config/loader_hcl.go
index 6f4fa8edd..b20900bfb 100644
--- a/config/loader_hcl.go
+++ b/config/loader_hcl.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/hashicorp/hcl"
 	hclobj "github.com/hashicorp/hcl/hcl"
+	"github.com/mitchellh/mapstructure"
 )
 
 // hclConfigurable is an implementation of configurable that knows
@@ -521,8 +522,16 @@ func loadResourcesHcl(os *hclobj.Object) ([]*Resource, error) {
 			// destroying the existing instance
 			var lifecycle ResourceLifecycle
 			if o := obj.Get("lifecycle", false); o != nil {
-				err = hcl.DecodeObject(&lifecycle, o)
-				if err != nil {
+				var raw map[string]interface{}
+				if err = hcl.DecodeObject(&raw, o); err != nil {
+					return nil, fmt.Errorf(
+						"Error parsing lifecycle for %s[%s]: %s",
+						t.Key,
+						k,
+						err)
+				}
+
+				if err := mapstructure.WeakDecode(raw, &lifecycle); err != nil {
 					return nil, fmt.Errorf(
 						"Error parsing lifecycle for %s[%s]: %s",
 						t.Key,
diff --git a/config/loader_test.go b/config/loader_test.go
index d487638e9..d239bd0b9 100644
--- a/config/loader_test.go
+++ b/config/loader_test.go
@@ -1,6 +1,7 @@
 package config
 
 import (
+	"io/ioutil"
 	"path/filepath"
 	"reflect"
 	"strings"
@@ -37,15 +38,15 @@ func TestIsEmptyDir_noConfigs(t *testing.T) {
 	}
 }
 
-func TestLoad_badType(t *testing.T) {
-	_, err := Load(filepath.Join(fixtureDir, "bad_type.tf.nope"))
+func TestLoadFile_badType(t *testing.T) {
+	_, err := LoadFile(filepath.Join(fixtureDir, "bad_type.tf.nope"))
 	if err == nil {
 		t.Fatal("should have error")
 	}
 }
 
-func TestLoadBasic(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "basic.tf"))
+func TestLoadFileBasic(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "basic.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -84,8 +85,8 @@ func TestLoadBasic(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_empty(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "empty.tf"))
+func TestLoadFileBasic_empty(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "empty.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -95,11 +96,11 @@ func TestLoadBasic_empty(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_import(t *testing.T) {
+func TestLoadFileBasic_import(t *testing.T) {
 	// Skip because we disabled importing
 	t.Skip()
 
-	c, err := Load(filepath.Join(fixtureDir, "import.tf"))
+	c, err := LoadFile(filepath.Join(fixtureDir, "import.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -124,8 +125,8 @@ func TestLoadBasic_import(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_json(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "basic.tf.json"))
+func TestLoadFileBasic_json(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "basic.tf.json"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -164,8 +165,8 @@ func TestLoadBasic_json(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_modules(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "modules.tf"))
+func TestLoadFileBasic_modules(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "modules.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -184,8 +185,53 @@ func TestLoadBasic_modules(t *testing.T) {
 	}
 }
 
-func TestLoad_variables(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "variables.tf"))
+func TestLoadJSONBasic(t *testing.T) {
+	raw, err := ioutil.ReadFile(filepath.Join(fixtureDir, "basic.tf.json"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	c, err := LoadJSON(raw)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if c == nil {
+		t.Fatal("config should not be nil")
+	}
+
+	if c.Dir != "" {
+		t.Fatalf("bad: %#v", c.Dir)
+	}
+
+	expectedAtlas := &AtlasConfig{Name: "mitchellh/foo"}
+	if !reflect.DeepEqual(c.Atlas, expectedAtlas) {
+		t.Fatalf("bad: %#v", c.Atlas)
+	}
+
+	actual := variablesStr(c.Variables)
+	if actual != strings.TrimSpace(basicVariablesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = providerConfigsStr(c.ProviderConfigs)
+	if actual != strings.TrimSpace(basicProvidersStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = resourcesStr(c.Resources)
+	if actual != strings.TrimSpace(basicResourcesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = outputsStr(c.Outputs)
+	if actual != strings.TrimSpace(basicOutputsStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestLoadFile_variables(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "variables.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -303,8 +349,8 @@ func TestLoadDir_override(t *testing.T) {
 	}
 }
 
-func TestLoad_provisioners(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "provisioners.tf"))
+func TestLoadFile_provisioners(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "provisioners.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -319,8 +365,8 @@ func TestLoad_provisioners(t *testing.T) {
 	}
 }
 
-func TestLoad_connections(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "connection.tf"))
+func TestLoadFile_connections(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "connection.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -357,8 +403,8 @@ func TestLoad_connections(t *testing.T) {
 	}
 }
 
-func TestLoad_createBeforeDestroy(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "create-before-destroy.tf"))
+func TestLoadFile_createBeforeDestroy(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "create-before-destroy.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -394,6 +440,43 @@ func TestLoad_createBeforeDestroy(t *testing.T) {
 	}
 }
 
+func TestLoad_preventDestroyString(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "prevent-destroy-string.tf"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if c == nil {
+		t.Fatal("config should not be nil")
+	}
+
+	actual := resourcesStr(c.Resources)
+	if actual != strings.TrimSpace(createBeforeDestroyResourcesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	// Check for the flag value
+	r := c.Resources[0]
+	if r.Name != "web" && r.Type != "aws_instance" {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	// Should enable create before destroy
+	if !r.Lifecycle.PreventDestroy {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	r = c.Resources[1]
+	if r.Name != "bar" && r.Type != "aws_instance" {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	// Should not enable create before destroy
+	if r.Lifecycle.PreventDestroy {
+		t.Fatalf("Bad: %#v", r)
+	}
+}
+
 func TestLoad_temporary_files(t *testing.T) {
 	_, err := LoadDir(filepath.Join(fixtureDir, "dir-temporary-files"))
 	if err == nil {
diff --git a/config/raw_config.go b/config/raw_config.go
index d51578e0b..ebb9f18dc 100644
--- a/config/raw_config.go
+++ b/config/raw_config.go
@@ -304,6 +304,8 @@ func langEvalConfig(vs map[string]ast.Variable) *lang.EvalConfig {
 		funcMap[k] = v
 	}
 	funcMap["lookup"] = interpolationFuncLookup(vs)
+	funcMap["keys"] = interpolationFuncKeys(vs)
+	funcMap["values"] = interpolationFuncValues(vs)
 
 	return &lang.EvalConfig{
 		GlobalScope: &ast.BasicScope{
diff --git a/config/string_list.go b/config/string_list.go
new file mode 100644
index 000000000..70d43d1e4
--- /dev/null
+++ b/config/string_list.go
@@ -0,0 +1,76 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+// StringList represents the "poor man's list" that terraform uses
+// internally
+type StringList string
+
+// This is the delimiter used to recognize and split StringLists
+//
+// It plays two semantic roles:
+//   * It introduces a list
+//   * It terminates each element
+//
+// Example representations:
+// []             => SLD
+// [""]           => SLDSLD
+// [" "]          => SLD SLD
+// ["foo"]        => SLDfooSLD
+// ["foo", "bar"] => SLDfooSLDbarSLD
+// ["", ""]       => SLDSLDSLD
+const stringListDelim = `B780FFEC-B661-4EB8-9236-A01737AD98B6`
+
+// Build a StringList from a slice
+func NewStringList(parts []string) StringList {
+	// We have to special case the empty list representation
+	if len(parts) == 0 {
+		return StringList(stringListDelim)
+	}
+	return StringList(fmt.Sprintf("%s%s%s",
+		stringListDelim,
+		strings.Join(parts, stringListDelim),
+		stringListDelim,
+	))
+}
+
+// Returns an element at the index, wrapping around the length of the string
+// when index > list length
+func (sl StringList) Element(index int) string {
+	if sl.Length() == 0 {
+		return ""
+	}
+	return sl.Slice()[index%sl.Length()]
+}
+
+// Returns the length of the StringList
+func (sl StringList) Length() int {
+	return len(sl.Slice())
+}
+
+// Returns a slice of strings as represented by this StringList
+func (sl StringList) Slice() []string {
+	parts := strings.Split(string(sl), stringListDelim)
+
+	switch len(parts) {
+	case 0, 1:
+		return []string{}
+	case 2:
+		return []string{""}
+	}
+
+	// strip empty elements generated by leading and trailing delimiters
+	return parts[1 : len(parts)-1]
+}
+
+func (sl StringList) String() string {
+	return string(sl)
+}
+
+// Determines if a given string represents a StringList
+func IsStringList(s string) bool {
+	return strings.Contains(s, stringListDelim)
+}
diff --git a/config/test-fixtures/prevent-destroy-string.tf b/config/test-fixtures/prevent-destroy-string.tf
new file mode 100644
index 000000000..c5e253a14
--- /dev/null
+++ b/config/test-fixtures/prevent-destroy-string.tf
@@ -0,0 +1,10 @@
+resource "aws_instance" "web" {
+    ami = "foo"
+    lifecycle {
+        prevent_destroy = "true"
+    }
+}
+
+resource "aws_instance" "bar" {
+    ami = "foo"
+}
diff --git a/contrib/zsh-completion/_terraform b/contrib/zsh-completion/_terraform
index 0b3fa55b0..1252bb961 100644
--- a/contrib/zsh-completion/_terraform
+++ b/contrib/zsh-completion/_terraform
@@ -13,7 +13,7 @@ _terraform_cmds=(
     'push:Uploads the local state to the remote server'
     'refresh:Update local state file against real resources'
     'remote:Configures remote state management'
-    'taint:Manualy forcing a destroy and recreate on the next plan/apply'
+    'taint:Manually forcing a destroy and recreate on the next plan/apply'
     'show:Inspect Terraform state or plan'
     'version:Prints the Terraform version'
 )
@@ -82,7 +82,7 @@ __plan() {
 
 __push() {
     _arguments \
-        '-force[Forces the upload of the local state, ignoring any conflits. This should be used carefully, as force pushing can cause remote state information to be lost.]'
+        '-force[Forces the upload of the local state, ignoring any conflicts. This should be used carefully, as force pushing can cause remote state information to be lost.]'
 }
 
 __refresh() {
diff --git a/deps/v0-5-3.json b/deps/v0-5-3.json
new file mode 100644
index 000000000..09fe5c60f
--- /dev/null
+++ b/deps/v0-5-3.json
@@ -0,0 +1,301 @@
+{
+	"ImportPath": "github.com/hashicorp/terraform",
+	"GoVersion": "go1.4.2",
+	"Deps": [
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/aws",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/apierr",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/endpoints",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/query",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/rest",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/restxml",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/xml/xmlutil",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/signer/v4",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/service/s3",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/archive",
+			"Comment": "20141209094003-60-g6a87d5f",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/v1",
+			"Comment": "20141209094003-60-g6a87d5f",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/consul/api",
+			"Comment": "v0.5.2-33-g0aea1f0",
+			"Rev": "0aea1f06a1662dd392d3c8e8240cb4cc662e2e65"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/errwrap",
+			"Rev": "7554cd9344cec97297fa6649b055a8c98c2a1e55"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-checkpoint",
+			"Rev": "88326f6851319068e7b34981032128c0b1a6524d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-multierror",
+			"Rev": "fcdddc395df1ddf4247c69bd436e84cfa0733f7e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-version",
+			"Rev": "999359b6b7a041ce16e695d51e92145b83f01087"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/hcl",
+			"Rev": "513e04c400ee2e81e97f5e011c08fb42c6f69b84"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/yamux",
+			"Rev": "b2e55852ddaf823a85c67f798080eb7d08acd71d"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/cli",
+			"Rev": "76e2780bc4f71797e1ce037ac0b43b7c99b31749"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/colorstring",
+			"Rev": "61164e49940b423ba1f12ddbdf01632ac793e5e9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/copystructure",
+			"Rev": "6fc66267e9da7d155a9d3bd489e00dad02666dc6"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-homedir",
+			"Rev": "1f6da4a72e57d4e7edd4a7295a585e0a3999a2d4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "bb4fbaf540ca2f7057d3adb5765784d24d9fd801"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/panicwrap",
+			"Rev": "45cbfd3bae250c7676c077fb275be1a2968e066a"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/prefixedio",
+			"Rev": "89d9b535996bf0a185f85b59578f2e245f9e1724"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/reflectwalk",
+			"Rev": "eecf4c70c626c7cfbb95c90195bc34d386c74ac6"
+		},
+		{
+			"ImportPath": "github.com/vaughan0/go-ini",
+			"Rev": "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/ssh/terminal",
+			"Rev": "c10c31b5e94b6f7a0283272dc2bb27163dcea24b"
+		},
+		{
+			"ImportPath": "github.com/Sirupsen/logrus",
+			"Rev": "52919f182f9c314f8a38c5afe96506f73d02b4b2"
+		},
+		{
+			"ImportPath": "github.com/armon/circbuf",
+			"Rev": "f092b4f207b6e5cce0569056fba9e1a2735cb6cf"
+		},
+		{
+			"ImportPath": "github.com/cyberdelia/heroku-go",
+			"Rev": "594d483b9b6a8ddc7cd2f1e3e7d1de92fa2de665"
+		},
+		{
+			"ImportPath": "github.com/docker/docker",
+			"Rev": "42cfc95549728014811cc9aa2c5b07bdf5553a54"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/iso8601",
+			"Rev": "2075bf119b58e5576c6ed9f867b8f3d17f2e54d4"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/winrmtest",
+			"Rev": "3e9661c52c45dab9a8528966a23d421922fca9b9"
+		},
+		{
+			"ImportPath": "github.com/fsouza/go-dockerclient",
+			"Rev": "f90594a4da6a7cbdaedd29ee5495ddd6b39fe5d3"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/aws-sdk-go",
+			"Rev": "e6ea0192eee4640f32ec73c0cbb71f63e4f2b65a"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/consul",
+			"Rev": "9417fd37686241d65918208874a7faa4d0cd92d2"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/errwrap",
+			"Rev": "7554cd9344cec97297fa6649b055a8c98c2a1e55"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-checkpoint",
+			"Rev": "88326f6851319068e7b34981032128c0b1a6524d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-multierror",
+			"Rev": "fcdddc395df1ddf4247c69bd436e84cfa0733f7e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-version",
+			"Rev": "999359b6b7a041ce16e695d51e92145b83f01087"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/hcl",
+			"Rev": "513e04c400ee2e81e97f5e011c08fb42c6f69b84"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/yamux",
+			"Rev": "b2e55852ddaf823a85c67f798080eb7d08acd71d"
+		},
+		{
+			"ImportPath": "github.com/imdario/mergo",
+			"Rev": "2fcac9923693d66dc0e03988a31b21da05cdea84"
+		},
+		{
+			"ImportPath": "github.com/masterzen/simplexml",
+			"Rev": "95ba30457eb1121fa27753627c774c7cd4e90083"
+		},
+		{
+			"ImportPath": "github.com/masterzen/winrm",
+			"Rev": "132339029dfa67fd39ff8edeed2af78f2cca4fbb"
+		},
+		{
+			"ImportPath": "github.com/masterzen/xmlpath",
+			"Rev": "13f4951698adc0fa9c1dda3e275d489a24201161"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/cli",
+			"Rev": "6cc8bc522243675a2882b81662b0b0d2e04b99c9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/colorstring",
+			"Rev": "61164e49940b423ba1f12ddbdf01632ac793e5e9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/copystructure",
+			"Rev": "6fc66267e9da7d155a9d3bd489e00dad02666dc6"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-homedir",
+			"Rev": "1f6da4a72e57d4e7edd4a7295a585e0a3999a2d4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/gox",
+			"Rev": "e8e6fd4fe12510cc46893dff18c5188a6a6dc549"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/iochan",
+			"Rev": "b584a329b193e206025682ae6c10cdbe03b0cd77"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-linereader",
+			"Rev": "07bab5fdd9580500aea6ada0e09df4aa28e68abd"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "442e588f213303bec7936deba67901f8fc8f18b1"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/packer",
+			"Rev": "350a5f8cad6a0e4c2b24c3049a84c4f294416e16"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/panicwrap",
+			"Rev": "45cbfd3bae250c7676c077fb275be1a2968e066a"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/prefixedio",
+			"Rev": "89d9b535996bf0a185f85b59578f2e245f9e1724"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/reflectwalk",
+			"Rev": "242be0c275dedfba00a616563e6db75ab8f279ec"
+		},
+		{
+			"ImportPath": "github.com/nu7hatch/gouuid",
+			"Rev": "179d4d0c4d8d407a32af483c2354df1d2c91e6c3"
+		},
+		{
+			"ImportPath": "github.com/packer-community/winrmcp",
+			"Rev": "650a91d1da6dc3fefa8f052289ffce648924a304"
+		},
+		{
+			"ImportPath": "github.com/pearkes/cloudflare",
+			"Rev": "19e280b056f3742e535ea12ae92a37ea7767ea82"
+		},
+		{
+			"ImportPath": "github.com/pearkes/digitalocean",
+			"Rev": "e966f00c2d9de5743e87697ab77c7278f5998914"
+		},
+		{
+			"ImportPath": "github.com/pearkes/dnsimple",
+			"Rev": "1e0c2b0eb33ca7b5632a130d6d34376a1ea46c84"
+		},
+		{
+			"ImportPath": "github.com/pearkes/mailgun",
+			"Rev": "5b02e7e9ffee9869f81393e80db138f6ff726260"
+		},
+		{
+			"ImportPath": "github.com/rackspace/gophercloud",
+			"Rev": "9ad4137a6b3e786b9c1e161b8d354b44482ab6d7"
+		},
+		{
+			"ImportPath": "github.com/satori/go.uuid",
+			"Rev": "7c7f2020c4c9491594b85767967f4619c2fa75f9"
+		},
+		{
+			"ImportPath": "github.com/soniah/dnsmadeeasy",
+			"Rev": "5578a8c15e33958c61cf7db720b6181af65f4a9e"
+		},
+		{
+			"ImportPath": "github.com/vaughan0/go-ini",
+			"Rev": "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1"
+		},
+		{
+			"ImportPath": "github.com/xanzy/go-cloudstack",
+			"Rev": "f73f6ff1b843dbdac0a01da7b7f39883adfe2bdb"
+		}
+	]
+}
diff --git a/deps/v0-6-0.json b/deps/v0-6-0.json
new file mode 100644
index 000000000..80e1349bb
--- /dev/null
+++ b/deps/v0-6-0.json
@@ -0,0 +1,385 @@
+{
+	"ImportPath": "github.com/hashicorp/terraform",
+	"GoVersion": "go1.4.2",
+	"Packages": [
+		"./..."
+	],
+	"Deps": [
+		{
+			"ImportPath": "code.google.com/p/go-uuid/uuid",
+			"Comment": "null-15",
+			"Rev": "35bc42037350f0078e3c974c6ea690f1926603ab"
+		},
+		{
+			"ImportPath": "github.com/Azure/azure-sdk-for-go/core/http",
+			"Comment": "v1.2-216-g9197765",
+			"Rev": "91977650587a7bc48318c0430649d7fea886f111"
+		},
+		{
+			"ImportPath": "github.com/Azure/azure-sdk-for-go/core/tls",
+			"Comment": "v1.2-216-g9197765",
+			"Rev": "91977650587a7bc48318c0430649d7fea886f111"
+		},
+		{
+			"ImportPath": "github.com/Azure/azure-sdk-for-go/management",
+			"Comment": "v1.2-216-g9197765",
+			"Rev": "91977650587a7bc48318c0430649d7fea886f111"
+		},
+		{
+			"ImportPath": "github.com/Azure/azure-sdk-for-go/storage",
+			"Comment": "v1.2-216-g9197765",
+			"Rev": "91977650587a7bc48318c0430649d7fea886f111"
+		},
+		{
+			"ImportPath": "github.com/Azure/go-pkcs12",
+			"Rev": "a635c0684cd517745ca5c9552a312627791d5ba0"
+		},
+		{
+			"ImportPath": "github.com/armon/circbuf",
+			"Rev": "f092b4f207b6e5cce0569056fba9e1a2735cb6cf"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/endpoints",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/ec2query",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/json/jsonutil",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/jsonrpc",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/query",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/rest",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/restjson",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/restxml",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/protocol/xml/xmlutil",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/internal/signer/v4",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/autoscaling",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/cloudwatch",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/dynamodb",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/ec2",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/ecs",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/elasticache",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/elb",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/iam",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/kinesis",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/lambda",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/rds",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/route53",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/s3",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/sns",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/sqs",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/aws/credentials",
+			"Comment": "v0.6.4-13-gb102478",
+			"Rev": "b1024787e030774e84f3aa6995f2c3891283b4a0"
+		},
+		{
+			"ImportPath": "github.com/cyberdelia/heroku-go/v3",
+			"Rev": "594d483b9b6a8ddc7cd2f1e3e7d1de92fa2de665"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/iso8601",
+			"Rev": "2075bf119b58e5576c6ed9f867b8f3d17f2e54d4"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/winrmtest",
+			"Rev": "3e9661c52c45dab9a8528966a23d421922fca9b9"
+		},
+		{
+			"ImportPath": "github.com/fsouza/go-dockerclient",
+			"Rev": "bacc91d0d732390df132783988dc17c611881047"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/archive",
+			"Comment": "20141209094003-70-g1b40363",
+			"Rev": "1b403631cd2d44764a68a9549874213cf95b285e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/v1",
+			"Comment": "20141209094003-70-g1b40363",
+			"Rev": "1b403631cd2d44764a68a9549874213cf95b285e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/consul/api",
+			"Comment": "v0.5.2-125-g9cb5526",
+			"Rev": "9cb55266e7df62f2c3fd393503331140a05bfeb6"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/errwrap",
+			"Rev": "7554cd9344cec97297fa6649b055a8c98c2a1e55"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-checkpoint",
+			"Rev": "88326f6851319068e7b34981032128c0b1a6524d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-multierror",
+			"Rev": "56912fb08d85084aa318edcf2bba735b97cf35c5"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-version",
+			"Rev": "999359b6b7a041ce16e695d51e92145b83f01087"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/hcl",
+			"Rev": "54864211433d45cb780682431585b3e573b49e4a"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/yamux",
+			"Rev": "b2e55852ddaf823a85c67f798080eb7d08acd71d"
+		},
+		{
+			"ImportPath": "github.com/imdario/mergo",
+			"Comment": "0.2.0-5-g61a5285",
+			"Rev": "61a52852277811e93e06d28e0d0c396284a7730b"
+		},
+		{
+			"ImportPath": "github.com/masterzen/simplexml/dom",
+			"Rev": "95ba30457eb1121fa27753627c774c7cd4e90083"
+		},
+		{
+			"ImportPath": "github.com/masterzen/winrm/soap",
+			"Rev": "132339029dfa67fd39ff8edeed2af78f2cca4fbb"
+		},
+		{
+			"ImportPath": "github.com/masterzen/winrm/winrm",
+			"Rev": "132339029dfa67fd39ff8edeed2af78f2cca4fbb"
+		},
+		{
+			"ImportPath": "github.com/masterzen/xmlpath",
+			"Rev": "13f4951698adc0fa9c1dda3e275d489a24201161"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/cli",
+			"Rev": "8102d0ed5ea2709ade1243798785888175f6e415"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/colorstring",
+			"Rev": "61164e49940b423ba1f12ddbdf01632ac793e5e9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/copystructure",
+			"Rev": "6fc66267e9da7d155a9d3bd489e00dad02666dc6"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-homedir",
+			"Rev": "1f6da4a72e57d4e7edd4a7295a585e0a3999a2d4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-linereader",
+			"Rev": "07bab5fdd9580500aea6ada0e09df4aa28e68abd"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "2caf8efc93669b6c43e0441cdc6aed17546c96f3"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/packer/common/uuid",
+			"Comment": "v0.8.0-89-g3239d15",
+			"Rev": "3239d157c16ad1612d652940b2da2981614c97e4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/panicwrap",
+			"Rev": "45cbfd3bae250c7676c077fb275be1a2968e066a"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/prefixedio",
+			"Rev": "89d9b535996bf0a185f85b59578f2e245f9e1724"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/reflectwalk",
+			"Rev": "eecf4c70c626c7cfbb95c90195bc34d386c74ac6"
+		},
+		{
+			"ImportPath": "github.com/nu7hatch/gouuid",
+			"Rev": "179d4d0c4d8d407a32af483c2354df1d2c91e6c3"
+		},
+		{
+			"ImportPath": "github.com/packer-community/winrmcp/winrmcp",
+			"Rev": "743b1afe5ee3f6d5ba71a0d50673fa0ba2123d6b"
+		},
+		{
+			"ImportPath": "github.com/pearkes/cloudflare",
+			"Rev": "19e280b056f3742e535ea12ae92a37ea7767ea82"
+		},
+		{
+			"ImportPath": "github.com/pearkes/digitalocean",
+			"Rev": "e966f00c2d9de5743e87697ab77c7278f5998914"
+		},
+		{
+			"ImportPath": "github.com/pearkes/dnsimple",
+			"Rev": "2a807d118c9e52e94819f414a6ec0293b45cad01"
+		},
+		{
+			"ImportPath": "github.com/pearkes/mailgun",
+			"Rev": "5b02e7e9ffee9869f81393e80db138f6ff726260"
+		},
+		{
+			"ImportPath": "github.com/rackspace/gophercloud",
+			"Comment": "v1.0.0-618-gf956c6c",
+			"Rev": "f956c6c6c0c55844eff4b153b5071ef6e3ab4ab4"
+		},
+		{
+			"ImportPath": "github.com/satori/go.uuid",
+			"Rev": "afe1e2ddf0f05b7c29d388a3f8e76cb15c2231ca"
+		},
+		{
+			"ImportPath": "github.com/soniah/dnsmadeeasy",
+			"Comment": "v1.1-2-g5578a8c",
+			"Rev": "5578a8c15e33958c61cf7db720b6181af65f4a9e"
+		},
+		{
+			"ImportPath": "github.com/vaughan0/go-ini",
+			"Rev": "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1"
+		},
+		{
+			"ImportPath": "github.com/xanzy/go-cloudstack/cloudstack",
+			"Comment": "v1.2.0-30-g4d162c3",
+			"Rev": "4d162c3e1955cd12235a8f0abaa95fe0bbf08c63"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/ssh",
+			"Rev": "cc04154d65fb9296747569b107cfd05380b1ea3e"
+		},
+		{
+			"ImportPath": "golang.org/x/net/context",
+			"Rev": "d9558e5c97f85372afee28cf2b6059d7d3818919"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2",
+			"Rev": "b5adcc2dcdf009d0391547edc6ecbaff889f5bb9"
+		},
+		{
+			"ImportPath": "google.golang.org/api/compute/v0.beta",
+			"Rev": "a09229c13c2f13bbdedf7b31b506cad4c83ef3bf"
+		},
+		{
+			"ImportPath": "google.golang.org/api/compute/v1",
+			"Rev": "a09229c13c2f13bbdedf7b31b506cad4c83ef3bf"
+		},
+		{
+			"ImportPath": "google.golang.org/api/dns/v1",
+			"Rev": "a09229c13c2f13bbdedf7b31b506cad4c83ef3bf"
+		},
+		{
+			"ImportPath": "google.golang.org/api/googleapi",
+			"Rev": "a09229c13c2f13bbdedf7b31b506cad4c83ef3bf"
+		},
+		{
+			"ImportPath": "google.golang.org/api/storage/v1",
+			"Rev": "a09229c13c2f13bbdedf7b31b506cad4c83ef3bf"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/compute/metadata",
+			"Rev": "15c0736a396d4a63e96b29802364d721ed0a33d5"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/internal",
+			"Rev": "15c0736a396d4a63e96b29802364d721ed0a33d5"
+		}
+	]
+}
diff --git a/examples/aws-asg/README.md b/examples/aws-asg/README.md
new file mode 100644
index 000000000..fac6917c7
--- /dev/null
+++ b/examples/aws-asg/README.md
@@ -0,0 +1,28 @@
+# ASG example
+
+This example shows how to launch instances using Auto Scaling Groups.
+
+This creates a security group, launch configuration, auto scaling group and an ELB. The user data for launch configuration installs nginx and it listens on port 80.
+
+The example uses latest Ubuntu AMIs. 
+
+Make sure you change the list of availability zones that is applicable to your account and region.
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+For planning phase 
+
+terraform plan -var 'key_name={your_key_name}}'
+
+For apply phase 
+
+terraform apply -var 'key_name={your_key_name}}'
+
+Once the stack is created, wait for few minutes and test the stack by launching a browser with ELB url. 
+
+To remove the stack
+
+ terraform destroy -var 'key_name={your_key_name}}'
+
diff --git a/examples/aws-asg/main.tf b/examples/aws-asg/main.tf
new file mode 100644
index 000000000..6ced0aa78
--- /dev/null
+++ b/examples/aws-asg/main.tf
@@ -0,0 +1,84 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+resource "aws_elb" "web-elb" {
+  name = "terraform-example-elb"
+
+  # The same availability zone as our instances
+  availability_zones = ["${split(",", var.availability_zones)}"]
+  listener {
+    instance_port = 80
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+
+  health_check {
+    healthy_threshold = 2
+    unhealthy_threshold = 2
+    timeout = 3
+    target = "HTTP:80/"
+    interval = 30
+  }
+
+}
+
+resource "aws_autoscaling_group" "web-asg" {
+  availability_zones = ["${split(",", var.availability_zones)}"]
+  name = "terraform-example-asg"
+  max_size = "${var.asg_max}"
+  min_size = "${var.asg_min}"
+  desired_capacity = "${var.asg_desired}"
+  force_delete = true
+  launch_configuration = "${aws_launch_configuration.web-lc.name}"
+  load_balancers = ["${aws_elb.web-elb.name}"]
+  #vpc_zone_identifier = ["${split(",", var.availability_zones)}"]
+  tag {
+        key = "Name"
+        value = "web-asg"
+        propagate_at_launch = "true"
+    }
+  }
+
+resource "aws_launch_configuration" "web-lc" {
+    name = "terraform-example-lc"
+    image_id = "${lookup(var.aws_amis, var.aws_region)}"
+    instance_type = "${var.instance_type}"
+    # Security group
+    security_groups = ["${aws_security_group.default.name}"]
+    user_data = "${file("userdata.sh")}"
+    key_name = "${var.key_name}"
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "terraform_example_sg"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
diff --git a/examples/aws-asg/outputs.tf b/examples/aws-asg/outputs.tf
new file mode 100644
index 000000000..afd78f134
--- /dev/null
+++ b/examples/aws-asg/outputs.tf
@@ -0,0 +1,12 @@
+output "security_group" {
+    value = "${aws_security_group.default.id}"
+}
+output "launch_configuration" {
+    value = "${aws_launch_configuration.web-lc.id}"
+}
+output "asg_name" {
+    value = "${aws_autoscaling_group.web-asg.id}"
+}
+output "elb_name" {
+    value = "${aws_elb.web-elb.dns_name}"
+}
\ No newline at end of file
diff --git a/examples/aws-asg/userdata.sh b/examples/aws-asg/userdata.sh
new file mode 100644
index 000000000..77e340b3a
--- /dev/null
+++ b/examples/aws-asg/userdata.sh
@@ -0,0 +1,3 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
diff --git a/examples/aws-asg/variables.tf b/examples/aws-asg/variables.tf
new file mode 100644
index 000000000..b51450911
--- /dev/null
+++ b/examples/aws-asg/variables.tf
@@ -0,0 +1,42 @@
+variable "aws_region" {
+    description = "The AWS region to create things in."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
+variable "availability_zones" {
+	default = "us-east-1b,us-east-1c,us-east-1d,us-east-1e"
+    description = "List of availability zones, use AWS CLI to find your "
+}
+
+variable "key_name" {
+    description = "Name of AWS key pair"
+}
+
+variable "instance_type" {
+    default = "t2.micro"
+    description = "AWS instance type"
+}
+
+variable "asg_min" {
+    description = "Min numbers of servers in ASG"
+    default = "1"
+}
+
+variable "asg_max" {
+    description = "Max numbers of servers in ASG"
+    default = "2"
+}
+
+variable "asg_desired" {
+    description = "Desired numbers of servers in ASG"
+    default = "1"
+}
+
diff --git a/examples/aws-count/README.md b/examples/aws-count/README.md
index a2703f59d..102841b94 100644
--- a/examples/aws-count/README.md
+++ b/examples/aws-count/README.md
@@ -6,5 +6,8 @@ and let you scale resources by simply incrementing a number.
 Additionally, variables can be used to expand a list of resources
 for use elsewhere.
 
-As with all examples, just copy and paste the example and run
-`terraform apply` to see it work.
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply` to see it work.
diff --git a/examples/aws-eip/README.md b/examples/aws-eip/README.md
new file mode 100644
index 000000000..7839f019c
--- /dev/null
+++ b/examples/aws-eip/README.md
@@ -0,0 +1,11 @@
+# Elastic IP Example
+
+The eip example launches a web server, installs nginx. It also creates security group 
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply -var 'key_name={your_key_name}}'` 
+
+Give couple of mins for userdata to insatll nginx, and then type the Elastic IP from outputs in your browser and see the nginx welcome page
diff --git a/examples/aws-eip/main.tf b/examples/aws-eip/main.tf
new file mode 100644
index 000000000..62757a6fe
--- /dev/null
+++ b/examples/aws-eip/main.tf
@@ -0,0 +1,69 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+resource "aws_eip" "default" {
+    instance = "${aws_instance.web.id}"
+    vpc = true
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "eip_example"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
+
+
+resource "aws_instance" "web" {
+  instance_type = "t2.micro"
+
+  # Lookup the correct AMI based on the region
+  # we specified
+  ami = "${lookup(var.aws_amis, var.aws_region)}"
+
+  # The name of our SSH keypair you've created and downloaded
+  # from the AWS console.
+  #
+  # https://console.aws.amazon.com/ec2/v2/home?region=us-west-2#KeyPairs:
+  #
+  key_name = "${var.key_name}"
+
+  # Our Security group to allow HTTP and SSH access
+  security_groups = ["${aws_security_group.default.name}"]
+
+  # We run a remote provisioner on the instance after creating it.
+  # In this case, we just install nginx and start it. By default,
+  # this should be on port 80
+  user_data = "${file("userdata.sh")}"
+  #Instance tags
+    tags {
+        Name = "eip-example"
+    }
+}
+
diff --git a/examples/aws-eip/outputs.tf b/examples/aws-eip/outputs.tf
new file mode 100644
index 000000000..1660431b6
--- /dev/null
+++ b/examples/aws-eip/outputs.tf
@@ -0,0 +1,6 @@
+output "address" {
+  value = "${aws_instance.web.private_ip}"
+}
+output "elastic ip" {
+  value = "${aws_eip.default.public_ip}"
+}
diff --git a/examples/aws-eip/userdata.sh b/examples/aws-eip/userdata.sh
new file mode 100644
index 000000000..8a058c786
--- /dev/null
+++ b/examples/aws-eip/userdata.sh
@@ -0,0 +1,4 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
+
diff --git a/examples/aws-eip/variables.tf b/examples/aws-eip/variables.tf
new file mode 100644
index 000000000..d1f0d0d6c
--- /dev/null
+++ b/examples/aws-eip/variables.tf
@@ -0,0 +1,17 @@
+variable "aws_region" {
+    description = "The AWS region to create things in."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
+variable "key_name" {
+    description = "Name of the SSH keypair to use in AWS."
+}
+
diff --git a/examples/aws-elb/README.md b/examples/aws-elb/README.md
new file mode 100644
index 000000000..a5f39f5d2
--- /dev/null
+++ b/examples/aws-elb/README.md
@@ -0,0 +1,11 @@
+# ELB with stickiness Example
+
+The example launches a web server, installs nginx, creates an ELB for instance. It also creates security groups for elb/instance 
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply -var 'key_name={your_key_name}}'` 
+
+Give couple of mins for userdata to insatll nginx, and then type the ELB DNS Name from outputs in your browser and see the nginx welcome page
diff --git a/examples/aws-elb/main.tf b/examples/aws-elb/main.tf
new file mode 100644
index 000000000..6542a91ef
--- /dev/null
+++ b/examples/aws-elb/main.tf
@@ -0,0 +1,123 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "instance_sg"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
+
+# Our elb security group to access
+# the ELB over HTTP
+resource "aws_security_group" "elb" {
+    name = "elb_sg"
+    description = "Used in the terraform"
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+  
+}
+
+
+resource "aws_elb" "web" {
+  name = "example-elb"
+
+  # The same availability zone as our instance
+  availability_zones = ["${aws_instance.web.availability_zone}"]
+  security_groups = ["${aws_security_group.elb.id}"]
+  listener {
+    instance_port = 80
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+
+  health_check {
+    healthy_threshold = 2
+    unhealthy_threshold = 2
+    timeout = 3
+    target = "HTTP:80/"
+    interval = 30
+  }  
+
+  # The instance is registered automatically
+  instances = ["${aws_instance.web.id}"]
+
+  cross_zone_load_balancing = true
+  idle_timeout = 400
+  connection_draining = true
+  connection_draining_timeout = 400
+
+}
+
+resource "aws_lb_cookie_stickiness_policy" "default" {
+      name = "lbpolicy"
+      load_balancer = "${aws_elb.web.id}"
+      lb_port = 80
+      cookie_expiration_period = 600
+}
+
+resource "aws_instance" "web" {
+  
+  instance_type = "t2.micro"
+
+  # Lookup the correct AMI based on the region
+  # we specified
+  ami = "${lookup(var.aws_amis, var.aws_region)}"
+
+  # The name of our SSH keypair you've created and downloaded
+  # from the AWS console.
+  #
+  # https://console.aws.amazon.com/ec2/v2/home?region=us-west-2#KeyPairs:
+  #
+  key_name = "${var.key_name}"
+
+  # Our Security group to allow HTTP and SSH access
+  security_groups = ["${aws_security_group.default.name}"]
+
+  user_data = "${file("userdata.sh")}"
+  #Instance tags
+    tags {
+        Name = "elb-example"
+    }
+}
diff --git a/examples/aws-elb/outputs.tf b/examples/aws-elb/outputs.tf
new file mode 100644
index 000000000..5977837f3
--- /dev/null
+++ b/examples/aws-elb/outputs.tf
@@ -0,0 +1,3 @@
+output "address" {
+  value = "${aws_elb.web.dns_name}"
+}
diff --git a/examples/aws-elb/userdata.sh b/examples/aws-elb/userdata.sh
new file mode 100644
index 000000000..8a058c786
--- /dev/null
+++ b/examples/aws-elb/userdata.sh
@@ -0,0 +1,4 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
+
diff --git a/examples/aws-elb/variables.tf b/examples/aws-elb/variables.tf
new file mode 100644
index 000000000..150ffa36c
--- /dev/null
+++ b/examples/aws-elb/variables.tf
@@ -0,0 +1,17 @@
+variable "key_name" {
+    description = "Name of the SSH keypair to use in AWS."
+}
+
+variable "aws_region" {
+    description = "AWS region to launch servers."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
diff --git a/examples/aws-rds/README.md b/examples/aws-rds/README.md
new file mode 100644
index 000000000..79e9ebd02
--- /dev/null
+++ b/examples/aws-rds/README.md
@@ -0,0 +1,17 @@
+## Creating an RDS instance in AWS
+
+This example provides sample configuration for creating a mysql or postgres instance. For Oracle/SQL Servers, replace default values with appropriate values, they are not included in sample since the number of options are high.
+
+The example creates db subnet groups and a VPC security group as inputs to the instance creation
+
+For AWS provider, set up your AWS environment as outlined in https://www.terraform.io/docs/providers/aws/index.html
+
+If you need to use existing security groups and subnets, remove the sg.tf and subnets.tf files and replace the corresponding sections in main.tf under aws_db_instance
+
+Pass the password variable through your ENV variable.
+
+Several paraneters are externalized, review the different variables.tf files and change them to fit your needs. Carefully review the CIDR blocks, egress/ingress rules, availability zones that are very specific to your account.
+
+Once ready run 'terraform plan' to review. At the minimum, provide the vpc_id as input variable.
+
+Once satisfied with plan, run 'terraform apply'  
diff --git a/examples/aws-rds/main.tf b/examples/aws-rds/main.tf
new file mode 100644
index 000000000..d292a38af
--- /dev/null
+++ b/examples/aws-rds/main.tf
@@ -0,0 +1,19 @@
+resource "aws_db_instance" "default" {
+    depends_on = "aws_security_group.default"
+    identifier = "${var.identifier}"
+    allocated_storage = "${var.storage}"
+    engine = "${var.engine}"
+    engine_version = "${lookup(var.engine_version, var.engine)}"
+    instance_class = "${var.instance_class}"
+    name = "${var.db_name}"
+    username = "${var.username}"
+    password = "${var.password}"
+    vpc_security_group_ids = ["${aws_security_group.default.id}"]
+    db_subnet_group_name = "${aws_db_subnet_group.default.id}"
+}
+
+resource "aws_db_subnet_group" "default" {
+    name = "main_subnet_group"
+    description = "Our main group of subnets"
+    subnet_ids = ["${aws_subnet.subnet_1.id}", "${aws_subnet.subnet_2.id}"]
+}
diff --git a/examples/aws-rds/outputs.tf b/examples/aws-rds/outputs.tf
new file mode 100644
index 000000000..1bf2b0cb8
--- /dev/null
+++ b/examples/aws-rds/outputs.tf
@@ -0,0 +1,10 @@
+output "subnet_group" {
+    value = "${aws_db_subnet_group.default.name}"
+}
+output "db_instance_id" {
+    value = "${aws_db_instance.default.id}"
+}
+output "db_instance_address" {
+    value = "${aws_db_instance.default.address}"
+}
+
diff --git a/examples/aws-rds/sg-variables.tf b/examples/aws-rds/sg-variables.tf
new file mode 100644
index 000000000..a1fefe413
--- /dev/null
+++ b/examples/aws-rds/sg-variables.tf
@@ -0,0 +1,10 @@
+variable "cidr_blocks" {
+	default = "0.0.0.0/0"
+    description = "CIDR for sg"
+}
+
+variable "sg_name" {
+	default = "rds_sg"
+    description = "Tag Name for sg"
+}
+
diff --git a/examples/aws-rds/sg.tf b/examples/aws-rds/sg.tf
new file mode 100644
index 000000000..c55b0799d
--- /dev/null
+++ b/examples/aws-rds/sg.tf
@@ -0,0 +1,23 @@
+resource "aws_security_group" "default" {
+  name = "main_rds_sg"
+  description = "Allow all inbound traffic"
+  vpc_id = "${var.vpc_id}"
+
+  ingress {
+      from_port = 0
+      to_port = 65535
+      protocol = "TCP"
+      cidr_blocks = ["${var.cidr_blocks}"]
+  }
+
+  egress {
+      from_port = 0
+      to_port = 0
+      protocol = "-1"
+      cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags {
+    Name = "${var.sg_name}"
+  }
+}
diff --git a/examples/aws-rds/subnet-variables.tf b/examples/aws-rds/subnet-variables.tf
new file mode 100644
index 000000000..35c695088
--- /dev/null
+++ b/examples/aws-rds/subnet-variables.tf
@@ -0,0 +1,24 @@
+variable "subnet_1_cidr" {
+	default = "10.0.1.0/24"
+    description = "Your AZ"
+}
+
+variable "subnet_2_cidr" {
+	default = "10.0.2.0/24"
+    description = "Your AZ"
+}
+
+variable "az_1" {
+	default = "us-east-1b"
+    description = "Your Az1, use AWS CLI to find your account specific"
+}
+
+variable "az_2" {
+	default = "us-east-1c"
+    description = "Your Az2, use AWS CLI to find your account specific"
+}
+
+variable "vpc_id" {
+    description = "Your VPC ID"
+}
+
diff --git a/examples/aws-rds/subnets.tf b/examples/aws-rds/subnets.tf
new file mode 100644
index 000000000..5de7d0d82
--- /dev/null
+++ b/examples/aws-rds/subnets.tf
@@ -0,0 +1,19 @@
+resource "aws_subnet" "subnet_1" {
+    vpc_id = "${var.vpc_id}"
+    cidr_block = "${var.subnet_1_cidr}"
+    availability_zone = "${var.az_1}"
+
+    tags {
+        Name = "main_subnet1"
+    }
+}
+
+resource "aws_subnet" "subnet_2" {
+    vpc_id = "${var.vpc_id}"
+    cidr_block = "${var.subnet_2_cidr}"
+    availability_zone = "${var.az_2}"
+
+    tags {
+        Name = "main_subnet2"
+    }
+}
diff --git a/examples/aws-rds/variables.tf b/examples/aws-rds/variables.tf
new file mode 100644
index 000000000..ad3156b1b
--- /dev/null
+++ b/examples/aws-rds/variables.tf
@@ -0,0 +1,41 @@
+variable "identifier" {
+	default = "mydb-rds"
+    description = "Identifier for your DB"
+}
+
+variable "storage" {
+	default = "10"
+    description = "Storage size in GB"
+}
+
+variable "engine" {
+	default = "postgres"
+    description = "Engine type, example values mysql, postgres"
+}
+
+variable "engine_version" {
+    description = "Engine version"
+    default = {
+        mysql = "5.6.22"
+        postgres = "9.4.1"
+    }
+}
+
+variable "instance_class" {
+	default = "db.t2.micro"
+    description = "Instance class"
+}
+
+variable "db_name" {
+	default = "mydb"
+    description = "db name"
+}
+
+variable "username" {
+	default = "myuser"
+    description = "User name"
+}
+
+variable "password" {
+    description = "password, provide through your ENV variables"
+}
diff --git a/examples/aws-two-tier/README.md b/examples/aws-two-tier/README.md
index 8a5ad61a3..dcdf7d1c4 100644
--- a/examples/aws-two-tier/README.md
+++ b/examples/aws-two-tier/README.md
@@ -14,5 +14,19 @@ After you run `terraform apply` on this configuration, it will
 automatically output the DNS address of the ELB. After your instance
 registers, this should respond with the default nginx web page.
 
-As with all examples, just copy and paste the example and run
-`terraform apply` to see it work.
+To run, configure your AWS provider as described in 
+
+https://www.terraform.io/docs/providers/aws/index.html
+
+Run with a command like this:
+
+```
+terraform apply -var 'key_name={your_aws_key_name}' \
+   -var 'key_path={location_of_your_key_in_your_local_machine}'` 
+```
+
+For example:
+
+```
+terraform apply -var 'key_name=terraform' -var 'key_path=/Users/jsmith/.ssh/terraform.pem'
+```
diff --git a/examples/aws-two-tier/main.tf b/examples/aws-two-tier/main.tf
index b06bf8f80..2a8957e66 100644
--- a/examples/aws-two-tier/main.tf
+++ b/examples/aws-two-tier/main.tf
@@ -24,6 +24,14 @@ resource "aws_security_group" "default" {
         protocol = "tcp"
         cidr_blocks = ["0.0.0.0/0"]
     }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
 }
 
 
diff --git a/helper/resource/testing.go b/helper/resource/testing.go
index 6832146b2..eaa0cbf71 100644
--- a/helper/resource/testing.go
+++ b/helper/resource/testing.go
@@ -7,6 +7,7 @@ import (
 	"log"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -60,6 +61,10 @@ type TestCase struct {
 // potentially complex update logic. In general, simply create/destroy
 // tests will only need one step.
 type TestStep struct {
+	// PreConfig is called before the Config is applied to perform any per-step
+	// setup that needs to happen
+	PreConfig func()
+
 	// Config a string of the configuration to give to Terraform.
 	Config string
 
@@ -160,6 +165,10 @@ func testStep(
 	opts terraform.ContextOpts,
 	state *terraform.State,
 	step TestStep) (*terraform.State, error) {
+	if step.PreConfig != nil {
+		step.PreConfig()
+	}
+
 	cfgPath, err := ioutil.TempDir("", "tf-test")
 	if err != nil {
 		return state, fmt.Errorf(
@@ -316,6 +325,32 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 	}
 }
 
+func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
+	return func(s *terraform.State) error {
+		ms := s.RootModule()
+		rs, ok := ms.Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		is := rs.Primary
+		if is == nil {
+			return fmt.Errorf("No primary instance: %s", name)
+		}
+
+		if !r.MatchString(is.Attributes[key]) {
+			return fmt.Errorf(
+				"%s: Attribute '%s' didn't match %q, got %#v",
+				name,
+				key,
+				r.String(),
+				is.Attributes[key])
+		}
+
+		return nil
+	}
+}
+
 // TestCheckResourceAttrPtr is like TestCheckResourceAttr except the
 // value is a pointer so that it can be updated while the test is running.
 // It will only be dereferenced at the point this step is run.
diff --git a/helper/schema/field_reader.go b/helper/schema/field_reader.go
index cc4a1d186..fc2a1e090 100644
--- a/helper/schema/field_reader.go
+++ b/helper/schema/field_reader.go
@@ -78,19 +78,11 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
 		}
 
 		switch t := current.Type; t {
-		case TypeBool:
-			fallthrough
-		case TypeInt:
-			fallthrough
-		case TypeFloat:
-			fallthrough
-		case TypeString:
+		case TypeBool, TypeInt, TypeFloat, TypeString:
 			if len(addr) > 0 {
 				return nil
 			}
-		case TypeList:
-			fallthrough
-		case TypeSet:
+		case TypeList, TypeSet:
 			switch v := current.Elem.(type) {
 			case *Resource:
 				current = &Schema{
diff --git a/helper/schema/field_reader_config.go b/helper/schema/field_reader_config.go
index a6edef099..69b63eac7 100644
--- a/helper/schema/field_reader_config.go
+++ b/helper/schema/field_reader_config.go
@@ -80,13 +80,7 @@ func (r *ConfigFieldReader) readField(
 	k := strings.Join(address, ".")
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeFloat, TypeInt, TypeString:
 		return r.readPrimitive(k, schema)
 	case TypeList:
 		return readListField(&nestedConfigFieldReader{r}, address, schema)
diff --git a/helper/schema/field_reader_diff.go b/helper/schema/field_reader_diff.go
index bfac2a0b0..e17a6685e 100644
--- a/helper/schema/field_reader_diff.go
+++ b/helper/schema/field_reader_diff.go
@@ -39,13 +39,7 @@ func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return r.readPrimitive(address, schema)
 	case TypeList:
 		return readListField(r, address, schema)
@@ -150,7 +144,11 @@ func (r *DiffFieldReader) readSet(
 	set := &Set{F: schema.Set}
 
 	// Go through the map and find all the set items
-	for k, _ := range r.Diff.Attributes {
+	for k, d := range r.Diff.Attributes {
+		if d.NewRemoved {
+			// If the field is removed, we always ignore it
+			continue
+		}
 		if !strings.HasPrefix(k, prefix) {
 			continue
 		}
diff --git a/helper/schema/field_reader_map.go b/helper/schema/field_reader_map.go
index a4345cbcd..6dc76c474 100644
--- a/helper/schema/field_reader_map.go
+++ b/helper/schema/field_reader_map.go
@@ -21,13 +21,7 @@ func (r *MapFieldReader) ReadField(address []string) (FieldReadResult, error) {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return r.readPrimitive(address, schema)
 	case TypeList:
 		return readListField(r, address, schema)
diff --git a/helper/schema/field_writer_map.go b/helper/schema/field_writer_map.go
index 53e467650..3e9b04719 100644
--- a/helper/schema/field_writer_map.go
+++ b/helper/schema/field_writer_map.go
@@ -74,13 +74,7 @@ func (w *MapFieldWriter) set(addr []string, value interface{}) error {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return w.setPrimitive(addr, value, schema)
 	case TypeList:
 		return w.setList(addr, value, schema)
diff --git a/helper/schema/provider.go b/helper/schema/provider.go
index 6b364e5a1..aa35d32d0 100644
--- a/helper/schema/provider.go
+++ b/helper/schema/provider.go
@@ -97,6 +97,13 @@ func (p *Provider) Input(
 
 // Validate implementation of terraform.ResourceProvider interface.
 func (p *Provider) Validate(c *terraform.ResourceConfig) ([]string, []error) {
+	if err := p.InternalValidate(); err != nil {
+		return nil, []error{fmt.Errorf(
+			"Internal validation of the provider failed! This is always a bug\n"+
+				"with the provider itself, and not a user issue. Please report\n"+
+				"this bug:\n\n%s", err)}
+	}
+
 	return schemaMap(p.Schema).Validate(c)
 }
 
diff --git a/helper/schema/provider_test.go b/helper/schema/provider_test.go
index 85eb126db..e1f4b93b0 100644
--- a/helper/schema/provider_test.go
+++ b/helper/schema/provider_test.go
@@ -117,6 +117,36 @@ func TestProviderResources(t *testing.T) {
 	}
 }
 
+func TestProviderValidate(t *testing.T) {
+	cases := []struct {
+		P      *Provider
+		Config map[string]interface{}
+		Err    bool
+	}{
+		{
+			P: &Provider{
+				Schema: map[string]*Schema{
+					"foo": &Schema{},
+				},
+			},
+			Config: nil,
+			Err:    true,
+		},
+	}
+
+	for i, tc := range cases {
+		c, err := config.NewRawConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		_, es := tc.P.Validate(terraform.NewResourceConfig(c))
+		if (len(es) > 0) != tc.Err {
+			t.Fatalf("%d: %#v", i, es)
+		}
+	}
+}
+
 func TestProviderValidateResource(t *testing.T) {
 	cases := []struct {
 		P      *Provider
diff --git a/helper/schema/resource.go b/helper/schema/resource.go
index dec94fc7b..cc759e0d6 100644
--- a/helper/schema/resource.go
+++ b/helper/schema/resource.go
@@ -171,6 +171,11 @@ func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 func (r *Resource) Refresh(
 	s *terraform.InstanceState,
 	meta interface{}) (*terraform.InstanceState, error) {
+	// If the ID is already somehow blank, it doesn't exist
+	if s.ID == "" {
+		return nil, nil
+	}
+
 	if r.Exists != nil {
 		// Make a copy of data so that if it is modified it doesn't
 		// affect our Read later.
diff --git a/helper/schema/resource_data_test.go b/helper/schema/resource_data_test.go
index e2b895b9a..95479cfbf 100644
--- a/helper/schema/resource_data_test.go
+++ b/helper/schema/resource_data_test.go
@@ -688,6 +688,50 @@ func TestResourceDataGet(t *testing.T) {
 
 			Value: 33.0,
 		},
+
+		// #23 Sets with removed elements
+		{
+			Schema: map[string]*Schema{
+				"ports": &Schema{
+					Type:     TypeSet,
+					Optional: true,
+					Computed: true,
+					Elem:     &Schema{Type: TypeInt},
+					Set: func(a interface{}) int {
+						return a.(int)
+					},
+				},
+			},
+
+			State: &terraform.InstanceState{
+				Attributes: map[string]string{
+					"ports.#":  "1",
+					"ports.80": "80",
+				},
+			},
+
+			Diff: &terraform.InstanceDiff{
+				Attributes: map[string]*terraform.ResourceAttrDiff{
+					"ports.#": &terraform.ResourceAttrDiff{
+						Old: "2",
+						New: "1",
+					},
+					"ports.80": &terraform.ResourceAttrDiff{
+						Old: "80",
+						New: "80",
+					},
+					"ports.8080": &terraform.ResourceAttrDiff{
+						Old:        "8080",
+						New:        "0",
+						NewRemoved: true,
+					},
+				},
+			},
+
+			Key: "ports",
+
+			Value: []interface{}{80},
+		},
 	}
 
 	for i, tc := range cases {
diff --git a/helper/schema/resource_test.go b/helper/schema/resource_test.go
index 8027f5fb1..b27bd193a 100644
--- a/helper/schema/resource_test.go
+++ b/helper/schema/resource_test.go
@@ -388,6 +388,35 @@ func TestResourceRefresh(t *testing.T) {
 	}
 }
 
+func TestResourceRefresh_blankId(t *testing.T) {
+	r := &Resource{
+		Schema: map[string]*Schema{
+			"foo": &Schema{
+				Type:     TypeInt,
+				Optional: true,
+			},
+		},
+	}
+
+	r.Read = func(d *ResourceData, m interface{}) error {
+		d.SetId("foo")
+		return nil
+	}
+
+	s := &terraform.InstanceState{
+		ID:         "",
+		Attributes: map[string]string{},
+	}
+
+	actual, err := r.Refresh(s, 42)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if actual != nil {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
 func TestResourceRefresh_delete(t *testing.T) {
 	r := &Resource{
 		Schema: map[string]*Schema{
diff --git a/helper/schema/schema.go b/helper/schema/schema.go
index 67b7ba78b..ec0c8dd51 100644
--- a/helper/schema/schema.go
+++ b/helper/schema/schema.go
@@ -131,6 +131,14 @@ type Schema struct {
 	// This string is the message shown to the user with instructions on
 	// what do to about the removed attribute.
 	Removed string
+
+	// ValidateFunc allows individual fields to define arbitrary validation
+	// logic. It is yielded the provided config value as an interface{} that is
+	// guaranteed to be of the proper Schema type, and it can yield warnings or
+	// errors based on inspection of that value.
+	//
+	// ValidateFunc currently only works for primitive types.
+	ValidateFunc SchemaValidateFunc
 }
 
 // SchemaDefaultFunc is a function called to return a default value for
@@ -173,6 +181,10 @@ type SchemaSetFunc func(interface{}) int
 // to be stored in the state.
 type SchemaStateFunc func(interface{}) string
 
+// SchemaValidateFunc is a function used to validate a single field in the
+// schema.
+type SchemaValidateFunc func(interface{}, string) ([]string, []error)
+
 func (s *Schema) GoString() string {
 	return fmt.Sprintf("*%#v", *s)
 }
@@ -378,13 +390,7 @@ func (m schemaMap) Input(
 
 		var value interface{}
 		switch v.Type {
-		case TypeBool:
-			fallthrough
-		case TypeInt:
-			fallthrough
-		case TypeFloat:
-			fallthrough
-		case TypeSet:
+		case TypeBool, TypeInt, TypeFloat, TypeSet:
 			continue
 		case TypeString:
 			value, err = m.inputString(input, k, v)
@@ -509,6 +515,13 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 				}
 			}
 		}
+
+		if v.ValidateFunc != nil {
+			switch v.Type {
+			case TypeList, TypeSet, TypeMap:
+				return fmt.Errorf("ValidateFunc is only supported on primitives.")
+			}
+		}
 	}
 
 	return nil
@@ -522,13 +535,7 @@ func (m schemaMap) diff(
 	all bool) error {
 	var err error
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		err = m.diffString(k, schema, diff, d, all)
 	case TypeList:
 		err = m.diffList(k, schema, diff, d, all)
@@ -835,39 +842,46 @@ func (m schemaMap) diffSet(
 		})
 	}
 
-	for _, code := range ns.listCode() {
-		// If the code is negative (first character is -) then
-		// replace it with "~" for our computed set stuff.
-		codeStr := strconv.Itoa(code)
-		if codeStr[0] == '-' {
-			codeStr = string('~') + codeStr[1:]
-		}
+	// Build the list of codes that will make up our set. This is the
+	// removed codes as well as all the codes in the new codes.
+	codes := make([][]int, 2)
+	codes[0] = os.Difference(ns).listCode()
+	codes[1] = ns.listCode()
+	for _, list := range codes {
+		for _, code := range list {
+			// If the code is negative (first character is -) then
+			// replace it with "~" for our computed set stuff.
+			codeStr := strconv.Itoa(code)
+			if codeStr[0] == '-' {
+				codeStr = string('~') + codeStr[1:]
+			}
 
-		switch t := schema.Elem.(type) {
-		case *Resource:
-			// This is a complex resource
-			for k2, schema := range t.Schema {
-				subK := fmt.Sprintf("%s.%s.%s", k, codeStr, k2)
-				err := m.diff(subK, schema, diff, d, true)
+			switch t := schema.Elem.(type) {
+			case *Resource:
+				// This is a complex resource
+				for k2, schema := range t.Schema {
+					subK := fmt.Sprintf("%s.%s.%s", k, codeStr, k2)
+					err := m.diff(subK, schema, diff, d, true)
+					if err != nil {
+						return err
+					}
+				}
+			case *Schema:
+				// Copy the schema so that we can set Computed/ForceNew from
+				// the parent schema (the TypeSet).
+				t2 := *t
+				t2.ForceNew = schema.ForceNew
+
+				// This is just a primitive element, so go through each and
+				// just diff each.
+				subK := fmt.Sprintf("%s.%s", k, codeStr)
+				err := m.diff(subK, &t2, diff, d, true)
 				if err != nil {
 					return err
 				}
+			default:
+				return fmt.Errorf("%s: unknown element type (internal)", k)
 			}
-		case *Schema:
-			// Copy the schema so that we can set Computed/ForceNew from
-			// the parent schema (the TypeSet).
-			t2 := *t
-			t2.ForceNew = schema.ForceNew
-
-			// This is just a primitive element, so go through each and
-			// just diff each.
-			subK := fmt.Sprintf("%s.%s", k, codeStr)
-			err := m.diff(subK, &t2, diff, d, true)
-			if err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("%s: unknown element type (internal)", k)
 		}
 	}
 
@@ -1089,6 +1103,13 @@ func (m schemaMap) validateObject(
 	k string,
 	schema map[string]*Schema,
 	c *terraform.ResourceConfig) ([]string, []error) {
+	raw, _ := c.GetRaw(k)
+	if _, ok := raw.(map[string]interface{}); !ok {
+		return nil, []error{fmt.Errorf(
+			"%s: expected object, got %s",
+			k, reflect.ValueOf(raw).Kind())}
+	}
+
 	var ws []string
 	var es []error
 	for subK, s := range schema {
@@ -1107,7 +1128,6 @@ func (m schemaMap) validateObject(
 	}
 
 	// Detect any extra/unknown keys and report those as errors.
-	raw, _ := c.GetRaw(k)
 	if m, ok := raw.(map[string]interface{}); ok {
 		for subk, _ := range m {
 			if _, ok := schema[subk]; !ok {
@@ -1130,6 +1150,7 @@ func (m schemaMap) validatePrimitive(
 		return nil, nil
 	}
 
+	var decoded interface{}
 	switch schema.Type {
 	case TypeBool:
 		// Verify that we can parse this as the correct type
@@ -1137,28 +1158,36 @@ func (m schemaMap) validatePrimitive(
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeInt:
 		// Verify that we can parse this as an int
 		var n int
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeFloat:
 		// Verify that we can parse this as an int
 		var n float64
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeString:
 		// Verify that we can parse this as a string
 		var n string
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	default:
 		panic(fmt.Sprintf("Unknown validation type: %#v", schema.Type))
 	}
 
+	if schema.ValidateFunc != nil {
+		return schema.ValidateFunc(decoded, k)
+	}
+
 	return nil, nil
 }
 
@@ -1170,9 +1199,7 @@ func (m schemaMap) validateType(
 	var ws []string
 	var es []error
 	switch schema.Type {
-	case TypeSet:
-		fallthrough
-	case TypeList:
+	case TypeSet, TypeList:
 		ws, es = m.validateList(k, raw, schema, c)
 	case TypeMap:
 		ws, es = m.validateMap(k, raw, schema, c)
diff --git a/helper/schema/schema_test.go b/helper/schema/schema_test.go
index 9a77cda2f..4421e4111 100644
--- a/helper/schema/schema_test.go
+++ b/helper/schema/schema_test.go
@@ -582,7 +582,7 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": "2" + config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{"2", "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -626,8 +626,8 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": config.UnknownVariableValue +
-					config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{
+					config.UnknownVariableValue, "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -905,7 +905,7 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": "2" + config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{"2", "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -952,8 +952,8 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": config.UnknownVariableValue +
-					config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{
+					config.UnknownVariableValue, "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -1047,6 +1047,16 @@ func TestSchemaMap_Diff(t *testing.T) {
 						Old: "2",
 						New: "0",
 					},
+					"ports.1": &terraform.ResourceAttrDiff{
+						Old:        "1",
+						New:        "0",
+						NewRemoved: true,
+					},
+					"ports.2": &terraform.ResourceAttrDiff{
+						Old:        "2",
+						New:        "0",
+						NewRemoved: true,
+					},
 				},
 			},
 
@@ -2064,6 +2074,11 @@ func TestSchemaMap_Diff(t *testing.T) {
 						New:         "0",
 						RequiresNew: true,
 					},
+					"instances.3": &terraform.ResourceAttrDiff{
+						Old:        "foo",
+						New:        "",
+						NewRemoved: true,
+					},
 				},
 			},
 
@@ -2348,6 +2363,59 @@ func TestSchemaMap_Diff(t *testing.T) {
 
 			Err: false,
 		},
+
+		// #60 - Removing set elements
+		{
+			Schema: map[string]*Schema{
+				"instances": &Schema{
+					Type:     TypeSet,
+					Elem:     &Schema{Type: TypeString},
+					Optional: true,
+					ForceNew: true,
+					Set: func(v interface{}) int {
+						return len(v.(string))
+					},
+				},
+			},
+
+			State: &terraform.InstanceState{
+				Attributes: map[string]string{
+					"instances.#": "2",
+					"instances.3": "333",
+					"instances.2": "22",
+				},
+			},
+
+			Config: map[string]interface{}{
+				"instances": []interface{}{"333", "4444"},
+			},
+
+			Diff: &terraform.InstanceDiff{
+				Attributes: map[string]*terraform.ResourceAttrDiff{
+					"instances.#": &terraform.ResourceAttrDiff{
+						Old: "2",
+						New: "2",
+					},
+					"instances.2": &terraform.ResourceAttrDiff{
+						Old:        "22",
+						New:        "",
+						NewRemoved: true,
+					},
+					"instances.3": &terraform.ResourceAttrDiff{
+						Old:         "333",
+						New:         "333",
+						RequiresNew: true,
+					},
+					"instances.4": &terraform.ResourceAttrDiff{
+						Old:         "",
+						New:         "4444",
+						RequiresNew: true,
+					},
+				},
+			},
+
+			Err: false,
+		},
 	}
 
 	for i, tc := range cases {
@@ -2537,6 +2605,40 @@ func TestSchemaMap_Input(t *testing.T) {
 	}
 }
 
+func TestSchemaMap_InputDefault(t *testing.T) {
+	emptyConfig := make(map[string]interface{})
+	c, err := config.NewRawConfig(emptyConfig)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	rc := terraform.NewResourceConfig(c)
+	rc.Config = make(map[string]interface{})
+
+	input := new(terraform.MockUIInput)
+	input.InputFn = func(opts *terraform.InputOpts) (string, error) {
+		t.Fatalf("InputFn should not be called on: %#v", opts)
+		return "", nil
+	}
+
+	schema := map[string]*Schema{
+		"availability_zone": &Schema{
+			Type:     TypeString,
+			Default:  "foo",
+			Optional: true,
+		},
+	}
+	actual, err := schemaMap(schema).Input(input, rc)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := map[string]interface{}{}
+
+	if !reflect.DeepEqual(expected, actual.Config) {
+		t.Fatalf("got: %#v\nexpected: %#v", actual.Config, expected)
+	}
+}
+
 func TestSchemaMap_InternalValidate(t *testing.T) {
 	cases := []struct {
 		In  map[string]*Schema
@@ -2796,6 +2898,20 @@ func TestSchemaMap_InternalValidate(t *testing.T) {
 			},
 			false,
 		},
+
+		// ValidateFunc on non-primitive
+		{
+			map[string]*Schema{
+				"foo": &Schema{
+					Type:     TypeMap,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						return
+					},
+				},
+			},
+			true,
+		},
 	}
 
 	for i, tc := range cases {
@@ -2967,6 +3083,29 @@ func TestSchemaMap_Validate(t *testing.T) {
 			Err: false,
 		},
 
+		"Sub-resource is the wrong type": {
+			Schema: map[string]*Schema{
+				"ingress": &Schema{
+					Type:     TypeList,
+					Required: true,
+					Elem: &Resource{
+						Schema: map[string]*Schema{
+							"from": &Schema{
+								Type:     TypeInt,
+								Required: true,
+							},
+						},
+					},
+				},
+			},
+
+			Config: map[string]interface{}{
+				"ingress": []interface{}{"foo"},
+			},
+
+			Err: true,
+		},
+
 		"Not a list": {
 			Schema: map[string]*Schema{
 				"ingress": &Schema{
@@ -3399,9 +3538,101 @@ func TestSchemaMap_Validate(t *testing.T) {
 
 			Err: true,
 			Errors: []error{
-				fmt.Errorf("\"optional_att\": conflicts with required_att (\"required-val\")"),
+				fmt.Errorf(`"optional_att": conflicts with required_att ("required-val")`),
 			},
 		},
+
+		"Good with ValidateFunc": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "valid",
+			},
+			Err: false,
+		},
+
+		"Bad with ValidateFunc": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						es = append(es, fmt.Errorf("something is not right here"))
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "invalid",
+			},
+			Err: true,
+			Errors: []error{
+				fmt.Errorf(`something is not right here`),
+			},
+		},
+
+		"ValidateFunc not called when type does not match": {
+			Schema: map[string]*Schema{
+				"number": &Schema{
+					Type:     TypeInt,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						t.Fatalf("Should not have gotten validate call")
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"number": "NaN",
+			},
+			Err: true,
+		},
+
+		"ValidateFunc gets decoded type": {
+			Schema: map[string]*Schema{
+				"maybe": &Schema{
+					Type:     TypeBool,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						if _, ok := v.(bool); !ok {
+							t.Fatalf("Expected bool, got: %#v", v)
+						}
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"maybe": "true",
+			},
+		},
+
+		"ValidateFunc is not called with a computed value": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						es = append(es, fmt.Errorf("something is not right here"))
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "${var.foo}",
+			},
+			Vars: map[string]string{
+				"var.foo": config.UnknownVariableValue,
+			},
+
+			Err: false,
+		},
 	}
 
 	for tn, tc := range cases {
diff --git a/helper/schema/set.go b/helper/schema/set.go
index 7176b8630..8d21866df 100644
--- a/helper/schema/set.go
+++ b/helper/schema/set.go
@@ -74,7 +74,7 @@ func (s *Set) List() []interface{} {
 	return result
 }
 
-// Differences performs a set difference of the two sets, returning
+// Difference performs a set difference of the two sets, returning
 // a new third set that has only the elements unique to this set.
 func (s *Set) Difference(other *Set) *Set {
 	result := &Set{F: s.F}
diff --git a/helper/schema/valuetype_string.go b/helper/schema/valuetype_string.go
index fec00944e..42442a46b 100644
--- a/helper/schema/valuetype_string.go
+++ b/helper/schema/valuetype_string.go
@@ -9,7 +9,7 @@ const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTy
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
-	if i < 0 || i+1 >= ValueType(len(_ValueType_index)) {
+	if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
 		return fmt.Sprintf("ValueType(%d)", i)
 	}
 	return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
diff --git a/main.go b/main.go
index abd0e18e3..168583107 100644
--- a/main.go
+++ b/main.go
@@ -101,10 +101,6 @@ func wrappedMain() int {
 	// Make sure we clean up any managed plugins at the end of this
 	defer plugin.CleanupClients()
 
-	// Initialize the TFConfig settings for the commands...
-	ContextOpts.Providers = config.ProviderFactories()
-	ContextOpts.Provisioners = config.ProvisionerFactories()
-
 	// Get the command line args. We shortcut "--version" and "-v" to
 	// just show the version.
 	args := os.Args[1:]
diff --git a/panic.go b/panic.go
index d8e4b9eb9..7ea4da713 100644
--- a/panic.go
+++ b/panic.go
@@ -19,6 +19,10 @@ A crash log has been placed at "crash.log" relative to your current
 working directory. It would be immensely helpful if you could please
 report the crash with Terraform[1] so that we can fix this.
 
+When reporting bugs, please include your terraform version. That
+information is available on the first line of crash.log. You can also
+get it by running 'terraform --version' on the command line.
+
 [1]: https://github.com/hashicorp/terraform/issues
 
 !!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!
diff --git a/rpc/resource_provider.go b/rpc/resource_provider.go
index e3fa4241c..3fe6927de 100644
--- a/rpc/resource_provider.go
+++ b/rpc/resource_provider.go
@@ -174,6 +174,10 @@ func (p *ResourceProvider) Resources() []terraform.ResourceType {
 	return result
 }
 
+func (p *ResourceProvider) Close() error {
+	return p.Client.Close()
+}
+
 // ResourceProviderServer is a net/rpc compatible structure for serving
 // a ResourceProvider. This should not be used directly.
 type ResourceProviderServer struct {
diff --git a/rpc/resource_provider_test.go b/rpc/resource_provider_test.go
index 91cf38bfe..3efdbce25 100644
--- a/rpc/resource_provider_test.go
+++ b/rpc/resource_provider_test.go
@@ -488,3 +488,31 @@ func TestResourceProvider_validateResource_warns(t *testing.T) {
 		t.Fatalf("bad: %#v", w)
 	}
 }
+
+func TestResourceProvider_close(t *testing.T) {
+	client, _ := testNewClientServer(t)
+	defer client.Close()
+
+	provider, err := client.ResourceProvider()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	var p interface{}
+	p = provider
+	pCloser, ok := p.(terraform.ResourceProviderCloser)
+	if !ok {
+		t.Fatal("should be a ResourceProviderCloser")
+	}
+
+	if err := pCloser.Close(); err != nil {
+		t.Fatalf("failed to close provider: %s", err)
+	}
+
+	// The connection should be closed now, so if we to make a
+	// new call we should get an error.
+	err = provider.Configure(&terraform.ResourceConfig{})
+	if err == nil {
+		t.Fatal("should have error")
+	}
+}
diff --git a/rpc/resource_provisioner.go b/rpc/resource_provisioner.go
index cf8c00812..715704d02 100644
--- a/rpc/resource_provisioner.go
+++ b/rpc/resource_provisioner.go
@@ -63,6 +63,10 @@ func (p *ResourceProvisioner) Apply(
 	return err
 }
 
+func (p *ResourceProvisioner) Close() error {
+	return p.Client.Close()
+}
+
 type ResourceProvisionerValidateArgs struct {
 	Config *terraform.ResourceConfig
 }
diff --git a/rpc/resource_provisioner_test.go b/rpc/resource_provisioner_test.go
index 32b6c06f3..6fabdb6d4 100644
--- a/rpc/resource_provisioner_test.go
+++ b/rpc/resource_provisioner_test.go
@@ -132,3 +132,34 @@ func TestResourceProvisioner_validate_warns(t *testing.T) {
 		t.Fatalf("bad: %#v", w)
 	}
 }
+
+func TestResourceProvisioner_close(t *testing.T) {
+	client, _ := testNewClientServer(t)
+	defer client.Close()
+
+	provisioner, err := client.ResourceProvisioner()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	var p interface{}
+	p = provisioner
+	pCloser, ok := p.(terraform.ResourceProvisionerCloser)
+	if !ok {
+		t.Fatal("should be a ResourceProvisionerCloser")
+	}
+
+	if err := pCloser.Close(); err != nil {
+		t.Fatalf("failed to close provisioner: %s", err)
+	}
+
+	// The connection should be closed now, so if we to make a
+	// new call we should get an error.
+	o := &terraform.MockUIOutput{}
+	s := &terraform.InstanceState{}
+	c := &terraform.ResourceConfig{}
+	err = provisioner.Apply(o, s, c)
+	if err == nil {
+		t.Fatal("should have error")
+	}
+}
diff --git a/scripts/build.sh b/scripts/build.sh
index afa9258d4..2553f5b6f 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,7 +1,6 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This script builds the application from source for multiple platforms.
-set -e
 
 # Get the parent directory of where this script is.
 SOURCE="${BASH_SOURCE[0]}"
diff --git a/scripts/dist.sh b/scripts/dist.sh
index fdd531dce..00038e3ac 100755
--- a/scripts/dist.sh
+++ b/scripts/dist.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 # Get the version from the command line
diff --git a/scripts/website_push.sh b/scripts/website_push.sh
index fafcbd70c..03017e87a 100755
--- a/scripts/website_push.sh
+++ b/scripts/website_push.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Get the parent directory of where this script is.
 SOURCE="${BASH_SOURCE[0]}"
diff --git a/state/remote/http.go b/state/remote/http.go
index 8b410fb3d..1aca7652f 100644
--- a/state/remote/http.go
+++ b/state/remote/http.go
@@ -3,11 +3,13 @@ package remote
 import (
 	"bytes"
 	"crypto/md5"
+	"crypto/tls"
 	"encoding/base64"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 )
 
 func httpFactory(conf map[string]string) (Client, error) {
@@ -24,18 +26,38 @@ func httpFactory(conf map[string]string) (Client, error) {
 		return nil, fmt.Errorf("address must be HTTP or HTTPS")
 	}
 
+	client := &http.Client{}
+	if skipRaw, ok := conf["skip_cert_verification"]; ok {
+		skip, err := strconv.ParseBool(skipRaw)
+		if err != nil {
+			return nil, fmt.Errorf("skip_cert_verification must be boolean")
+		}
+		if skip {
+			// Replace the client with one that ignores TLS verification
+			client = &http.Client{
+				Transport: &http.Transport{
+					TLSClientConfig: &tls.Config{
+						InsecureSkipVerify: true,
+					},
+				},
+			}
+		}
+	}
+
 	return &HTTPClient{
-		URL: url,
+		URL:    url,
+		Client: client,
 	}, nil
 }
 
-// HTTPClient is a remote client that stores data in Consul.
+// HTTPClient is a remote client that stores data in Consul or HTTP REST.
 type HTTPClient struct {
-	URL *url.URL
+	URL    *url.URL
+	Client *http.Client
 }
 
 func (c *HTTPClient) Get() (*Payload, error) {
-	resp, err := http.Get(c.URL.String())
+	resp, err := c.Client.Get(c.URL.String())
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +132,6 @@ func (c *HTTPClient) Put(data []byte) error {
 		}
 	*/
 
-	// Make the HTTP client and request
 	req, err := http.NewRequest("POST", base.String(), bytes.NewReader(data))
 	if err != nil {
 		return fmt.Errorf("Failed to make HTTP request: %s", err)
@@ -122,7 +143,7 @@ func (c *HTTPClient) Put(data []byte) error {
 	req.ContentLength = int64(len(data))
 
 	// Make the request
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := c.Client.Do(req)
 	if err != nil {
 		return fmt.Errorf("Failed to upload state: %v", err)
 	}
@@ -138,14 +159,13 @@ func (c *HTTPClient) Put(data []byte) error {
 }
 
 func (c *HTTPClient) Delete() error {
-	// Make the HTTP request
 	req, err := http.NewRequest("DELETE", c.URL.String(), nil)
 	if err != nil {
 		return fmt.Errorf("Failed to make HTTP request: %s", err)
 	}
 
 	// Make the request
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := c.Client.Do(req)
 	if err != nil {
 		return fmt.Errorf("Failed to delete state: %s", err)
 	}
diff --git a/state/remote/http_test.go b/state/remote/http_test.go
index e5cdbed88..e6e7297c1 100644
--- a/state/remote/http_test.go
+++ b/state/remote/http_test.go
@@ -24,7 +24,7 @@ func TestHTTPClient(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
-	client := &HTTPClient{URL: url}
+	client := &HTTPClient{URL: url, Client: http.DefaultClient}
 	testClient(t, client)
 }
 
diff --git a/state/remote/remote.go b/state/remote/remote.go
index cb525e6a3..7ebea3222 100644
--- a/state/remote/remote.go
+++ b/state/remote/remote.go
@@ -40,6 +40,7 @@ var BuiltinClients = map[string]Factory{
 	"consul": consulFactory,
 	"http":   httpFactory,
 	"s3":     s3Factory,
+	"swift":  swiftFactory,
 
 	// This is used for development purposes only.
 	"_local": fileFactory,
diff --git a/state/remote/s3.go b/state/remote/s3.go
index 6db07d070..c98fe9712 100644
--- a/state/remote/s3.go
+++ b/state/remote/s3.go
@@ -5,10 +5,12 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strconv"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/credentials"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func s3Factory(conf map[string]string) (Client, error) {
@@ -31,6 +33,17 @@ func s3Factory(conf map[string]string) (Client, error) {
 		}
 	}
 
+	serverSideEncryption := false
+	if raw, ok := conf["encrypt"]; ok {
+		v, err := strconv.ParseBool(raw)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"'encrypt' field couldn't be parsed as bool: %s", err)
+		}
+
+		serverSideEncryption = v
+	}
+
 	accessKeyId := conf["access_key"]
 	secretAccessKey := conf["secret_key"]
 
@@ -59,16 +72,18 @@ func s3Factory(conf map[string]string) (Client, error) {
 	nativeClient := s3.New(awsConfig)
 
 	return &S3Client{
-		nativeClient: nativeClient,
-		bucketName:   bucketName,
-		keyName:      keyName,
+		nativeClient:         nativeClient,
+		bucketName:           bucketName,
+		keyName:              keyName,
+		serverSideEncryption: serverSideEncryption,
 	}, nil
 }
 
 type S3Client struct {
-	nativeClient *s3.S3
-	bucketName   string
-	keyName      string
+	nativeClient         *s3.S3
+	bucketName           string
+	keyName              string
+	serverSideEncryption bool
 }
 
 func (c *S3Client) Get() (*Payload, error) {
@@ -78,8 +93,8 @@ func (c *S3Client) Get() (*Payload, error) {
 	})
 
 	if err != nil {
-		if awserr := aws.Error(err); awserr != nil {
-			if awserr.Code == "NoSuchKey" {
+		if awserr := err.(awserr.Error); awserr != nil {
+			if awserr.Code() == "NoSuchKey" {
 				return nil, nil
 			} else {
 				return nil, err
@@ -112,15 +127,19 @@ func (c *S3Client) Put(data []byte) error {
 	contentType := "application/octet-stream"
 	contentLength := int64(len(data))
 
-	_, err := c.nativeClient.PutObject(&s3.PutObjectInput{
+	i := &s3.PutObjectInput{
 		ContentType:   &contentType,
 		ContentLength: &contentLength,
 		Body:          bytes.NewReader(data),
 		Bucket:        &c.bucketName,
 		Key:           &c.keyName,
-	})
+	}
 
-	if err == nil {
+	if c.serverSideEncryption {
+		i.ServerSideEncryption = aws.String("AES256")
+	}
+
+	if _, err := c.nativeClient.PutObject(i); err == nil {
 		return nil
 	} else {
 		return fmt.Errorf("Failed to upload state: %v", err)
diff --git a/state/remote/s3_test.go b/state/remote/s3_test.go
index ca7ec4879..d9e99982e 100644
--- a/state/remote/s3_test.go
+++ b/state/remote/s3_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func TestS3Client_impl(t *testing.T) {
@@ -28,6 +28,8 @@ func TestS3Factory(t *testing.T) {
 	config["region"] = "us-west-1"
 	config["bucket"] = "foo"
 	config["key"] = "bar"
+	config["encrypt"] = "1"
+
 	// For this test we'll provide the credentials as config. The
 	// acceptance tests implicitly test passing credentials as
 	// environment variables.
@@ -80,11 +82,13 @@ func TestS3Client(t *testing.T) {
 
 	bucketName := fmt.Sprintf("terraform-remote-s3-test-%x", time.Now().Unix())
 	keyName := "testState"
+	testData := []byte(`testing data`)
 
 	config := make(map[string]string)
 	config["region"] = regionName
 	config["bucket"] = bucketName
 	config["key"] = keyName
+	config["encrypt"] = "1"
 
 	client, err := s3Factory(config)
 	if err != nil {
@@ -105,6 +109,13 @@ func TestS3Client(t *testing.T) {
 	if err != nil {
 		t.Skipf("Failed to create test S3 bucket, so skipping")
 	}
+
+	// Ensure we can perform a PUT request with the encryption header
+	err = s3Client.Put(testData)
+	if err != nil {
+		t.Logf("WARNING: Failed to send test data to S3 bucket. (error was %s)", err)
+	}
+
 	defer func() {
 		deleteBucketReq := &s3.DeleteBucketInput{
 			Bucket: &bucketName,
diff --git a/state/remote/swift.go b/state/remote/swift.go
new file mode 100644
index 000000000..3f9c88d69
--- /dev/null
+++ b/state/remote/swift.go
@@ -0,0 +1,114 @@
+package remote
+
+import (
+	"bytes"
+	"crypto/md5"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/rackspace/gophercloud"
+	"github.com/rackspace/gophercloud/openstack"
+	"github.com/rackspace/gophercloud/openstack/objectstorage/v1/containers"
+	"github.com/rackspace/gophercloud/openstack/objectstorage/v1/objects"
+)
+
+const TFSTATE_NAME = "tfstate.tf"
+
+// SwiftClient implements the Client interface for an Openstack Swift server.
+type SwiftClient struct {
+	client *gophercloud.ServiceClient
+	path   string
+}
+
+func swiftFactory(conf map[string]string) (Client, error) {
+	client := &SwiftClient{}
+
+	if err := client.validateConfig(conf); err != nil {
+		return nil, err
+	}
+
+	return client, nil
+}
+
+func (c *SwiftClient) validateConfig(conf map[string]string) (err error) {
+	if val := os.Getenv("OS_AUTH_URL"); val == "" {
+		return fmt.Errorf("missing OS_AUTH_URL environment variable")
+	}
+	if val := os.Getenv("OS_USERNAME"); val == "" {
+		return fmt.Errorf("missing OS_USERNAME environment variable")
+	}
+	if val := os.Getenv("OS_TENANT_NAME"); val == "" {
+		return fmt.Errorf("missing OS_TENANT_NAME environment variable")
+	}
+	if val := os.Getenv("OS_PASSWORD"); val == "" {
+		return fmt.Errorf("missing OS_PASSWORD environment variable")
+	}
+	path, ok := conf["path"]
+	if !ok || path == "" {
+		return fmt.Errorf("missing 'path' configuration")
+	}
+
+	provider, err := openstack.AuthenticatedClient(gophercloud.AuthOptions{
+		IdentityEndpoint: os.Getenv("OS_AUTH_URL"),
+		Username:         os.Getenv("OS_USERNAME"),
+		TenantName:       os.Getenv("OS_TENANT_NAME"),
+		Password:         os.Getenv("OS_PASSWORD"),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	c.path = path
+	c.client, err = openstack.NewObjectStorageV1(provider, gophercloud.EndpointOpts{
+		Region: os.Getenv("OS_REGION_NAME"),
+	})
+
+	return err
+}
+
+func (c *SwiftClient) Get() (*Payload, error) {
+	result := objects.Download(c.client, c.path, TFSTATE_NAME, nil)
+	bytes, err := result.ExtractContent()
+
+	if err != nil {
+		if strings.Contains(err.Error(), "but got 404 instead") {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	hash := md5.Sum(bytes)
+	payload := &Payload{
+		Data: bytes,
+		MD5:  hash[:md5.Size],
+	}
+
+	return payload, nil
+}
+
+func (c *SwiftClient) Put(data []byte) error {
+	if err := c.ensureContainerExists(); err != nil {
+		return err
+	}
+
+	reader := bytes.NewReader(data)
+	result := objects.Create(c.client, c.path, TFSTATE_NAME, reader, nil)
+
+	return result.Err
+}
+
+func (c *SwiftClient) Delete() error {
+	result := objects.Delete(c.client, c.path, TFSTATE_NAME, nil)
+	return result.Err
+}
+
+func (c *SwiftClient) ensureContainerExists() error {
+	result := containers.Create(c.client, c.path, nil)
+	if result.Err != nil {
+		return result.Err
+	}
+
+	return nil
+}
diff --git a/state/remote/swift_test.go b/state/remote/swift_test.go
new file mode 100644
index 000000000..c27de8e73
--- /dev/null
+++ b/state/remote/swift_test.go
@@ -0,0 +1,31 @@
+package remote
+
+import (
+	"net/http"
+	"os"
+	"testing"
+)
+
+func TestSwiftClient_impl(t *testing.T) {
+	var _ Client = new(SwiftClient)
+}
+
+func TestSwiftClient(t *testing.T) {
+	os_auth_url := os.Getenv("OS_AUTH_URL")
+	if os_auth_url == "" {
+		t.Skipf("skipping, OS_AUTH_URL and friends must be set")
+	}
+
+	if _, err := http.Get(os_auth_url); err != nil {
+		t.Skipf("skipping, unable to reach %s: %s", os_auth_url, err)
+	}
+
+	client, err := swiftFactory(map[string]string{
+		"path": "swift_test",
+	})
+	if err != nil {
+		t.Fatalf("bad: %s", err)
+	}
+
+	testClient(t, client)
+}
diff --git a/terraform/context.go b/terraform/context.go
index 66e954245..be01a492a 100644
--- a/terraform/context.go
+++ b/terraform/context.go
@@ -3,7 +3,9 @@ package terraform
 import (
 	"fmt"
 	"log"
+	"os"
 	"sort"
+	"strings"
 	"sync"
 
 	"github.com/hashicorp/go-multierror"
@@ -98,6 +100,26 @@ func NewContext(opts *ContextOpts) *Context {
 		par = 10
 	}
 
+	// Setup the variables. We first take the variables given to us.
+	// We then merge in the variables set in the environment.
+	variables := make(map[string]string)
+	for _, v := range os.Environ() {
+		if !strings.HasPrefix(v, VarEnvPrefix) {
+			continue
+		}
+
+		// Strip off the prefix and get the value after the first "="
+		idx := strings.Index(v, "=")
+		k := v[len(VarEnvPrefix):idx]
+		v = v[idx+1:]
+
+		// Override the command-line set variable
+		variables[k] = v
+	}
+	for k, v := range opts.Variables {
+		variables[k] = v
+	}
+
 	return &Context{
 		destroy:      opts.Destroy,
 		diff:         opts.Diff,
@@ -108,7 +130,7 @@ func NewContext(opts *ContextOpts) *Context {
 		state:        state,
 		targets:      opts.Targets,
 		uiInput:      opts.UIInput,
-		variables:    opts.Variables,
+		variables:    variables,
 
 		parallelSem:         NewSemaphore(par),
 		providerInputConfig: make(map[string]map[string]interface{}),
@@ -172,7 +194,7 @@ func (c *Context) Input(mode InputMode) error {
 		}
 		sort.Strings(names)
 		for _, n := range names {
-			// If we only care about unset variables, then if the variabel
+			// If we only care about unset variables, then if the variable
 			// is set, continue on.
 			if mode&InputModeVarUnset != 0 {
 				if _, ok := c.variables[n]; ok {
@@ -192,9 +214,13 @@ func (c *Context) Input(mode InputMode) error {
 				panic(fmt.Sprintf("Unknown variable type: %#v", v.Type()))
 			}
 
-			var defaultString string
-			if v.Default != nil {
-				defaultString = v.Default.(string)
+			// If the variable is not already set, and the variable defines a
+			// default, use that for the value.
+			if _, ok := c.variables[n]; !ok {
+				if v.Default != nil {
+					c.variables[n] = v.Default.(string)
+					continue
+				}
 			}
 
 			// Ask the user for a value for this variable
@@ -204,7 +230,6 @@ func (c *Context) Input(mode InputMode) error {
 				value, err = c.uiInput.Input(&InputOpts{
 					Id:          fmt.Sprintf("var.%s", n),
 					Query:       fmt.Sprintf("var.%s", n),
-					Default:     defaultString,
 					Description: v.Description,
 				})
 				if err != nil {
@@ -412,6 +437,12 @@ func (c *Context) Validate() ([]string, []error) {
 		}
 	}
 
+	// If we have errors at this point, the graphing has no chance,
+	// so just bail early.
+	if errs != nil {
+		return nil, []error{errs}
+	}
+
 	// Build the graph so we can walk it and run Validate on nodes.
 	// We also validate the graph generated here, but this graph doesn't
 	// necessarily match the graph that Plan will generate, so we'll validate the
diff --git a/terraform/context_apply_test.go b/terraform/context_apply_test.go
new file mode 100644
index 000000000..2f4d43296
--- /dev/null
+++ b/terraform/context_apply_test.go
@@ -0,0 +1,3472 @@
+package terraform
+
+import (
+	"fmt"
+	"os"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestContext2Apply(t *testing.T) {
+	m := testModule(t, "apply-good")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) < 2 {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_providerAlias(t *testing.T) {
+	m := testModule(t, "apply-provider-alias")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) < 2 {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProviderAliasStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_emptyModule(t *testing.T) {
+	m := testModule(t, "apply-empty-module")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	actual = strings.Replace(actual, "  ", "", -1)
+	expected := strings.TrimSpace(testTerraformApplyEmptyModuleStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s\nexpect:\n%s", actual, expected)
+	}
+}
+
+func TestContext2Apply_createBeforeDestroy(t *testing.T) {
+	m := testModule(t, "apply-good-create-before")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "abc",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	if p, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	} else {
+		t.Logf(p.String())
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 1 {
+		t.Fatalf("bad: %s", state)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCreateBeforeStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_createBeforeDestroyUpdate(t *testing.T) {
+	m := testModule(t, "apply-good-create-before-update")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo": "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	if p, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	} else {
+		t.Logf(p.String())
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 1 {
+		t.Fatalf("bad: %s", state)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCreateBeforeUpdateStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_minimal(t *testing.T) {
+	m := testModule(t, "apply-minimal")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyMinimalStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_badDiff(t *testing.T) {
+	m := testModule(t, "apply-good")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"newp": nil,
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Apply(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
+func TestContext2Apply_cancel(t *testing.T) {
+	stopped := false
+
+	m := testModule(t, "apply-cancel")
+	p := testProvider("aws")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ApplyFn = func(*InstanceInfo, *InstanceState, *InstanceDiff) (*InstanceState, error) {
+		if !stopped {
+			stopped = true
+			go ctx.Stop()
+
+			for {
+				if ctx.sh.Stopped() {
+					break
+				}
+			}
+		}
+
+		return &InstanceState{
+			ID: "foo",
+			Attributes: map[string]string{
+				"num": "2",
+			},
+		}, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					New: "bar",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Start the Apply in a goroutine
+	stateCh := make(chan *State)
+	go func() {
+		state, err := ctx.Apply()
+		if err != nil {
+			panic(err)
+		}
+
+		stateCh <- state
+	}()
+
+	state := <-stateCh
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 1 {
+		t.Fatalf("bad: %s", state.String())
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCancelStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_compute(t *testing.T) {
+	m := testModule(t, "apply-compute")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	ctx.variables = map[string]string{"value": "1"}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyComputeStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_countDecrease(t *testing.T) {
+	m := testModule(t, "apply-count-dec")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.1": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.2": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCountDecStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_countDecreaseToOne(t *testing.T) {
+	m := testModule(t, "apply-count-dec-one")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.1": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+					"aws_instance.foo.2": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCountDecToOneStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+// https://github.com/PeoplePerHour/terraform/pull/11
+//
+// This tests a case where both a "resource" and "resource.0" are in
+// the state file, which apparently is a reasonable backwards compatibility
+// concern found in the above 3rd party repo.
+func TestContext2Apply_countDecreaseToOneCorrupted(t *testing.T) {
+	m := testModule(t, "apply-count-dec-one")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+							Attributes: map[string]string{
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if p, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	} else {
+		testStringMatch(t, p, testTerraformApplyCountDecToOneCorruptedPlanStr)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCountDecToOneCorruptedStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_countTainted(t *testing.T) {
+	m := testModule(t, "apply-count-tainted")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+								Attributes: map[string]string{
+									"foo":  "foo",
+									"type": "aws_instance",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCountTaintedStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_countVariable(t *testing.T) {
+	m := testModule(t, "apply-count-variable")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyCountVariableStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_module(t *testing.T) {
+	m := testModule(t, "apply-module")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleDestroyOrder(t *testing.T) {
+	m := testModule(t, "apply-module-destroy-order")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+
+	// Create a custom apply function to track the order they were destroyed
+	var order []string
+	var orderLock sync.Mutex
+	p.ApplyFn = func(
+		info *InstanceInfo,
+		is *InstanceState,
+		id *InstanceDiff) (*InstanceState, error) {
+		orderLock.Lock()
+		defer orderLock.Unlock()
+
+		order = append(order, is.ID)
+		return nil, nil
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.b": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "b",
+						},
+					},
+				},
+			},
+
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.a": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "a",
+						},
+					},
+				},
+				Outputs: map[string]string{
+					"a_output": "a",
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State:   state,
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := []string{"b", "a"}
+	if !reflect.DeepEqual(order, expected) {
+		t.Fatalf("bad: %#v", order)
+	}
+
+	{
+		actual := strings.TrimSpace(state.String())
+		expected := strings.TrimSpace(testTerraformApplyModuleDestroyOrderStr)
+		if actual != expected {
+			t.Fatalf("bad: \n%s", actual)
+		}
+	}
+}
+
+func TestContext2Apply_moduleOrphanProvider(t *testing.T) {
+	m := testModule(t, "apply-module-orphan-provider-inherit")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		if _, ok := c.Get("value"); !ok {
+			return fmt.Errorf("value is not found")
+		}
+
+		return nil
+	}
+
+	// Create a state with an orphan module
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		State:  state,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// This tests an issue where all the providers in a module but not
+// in the root weren't being added to the root properly. In this test
+// case: aws is explicitly added to root, but "test" should be added to.
+// With the bug, it wasn't.
+func TestContext2Apply_moduleOnlyProvider(t *testing.T) {
+	m := testModule(t, "apply-module-only-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pTest := testProvider("test")
+	pTest.ApplyFn = testApplyFn
+	pTest.DiffFn = testDiffFn
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(pTest),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleOnlyProviderStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleProviderAlias(t *testing.T) {
+	m := testModule(t, "apply-module-provider-alias")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleProviderAliasStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleProviderAliasTargets(t *testing.T) {
+	m := testModule(t, "apply-module-provider-alias")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"no.thing"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(`
+<no state>
+	`)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleProviderCloseNested(t *testing.T) {
+	m := testModule(t, "apply-module-provider-close-nested")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: []string{"root", "child", "subchild"},
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Apply_moduleVarResourceCount(t *testing.T) {
+	m := testModule(t, "apply-module-var-resource-count")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"count": "2",
+		},
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	ctx = testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"count": "5",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// GH-819
+func TestContext2Apply_moduleBool(t *testing.T) {
+	m := testModule(t, "apply-module-bool")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleBoolStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_multiProvider(t *testing.T) {
+	m := testModule(t, "apply-multi-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	pDO := testProvider("do")
+	pDO.ApplyFn = testApplyFn
+	pDO.DiffFn = testDiffFn
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+			"do":  testProviderFuncFixed(pDO),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) < 2 {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyMultiProviderStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_multiVar(t *testing.T) {
+	m := testModule(t, "apply-multi-var")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	// First, apply with a count of 3
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"count": "3",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := state.RootModule().Outputs["output"]
+	expected := "bar0,bar1,bar2"
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Apply again, reduce the count to 1
+	{
+		ctx := testContext2(t, &ContextOpts{
+			Module: m,
+			State:  state,
+			Providers: map[string]ResourceProviderFactory{
+				"aws": testProviderFuncFixed(p),
+			},
+			Variables: map[string]string{
+				"count": "1",
+			},
+		})
+
+		if _, err := ctx.Plan(); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		state, err := ctx.Apply()
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		actual := state.RootModule().Outputs["output"]
+		expected := "bar0"
+		if actual != expected {
+			t.Fatalf("bad: \n%s", actual)
+		}
+	}
+}
+
+func TestContext2Apply_nilDiff(t *testing.T) {
+	m := testModule(t, "apply-good")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return nil, nil
+	}
+
+	if _, err := ctx.Apply(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
+func TestContext2Apply_outputOrphan(t *testing.T) {
+	m := testModule(t, "apply-output-orphan")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Outputs: map[string]string{
+					"foo": "bar",
+					"bar": "baz",
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyOutputOrphanStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_providerComputedVar(t *testing.T) {
+	m := testModule(t, "apply-provider-computed")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	pTest := testProvider("test")
+	pTest.ApplyFn = testApplyFn
+	pTest.DiffFn = testDiffFn
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(pTest),
+		},
+	})
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		if c.IsComputed("value") {
+			return fmt.Errorf("value is computed")
+		}
+
+		v, ok := c.Get("value")
+		if !ok {
+			return fmt.Errorf("value is not found")
+		}
+		if v != "yes" {
+			return fmt.Errorf("value is not 'yes': %v", v)
+		}
+
+		return nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Apply_Provisioner_compute(t *testing.T) {
+	m := testModule(t, "apply-provisioner-compute")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["foo"]
+		if !ok || val != "computed_dynamical" {
+			t.Fatalf("bad value for foo: %v %#v", val, c)
+		}
+
+		return nil
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		Variables: map[string]string{
+			"value": "1",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+func TestContext2Apply_provisionerCreateFail(t *testing.T) {
+	m := testModule(t, "apply-provisioner-fail-create")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.DiffFn = testDiffFn
+
+	p.ApplyFn = func(
+		info *InstanceInfo,
+		is *InstanceState,
+		id *InstanceDiff) (*InstanceState, error) {
+		is.ID = "foo"
+		return is, fmt.Errorf("error")
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_provisionerCreateFailNoId(t *testing.T) {
+	m := testModule(t, "apply-provisioner-fail-create")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.DiffFn = testDiffFn
+
+	p.ApplyFn = func(
+		info *InstanceInfo,
+		is *InstanceState,
+		id *InstanceDiff) (*InstanceState, error) {
+		return nil, fmt.Errorf("error")
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateNoIdStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_provisionerFail(t *testing.T) {
+	m := testModule(t, "apply-provisioner-fail")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	pr.ApplyFn = func(*InstanceState, *ResourceConfig) error {
+		return fmt.Errorf("EXPLOSION")
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		Variables: map[string]string{
+			"value": "1",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerFailStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_provisionerFail_createBeforeDestroy(t *testing.T) {
+	m := testModule(t, "apply-provisioner-fail-create-before")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(*InstanceState, *ResourceConfig) error {
+		return fmt.Errorf("EXPLOSION")
+	}
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "abc",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		State: state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateBeforeDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_error_createBeforeDestroy(t *testing.T) {
+	m := testModule(t, "apply-error-create-before")
+	p := testProvider("aws")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "abc",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
+		return nil, fmt.Errorf("error")
+	}
+	p.DiffFn = testDiffFn
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyErrorCreateBeforeDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s\n\nExpected:\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Apply_errorDestroy_createBeforeDestroy(t *testing.T) {
+	m := testModule(t, "apply-error-create-before")
+	p := testProvider("aws")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "abc",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
+		// Fail the destroy!
+		if id.Destroy {
+			return is, fmt.Errorf("error")
+		}
+
+		// Create should work
+		is = &InstanceState{
+			ID: "foo",
+		}
+		return is, nil
+	}
+	p.DiffFn = testDiffFn
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyErrorDestroyCreateBeforeDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad: actual:\n%s\n\nexpected:\n%s", actual, expected)
+	}
+}
+
+func TestContext2Apply_multiDepose_createBeforeDestroy(t *testing.T) {
+	m := testModule(t, "apply-multi-depose-create-before-destroy")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ps := map[string]ResourceProviderFactory{"aws": testProviderFuncFixed(p)}
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type:    "aws_instance",
+						Primary: &InstanceState{ID: "foo"},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module:    m,
+		Providers: ps,
+		State:     state,
+	})
+	createdInstanceId := "bar"
+	// Create works
+	createFunc := func(is *InstanceState) (*InstanceState, error) {
+		return &InstanceState{ID: createdInstanceId}, nil
+	}
+	// Destroy starts broken
+	destroyFunc := func(is *InstanceState) (*InstanceState, error) {
+		return is, fmt.Errorf("destroy failed")
+	}
+	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
+		if id.Destroy {
+			return destroyFunc(is)
+		} else {
+			return createFunc(is)
+		}
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Destroy is broken, so even though CBD successfully replaces the instance,
+	// we'll have to save the Deposed instance to destroy later
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	checkStateString(t, state, `
+aws_instance.web: (1 deposed)
+  ID = bar
+  Deposed ID 1 = foo
+	`)
+
+	createdInstanceId = "baz"
+	ctx = testContext2(t, &ContextOpts{
+		Module:    m,
+		Providers: ps,
+		State:     state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// We're replacing the primary instance once again. Destroy is _still_
+	// broken, so the Deposed list gets longer
+	state, err = ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	checkStateString(t, state, `
+aws_instance.web: (2 deposed)
+  ID = baz
+  Deposed ID 1 = foo
+  Deposed ID 2 = bar
+	`)
+
+	// Destroy partially fixed!
+	destroyFunc = func(is *InstanceState) (*InstanceState, error) {
+		if is.ID == "foo" || is.ID == "baz" {
+			return nil, nil
+		} else {
+			return is, fmt.Errorf("destroy partially failed")
+		}
+	}
+
+	createdInstanceId = "qux"
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	state, err = ctx.Apply()
+	// Expect error because 1/2 of Deposed destroys failed
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	// foo and baz are now gone, bar sticks around
+	checkStateString(t, state, `
+aws_instance.web: (1 deposed)
+  ID = qux
+  Deposed ID 1 = bar
+	`)
+
+	// Destroy working fully!
+	destroyFunc = func(is *InstanceState) (*InstanceState, error) {
+		return nil, nil
+	}
+
+	createdInstanceId = "quux"
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	state, err = ctx.Apply()
+	if err != nil {
+		t.Fatal("should not have error:", err)
+	}
+
+	// And finally the state is clean
+	checkStateString(t, state, `
+aws_instance.web:
+  ID = quux
+	`)
+}
+
+func TestContext2Apply_provisionerResourceRef(t *testing.T) {
+	m := testModule(t, "apply-provisioner-resource-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["foo"]
+		if !ok || val != "2" {
+			t.Fatalf("bad value for foo: %v %#v", val, c)
+		}
+
+		return nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerResourceRefStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+func TestContext2Apply_provisionerSelfRef(t *testing.T) {
+	m := testModule(t, "apply-provisioner-self-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		val, ok := c.Config["command"]
+		if !ok || val != "bar" {
+			t.Fatalf("bad value for command: %v %#v", val, c)
+		}
+
+		return nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerSelfRefStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+func TestContext2Apply_provisionerMultiSelfRef(t *testing.T) {
+	var lock sync.Mutex
+	commands := make([]string, 0, 5)
+
+	m := testModule(t, "apply-provisioner-multi-self-ref")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		lock.Lock()
+		defer lock.Unlock()
+
+		val, ok := c.Config["command"]
+		if !ok {
+			t.Fatalf("bad value for command: %v %#v", val, c)
+		}
+
+		commands = append(commands, val.(string))
+		return nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerMultiSelfRefStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+
+	// Verify our result
+	sort.Strings(commands)
+	expectedCommands := []string{"number 0", "number 1", "number 2"}
+	if !reflect.DeepEqual(commands, expectedCommands) {
+		t.Fatalf("bad: %#v", commands)
+	}
+}
+
+// Provisioner should NOT run on a diff, only create
+func TestContext2Apply_Provisioner_Diff(t *testing.T) {
+	m := testModule(t, "apply-provisioner-diff")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		return nil
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerDiffStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+	pr.ApplyCalled = false
+
+	// Change the state to force a diff
+	mod := state.RootModule()
+	mod.Resources["aws_instance.bar"].Primary.Attributes["foo"] = "baz"
+
+	// Re-create context with state
+	ctx = testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		State: state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state2, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual = strings.TrimSpace(state2.String())
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was NOT invoked
+	if pr.ApplyCalled {
+		t.Fatalf("provisioner invoked")
+	}
+}
+
+func TestContext2Apply_outputDiffVars(t *testing.T) {
+	m := testModule(t, "apply-good")
+	p := testProvider("aws")
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.baz": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		for k, ad := range d.Attributes {
+			if ad.NewComputed {
+				return nil, fmt.Errorf("%s: computed", k)
+			}
+		}
+
+		result := s.MergeDiff(d)
+		result.ID = "foo"
+		return result, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"foo": &ResourceAttrDiff{
+					NewComputed: true,
+					Type:        DiffAttrOutput,
+				},
+				"bar": &ResourceAttrDiff{
+					New: "baz",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Apply_Provisioner_ConnInfo(t *testing.T) {
+	m := testModule(t, "apply-provisioner-conninfo")
+	p := testProvider("aws")
+	pr := testProvisioner()
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		if s.Ephemeral.ConnInfo == nil {
+			t.Fatalf("ConnInfo not initialized")
+		}
+
+		result, _ := testApplyFn(info, s, d)
+		result.Ephemeral.ConnInfo = map[string]string{
+			"type": "ssh",
+			"host": "127.0.0.1",
+			"port": "22",
+		}
+		return result, nil
+	}
+	p.DiffFn = testDiffFn
+
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		conn := rs.Ephemeral.ConnInfo
+		if conn["type"] != "telnet" {
+			t.Fatalf("Bad: %#v", conn)
+		}
+		if conn["host"] != "127.0.0.1" {
+			t.Fatalf("Bad: %#v", conn)
+		}
+		if conn["port"] != "2222" {
+			t.Fatalf("Bad: %#v", conn)
+		}
+		if conn["user"] != "superuser" {
+			t.Fatalf("Bad: %#v", conn)
+		}
+		if conn["pass"] != "test" {
+			t.Fatalf("Bad: %#v", conn)
+		}
+
+		return nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		Variables: map[string]string{
+			"value": "1",
+			"pass":  "test",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyProvisionerStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Verify apply was invoked
+	if !pr.ApplyCalled {
+		t.Fatalf("provisioner not invoked")
+	}
+}
+
+func TestContext2Apply_destroy(t *testing.T) {
+	m := testModule(t, "apply-destroy")
+	h := new(HookRecordApplyOrder)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	// First plan and apply a create operation
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Next, plan and apply a destroy operation
+	h.Active = true
+	ctx = testContext2(t, &ContextOpts{
+		Destroy: true,
+		State:   state,
+		Module:  m,
+		Hooks:   []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err = ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Test that things were destroyed
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Test that things were destroyed _in the right order_
+	expected2 := []string{"aws_instance.bar", "aws_instance.foo"}
+	actual2 := h.IDs
+	if !reflect.DeepEqual(actual2, expected2) {
+		t.Fatalf("expected: %#v\n\ngot:%#v", expected2, actual2)
+	}
+}
+
+func TestContext2Apply_destroyOutputs(t *testing.T) {
+	m := testModule(t, "apply-destroy-outputs")
+	h := new(HookRecordApplyOrder)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	// First plan and apply a create operation
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Next, plan and apply a destroy operation
+	h.Active = true
+	ctx = testContext2(t, &ContextOpts{
+		Destroy: true,
+		State:   state,
+		Module:  m,
+		Hooks:   []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err = ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) > 0 {
+		t.Fatalf("bad: %#v", mod)
+	}
+}
+
+func TestContext2Apply_destroyOrphan(t *testing.T) {
+	m := testModule(t, "apply-error")
+	p := testProvider("aws")
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.baz": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		if d.Destroy {
+			return nil, nil
+		}
+
+		result := s.MergeDiff(d)
+		result.ID = "foo"
+		return result, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					New: "bar",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if _, ok := mod.Resources["aws_instance.baz"]; ok {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+}
+
+func TestContext2Apply_destroyTaintedProvisioner(t *testing.T) {
+	m := testModule(t, "apply-destroy-provisioner")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	called := false
+	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
+		called = true
+		return nil
+	}
+
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+								Attributes: map[string]string{
+									"id": "bar",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		State:   s,
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if called {
+		t.Fatal("provisioner should not be called")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace("<no state>")
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_error(t *testing.T) {
+	errored := false
+
+	m := testModule(t, "apply-error")
+	p := testProvider("aws")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ApplyFn = func(*InstanceInfo, *InstanceState, *InstanceDiff) (*InstanceState, error) {
+		if errored {
+			state := &InstanceState{
+				ID: "bar",
+			}
+			return state, fmt.Errorf("error")
+		}
+		errored = true
+
+		return &InstanceState{
+			ID: "foo",
+			Attributes: map[string]string{
+				"num": "2",
+			},
+		}, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					New: "bar",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyErrorStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_errorPartial(t *testing.T) {
+	errored := false
+
+	m := testModule(t, "apply-error")
+	p := testProvider("aws")
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		if errored {
+			return s, fmt.Errorf("error")
+		}
+		errored = true
+
+		return &InstanceState{
+			ID: "foo",
+			Attributes: map[string]string{
+				"num": "2",
+			},
+		}, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					New: "bar",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should have error")
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 2 {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyErrorPartialStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_hook(t *testing.T) {
+	m := testModule(t, "apply-good")
+	h := new(MockHook)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !h.PreApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostStateUpdateCalled {
+		t.Fatalf("should call post state update")
+	}
+}
+
+func TestContext2Apply_hookOrphan(t *testing.T) {
+	m := testModule(t, "apply-blank")
+	h := new(MockHook)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		State:  state,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !h.PreApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostStateUpdateCalled {
+		t.Fatalf("should call post state update")
+	}
+}
+
+func TestContext2Apply_idAttr(t *testing.T) {
+	m := testModule(t, "apply-idattr")
+	p := testProvider("aws")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		result := s.MergeDiff(d)
+		result.ID = "foo"
+		result.Attributes = map[string]string{
+			"id": "bar",
+		}
+
+		return result, nil
+	}
+	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					New: "bar",
+				},
+			},
+		}, nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	rs, ok := mod.Resources["aws_instance.foo"]
+	if !ok {
+		t.Fatal("not in state")
+	}
+	if rs.Primary.ID != "foo" {
+		t.Fatalf("bad: %#v", rs.Primary.ID)
+	}
+	if rs.Primary.Attributes["id"] != "foo" {
+		t.Fatalf("bad: %#v", rs.Primary.Attributes)
+	}
+}
+
+func TestContext2Apply_output(t *testing.T) {
+	m := testModule(t, "apply-output")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyOutputStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_outputInvalid(t *testing.T) {
+	m := testModule(t, "apply-output-invalid")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err == nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !strings.Contains(err.Error(), "is not a string") {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Apply_outputList(t *testing.T) {
+	m := testModule(t, "apply-output-list")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyOutputListStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_outputMulti(t *testing.T) {
+	m := testModule(t, "apply-output-multi")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyOutputMultiStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_outputMultiIndex(t *testing.T) {
+	m := testModule(t, "apply-output-multi-index")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyOutputMultiIndexStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_taint(t *testing.T) {
+	m := testModule(t, "apply-taint")
+	p := testProvider("aws")
+
+	// destroyCount tests against regression of
+	// https://github.com/hashicorp/terraform/issues/1056
+	var destroyCount = int32(0)
+	var once sync.Once
+	simulateProviderDelay := func() {
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		once.Do(simulateProviderDelay)
+		if d.Destroy {
+			atomic.AddInt32(&destroyCount, 1)
+		}
+		return testApplyFn(info, s, d)
+	}
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "baz",
+								Attributes: map[string]string{
+									"num":  "2",
+									"type": "aws_instance",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyTaintStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	if destroyCount != 1 {
+		t.Fatalf("Expected 1 destroy, got %d", destroyCount)
+	}
+}
+
+func TestContext2Apply_taintDep(t *testing.T) {
+	m := testModule(t, "apply-taint-dep")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "baz",
+								Attributes: map[string]string{
+									"num":  "2",
+									"type": "aws_instance",
+								},
+							},
+						},
+					},
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "baz",
+								"num":  "2",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if p, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	} else {
+		t.Logf("plan: %s", p)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyTaintDepStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Apply_taintDepRequiresNew(t *testing.T) {
+	m := testModule(t, "apply-taint-dep-requires-new")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "baz",
+								Attributes: map[string]string{
+									"num":  "2",
+									"type": "aws_instance",
+								},
+							},
+						},
+					},
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "baz",
+								"num":  "2",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	if p, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	} else {
+		t.Logf("plan: %s", p)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyTaintDepRequireNewStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Apply_targeted(t *testing.T) {
+	m := testModule(t, "apply-targeted")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 1 {
+		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
+	}
+
+	checkStateString(t, state, `
+aws_instance.foo:
+  ID = foo
+  num = 2
+  type = aws_instance
+	`)
+}
+
+func TestContext2Apply_targetedCount(t *testing.T) {
+	m := testModule(t, "apply-targeted-count")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+aws_instance.foo.0:
+  ID = foo
+aws_instance.foo.1:
+  ID = foo
+aws_instance.foo.2:
+  ID = foo
+	`)
+}
+
+func TestContext2Apply_targetedCountIndex(t *testing.T) {
+	m := testModule(t, "apply-targeted-count")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo[1]"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+aws_instance.foo.1:
+  ID = foo
+	`)
+}
+
+func TestContext2Apply_targetedDestroy(t *testing.T) {
+	m := testModule(t, "apply-targeted")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.bar": resourceState("aws_instance", "i-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{"aws_instance.foo"},
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) != 1 {
+		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
+	}
+
+	checkStateString(t, state, `
+aws_instance.bar:
+  ID = i-abc123
+	`)
+}
+
+func TestContext2Apply_targetedDestroyCountIndex(t *testing.T) {
+	m := testModule(t, "apply-targeted-count")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo.0": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.foo.1": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.foo.2": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.bar.0": resourceState("aws_instance", "i-abc123"),
+						"aws_instance.bar.1": resourceState("aws_instance", "i-abc123"),
+						"aws_instance.bar.2": resourceState("aws_instance", "i-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{
+			"aws_instance.foo[2]",
+			"aws_instance.bar[1]",
+		},
+		Destroy: true,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+aws_instance.bar.0:
+  ID = i-abc123
+aws_instance.bar.2:
+  ID = i-abc123
+aws_instance.foo.0:
+  ID = i-bcd345
+aws_instance.foo.1:
+  ID = i-bcd345
+	`)
+}
+
+func TestContext2Apply_targetedModule(t *testing.T) {
+	m := testModule(t, "apply-targeted-module")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"module.child"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.ModuleByPath([]string{"root", "child"})
+	if mod == nil {
+		t.Fatalf("no child module found in the state!\n\n%#v", state)
+	}
+	if len(mod.Resources) != 2 {
+		t.Fatalf("expected 2 resources, got: %#v", mod.Resources)
+	}
+
+	checkStateString(t, state, `
+<no state>
+module.child:
+  aws_instance.bar:
+    ID = foo
+    num = 2
+    type = aws_instance
+  aws_instance.foo:
+    ID = foo
+    num = 2
+    type = aws_instance
+	`)
+}
+
+// GH-1858
+func TestContext2Apply_targetedModuleDep(t *testing.T) {
+	m := testModule(t, "apply-targeted-module-dep")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+aws_instance.foo:
+  ID = foo
+  foo = foo
+  type = aws_instance
+
+  Dependencies:
+    module.child
+
+module.child:
+  aws_instance.mod:
+    ID = foo
+
+  Outputs:
+
+  output = foo
+	`)
+}
+
+func TestContext2Apply_targetedModuleResource(t *testing.T) {
+	m := testModule(t, "apply-targeted-module-resource")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"module.child.aws_instance.foo"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.ModuleByPath([]string{"root", "child"})
+	if len(mod.Resources) != 1 {
+		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
+	}
+
+	checkStateString(t, state, `
+<no state>
+module.child:
+  aws_instance.foo:
+    ID = foo
+    num = 2
+    type = aws_instance
+	`)
+}
+
+func TestContext2Apply_unknownAttribute(t *testing.T) {
+	m := testModule(t, "apply-unknown")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err == nil {
+		t.Fatal("should error")
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyUnknownAttrStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_unknownAttributeInterpolate(t *testing.T) {
+	m := testModule(t, "apply-unknown-interpolate")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
+func TestContext2Apply_vars(t *testing.T) {
+	m := testModule(t, "apply-vars")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo":            "us-west-2",
+			"amis.us-east-1": "override",
+		},
+	})
+
+	w, e := ctx.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyVarsStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_varsEnv(t *testing.T) {
+	// Set the env var
+	old := tempEnv(t, "TF_VAR_ami", "baz")
+	defer os.Setenv("TF_VAR_ami", old)
+
+	m := testModule(t, "apply-vars-env")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := ctx.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyVarsEnvStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_createBefore_depends(t *testing.T) {
+	m := testModule(t, "apply-depends-create-before")
+	h := new(HookRecordApplyOrder)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "ami-old",
+							},
+						},
+					},
+					"aws_instance.lb": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+							Attributes: map[string]string{
+								"instance": "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	h.Active = true
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := state.RootModule()
+	if len(mod.Resources) < 2 {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyDependsCreateBeforeStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s\n%s", actual, expected)
+	}
+
+	// Test that things were managed _in the right order_
+	order := h.States
+	diffs := h.Diffs
+	if order[0].ID != "" || diffs[0].Destroy {
+		t.Fatalf("should create new instance first: %#v", order)
+	}
+
+	if order[1].ID != "baz" {
+		t.Fatalf("update must happen after create: %#v", order)
+	}
+
+	if order[2].ID != "bar" || !diffs[2].Destroy {
+		t.Fatalf("destroy must happen after update: %#v", order)
+	}
+}
+
+func TestContext2Apply_singleDestroy(t *testing.T) {
+	m := testModule(t, "apply-depends-create-before")
+	h := new(HookRecordApplyOrder)
+	p := testProvider("aws")
+
+	invokeCount := 0
+	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
+		invokeCount++
+		switch invokeCount {
+		case 1:
+			if d.Destroy {
+				t.Fatalf("should not destroy")
+			}
+			if s.ID != "" {
+				t.Fatalf("should not have ID")
+			}
+		case 2:
+			if d.Destroy {
+				t.Fatalf("should not destroy")
+			}
+			if s.ID != "baz" {
+				t.Fatalf("should have id")
+			}
+		case 3:
+			if !d.Destroy {
+				t.Fatalf("should destroy")
+			}
+			if s.ID == "" {
+				t.Fatalf("should have ID")
+			}
+		default:
+			t.Fatalf("bad invoke count %d", invokeCount)
+		}
+		return testApplyFn(info, s, d)
+	}
+	p.DiffFn = testDiffFn
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"require_new": "ami-old",
+							},
+						},
+					},
+					"aws_instance.lb": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+							Attributes: map[string]string{
+								"instance": "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	h.Active = true
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if invokeCount != 3 {
+		t.Fatalf("bad: %d", invokeCount)
+	}
+}
diff --git a/terraform/context_input_test.go b/terraform/context_input_test.go
new file mode 100644
index 000000000..155f4c72f
--- /dev/null
+++ b/terraform/context_input_test.go
@@ -0,0 +1,512 @@
+package terraform
+
+import (
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+)
+
+func TestContext2Input(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-vars")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo":            "us-west-2",
+			"amis.us-east-1": "override",
+		},
+		UIInput: input,
+	})
+
+	input.InputReturnMap = map[string]string{
+		"var.foo": "us-east-1",
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformInputVarsStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Input_badVarDefault(t *testing.T) {
+	m := testModule(t, "input-bad-var-default")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Config["foo"] = "bar"
+		return c, nil
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Input_provider(t *testing.T) {
+	m := testModule(t, "input-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	var actual interface{}
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Config["foo"] = "bar"
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		actual = c.Config["foo"]
+		return nil
+	}
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !reflect.DeepEqual(actual, "bar") {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Input_providerMulti(t *testing.T) {
+	m := testModule(t, "input-provider-multi")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	var actual []interface{}
+	var lock sync.Mutex
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Config["foo"] = "bar"
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		lock.Lock()
+		defer lock.Unlock()
+		actual = append(actual, c.Config["foo"])
+		return nil
+	}
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := []interface{}{"bar", "bar"}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Input_providerOnce(t *testing.T) {
+	m := testModule(t, "input-provider-once")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	count := 0
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		count++
+		return nil, nil
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if count != 1 {
+		t.Fatalf("should only be called once: %d", count)
+	}
+}
+
+func TestContext2Input_providerId(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		UIInput: input,
+	})
+
+	var actual interface{}
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		v, err := i.Input(&InputOpts{Id: "foo"})
+		if err != nil {
+			return nil, err
+		}
+
+		c.Config["foo"] = v
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		actual = c.Config["foo"]
+		return nil
+	}
+
+	input.InputReturnMap = map[string]string{
+		"provider.aws.foo": "bar",
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !reflect.DeepEqual(actual, "bar") {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Input_providerOnly(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-provider-vars")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "us-west-2",
+		},
+		UIInput: input,
+	})
+
+	input.InputReturnMap = map[string]string{
+		"var.foo": "us-east-1",
+	}
+
+	var actual interface{}
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Config["foo"] = "bar"
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		actual = c.Config["foo"]
+		return nil
+	}
+
+	if err := ctx.Input(InputModeProvider); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !reflect.DeepEqual(actual, "bar") {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	actualStr := strings.TrimSpace(state.String())
+	expectedStr := strings.TrimSpace(testTerraformInputProviderOnlyStr)
+	if actualStr != expectedStr {
+		t.Fatalf("bad: \n%s", actualStr)
+	}
+}
+
+func TestContext2Input_providerVars(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-provider-with-vars")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "bar",
+		},
+		UIInput: input,
+	})
+
+	input.InputReturnMap = map[string]string{
+		"var.foo": "bar",
+	}
+
+	var actual interface{}
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Config["bar"] = "baz"
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		actual, _ = c.Get("foo")
+		return nil
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !reflect.DeepEqual(actual, "bar") {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Input_providerVarsModuleInherit(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-provider-with-vars-and-module")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		UIInput: input,
+	})
+
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		if errs := c.CheckSet([]string{"access_key"}); len(errs) > 0 {
+			return c, errs[0]
+		}
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		return nil
+	}
+
+	if err := ctx.Input(InputModeStd); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Input_varOnly(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-provider-vars")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "us-west-2",
+		},
+		UIInput: input,
+	})
+
+	input.InputReturnMap = map[string]string{
+		"var.foo": "us-east-1",
+	}
+
+	var actual interface{}
+	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+		c.Raw["foo"] = "bar"
+		return c, nil
+	}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		actual = c.Raw["foo"]
+		return nil
+	}
+
+	if err := ctx.Input(InputModeVar); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if reflect.DeepEqual(actual, "bar") {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	actualStr := strings.TrimSpace(state.String())
+	expectedStr := strings.TrimSpace(testTerraformInputVarOnlyStr)
+	if actualStr != expectedStr {
+		t.Fatalf("bad: \n%s", actualStr)
+	}
+}
+
+func TestContext2Input_varOnlyUnset(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-vars-unset")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "foovalue",
+		},
+		UIInput: input,
+	})
+
+	input.InputReturnMap = map[string]string{
+		"var.foo": "nope",
+		"var.bar": "baz",
+	}
+
+	if err := ctx.Input(InputModeVar | InputModeVarUnset); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actualStr := strings.TrimSpace(state.String())
+	expectedStr := strings.TrimSpace(testTerraformInputVarOnlyUnsetStr)
+	if actualStr != expectedStr {
+		t.Fatalf("bad: \n%s", actualStr)
+	}
+}
+
+func TestContext2Input_varWithDefault(t *testing.T) {
+	input := new(MockUIInput)
+	m := testModule(t, "input-var-default")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{},
+		UIInput:   input,
+	})
+
+	input.InputFn = func(opts *InputOpts) (string, error) {
+		t.Fatalf(
+			"Input should never be called because variable has a default: %#v", opts)
+		return "", nil
+	}
+
+	if err := ctx.Input(InputModeVar | InputModeVarUnset); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actualStr := strings.TrimSpace(state.String())
+	expectedStr := strings.TrimSpace(`
+aws_instance.foo:
+  ID = foo
+  foo = 123
+  type = aws_instance
+	`)
+	if actualStr != expectedStr {
+		t.Fatalf("expected: \n%s\ngot: \n%s\n", expectedStr, actualStr)
+	}
+}
diff --git a/terraform/context_plan_test.go b/terraform/context_plan_test.go
new file mode 100644
index 000000000..289779511
--- /dev/null
+++ b/terraform/context_plan_test.go
@@ -0,0 +1,1688 @@
+package terraform
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestContext2Plan(t *testing.T) {
+	m := testModule(t, "plan-good")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if len(plan.Diff.RootModule().Resources) < 2 {
+		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_createBefore_maintainRoot(t *testing.T) {
+	m := testModule(t, "plan-cbd-maintain-root")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"in": "a,b,c",
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(`
+DIFF:
+
+CREATE: aws_instance.bar.0
+CREATE: aws_instance.bar.1
+CREATE: aws_instance.foo.0
+CREATE: aws_instance.foo.1
+
+STATE:
+
+<no state>
+		`)
+	if actual != expected {
+		t.Fatalf("expected:\n%s, got:\n%s", expected, actual)
+	}
+}
+
+func TestContext2Plan_emptyDiff(t *testing.T) {
+	m := testModule(t, "plan-empty")
+	p := testProvider("aws")
+	p.DiffFn = func(
+		info *InstanceInfo,
+		s *InstanceState,
+		c *ResourceConfig) (*InstanceDiff, error) {
+		return nil, nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanEmptyStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_minimal(t *testing.T) {
+	m := testModule(t, "plan-empty")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanEmptyStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_modules(t *testing.T) {
+	m := testModule(t, "plan-modules")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModulesStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+// GH-1475
+func TestContext2Plan_moduleCycle(t *testing.T) {
+	m := testModule(t, "plan-module-cycle")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleCycleStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleDeadlock(t *testing.T) {
+	m := testModule(t, "plan-module-deadlock")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	timeout := make(chan bool, 1)
+	done := make(chan bool, 1)
+	go func() {
+		time.Sleep(3 * time.Second)
+		timeout <- true
+	}()
+	go func() {
+		ctx := testContext2(t, &ContextOpts{
+			Module: m,
+			Providers: map[string]ResourceProviderFactory{
+				"aws": testProviderFuncFixed(p),
+			},
+		})
+
+		plan, err := ctx.Plan()
+		done <- true
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		actual := strings.TrimSpace(plan.String())
+		expected := strings.TrimSpace(`
+DIFF:
+
+module.child:
+  CREATE: aws_instance.foo.0
+  CREATE: aws_instance.foo.1
+  CREATE: aws_instance.foo.2
+
+STATE:
+
+<no state>
+		`)
+		if actual != expected {
+			t.Fatalf("expected:\n%sgot:\n%s", expected, actual)
+		}
+	}()
+
+	select {
+	case <-timeout:
+		t.Fatalf("timed out! probably deadlock")
+	case <-done:
+		// ok
+	}
+}
+
+func TestContext2Plan_moduleInput(t *testing.T) {
+	m := testModule(t, "plan-module-input")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleInputStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleInputComputed(t *testing.T) {
+	m := testModule(t, "plan-module-input-computed")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleInputComputedStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleInputFromVar(t *testing.T) {
+	m := testModule(t, "plan-module-input-var")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "52",
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleInputVarStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleMultiVar(t *testing.T) {
+	m := testModule(t, "plan-module-multi-var")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleMultiVarStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleOrphans(t *testing.T) {
+	m := testModule(t, "plan-modules-remove")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleOrphansStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleProviderInherit(t *testing.T) {
+	var l sync.Mutex
+	var calls []string
+
+	m := testModule(t, "plan-module-provider-inherit")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": func() (ResourceProvider, error) {
+				l.Lock()
+				defer l.Unlock()
+
+				p := testProvider("aws")
+				p.ConfigureFn = func(c *ResourceConfig) error {
+					if v, ok := c.Get("from"); !ok || v.(string) != "root" {
+						return fmt.Errorf("bad")
+					}
+
+					return nil
+				}
+				p.DiffFn = func(
+					info *InstanceInfo,
+					state *InstanceState,
+					c *ResourceConfig) (*InstanceDiff, error) {
+					v, _ := c.Get("from")
+					calls = append(calls, v.(string))
+					return testDiffFn(info, state, c)
+				}
+				return p, nil
+			},
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := calls
+	sort.Strings(actual)
+	expected := []string{"child", "root"}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Plan_moduleProviderDefaults(t *testing.T) {
+	var l sync.Mutex
+	var calls []string
+	toCount := 0
+
+	m := testModule(t, "plan-module-provider-defaults")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": func() (ResourceProvider, error) {
+				l.Lock()
+				defer l.Unlock()
+
+				p := testProvider("aws")
+				p.ConfigureFn = func(c *ResourceConfig) error {
+					if v, ok := c.Get("from"); !ok || v.(string) != "root" {
+						return fmt.Errorf("bad")
+					}
+					if v, ok := c.Get("to"); ok && v.(string) == "child" {
+						toCount++
+					}
+
+					return nil
+				}
+				p.DiffFn = func(
+					info *InstanceInfo,
+					state *InstanceState,
+					c *ResourceConfig) (*InstanceDiff, error) {
+					v, _ := c.Get("from")
+					calls = append(calls, v.(string))
+					return testDiffFn(info, state, c)
+				}
+				return p, nil
+			},
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if toCount != 1 {
+		t.Fatalf(
+			"provider in child didn't set proper config\n\n"+
+				"toCount: %d", toCount)
+	}
+
+	actual := calls
+	sort.Strings(actual)
+	expected := []string{"child", "root"}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestContext2Plan_moduleProviderDefaultsVar(t *testing.T) {
+	var l sync.Mutex
+	var calls []string
+
+	m := testModule(t, "plan-module-provider-defaults-var")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": func() (ResourceProvider, error) {
+				l.Lock()
+				defer l.Unlock()
+
+				p := testProvider("aws")
+				p.ConfigureFn = func(c *ResourceConfig) error {
+					var buf bytes.Buffer
+					if v, ok := c.Get("from"); ok {
+						buf.WriteString(v.(string) + "\n")
+					}
+					if v, ok := c.Get("to"); ok {
+						buf.WriteString(v.(string) + "\n")
+					}
+
+					calls = append(calls, buf.String())
+					return nil
+				}
+				p.DiffFn = testDiffFn
+				return p, nil
+			},
+		},
+		Variables: map[string]string{
+			"foo": "root",
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := []string{
+		"root\n",
+		"root\nchild\n",
+	}
+	if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("BAD: %#v", calls)
+	}
+}
+
+func TestContext2Plan_moduleVar(t *testing.T) {
+	m := testModule(t, "plan-module-var")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleVarStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleVarComputed(t *testing.T) {
+	m := testModule(t, "plan-module-var-computed")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleVarComputedStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_nil(t *testing.T) {
+	m := testModule(t, "plan-nil")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if len(plan.Diff.RootModule().Resources) != 0 {
+		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
+	}
+}
+
+func TestContext2Plan_preventDestroy_bad(t *testing.T) {
+	m := testModule(t, "plan-prevent-destroy-bad")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "i-abc123",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	plan, err := ctx.Plan()
+
+	expectedErr := "aws_instance.foo: plan would destroy"
+	if !strings.Contains(fmt.Sprintf("%s", err), expectedErr) {
+		t.Fatalf("expected err would contain %q\nerr: %s\nplan: %s",
+			expectedErr, err, plan)
+	}
+}
+
+func TestContext2Plan_preventDestroy_good(t *testing.T) {
+	m := testModule(t, "plan-prevent-destroy-good")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "i-abc123",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !plan.Diff.Empty() {
+		t.Fatalf("Expected empty plan, got %s", plan.String())
+	}
+}
+
+func TestContext2Plan_preventDestroy_destroyPlan(t *testing.T) {
+	m := testModule(t, "plan-prevent-destroy-good")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "i-abc123",
+							},
+						},
+					},
+				},
+			},
+		},
+		Destroy: true,
+	})
+
+	plan, err := ctx.Plan()
+
+	expectedErr := "aws_instance.foo: plan would destroy"
+	if !strings.Contains(fmt.Sprintf("%s", err), expectedErr) {
+		t.Fatalf("expected err would contain %q\nerr: %s\nplan: %s",
+			expectedErr, err, plan)
+	}
+}
+
+func TestContext2Plan_computed(t *testing.T) {
+	m := testModule(t, "plan-computed")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanComputedStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_computedList(t *testing.T) {
+	m := testModule(t, "plan-computed-list")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanComputedListStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_count(t *testing.T) {
+	m := testModule(t, "plan-count")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if len(plan.Diff.RootModule().Resources) < 6 {
+		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countComputed(t *testing.T) {
+	m := testModule(t, "plan-count-computed")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err == nil {
+		t.Fatal("should error")
+	}
+}
+
+func TestContext2Plan_countIndex(t *testing.T) {
+	m := testModule(t, "plan-count-index")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountIndexStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countIndexZero(t *testing.T) {
+	m := testModule(t, "plan-count-index-zero")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountIndexZeroStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countVar(t *testing.T) {
+	m := testModule(t, "plan-count-var")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"count": "3",
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountVarStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countZero(t *testing.T) {
+	m := testModule(t, "plan-count-zero")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountZeroStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countOneIndex(t *testing.T) {
+	m := testModule(t, "plan-count-one-index")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountOneIndexStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countDecreaseToOne(t *testing.T) {
+	m := testModule(t, "plan-count-dec")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.1": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+					"aws_instance.foo.2": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountDecreaseStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countIncreaseFromNotSet(t *testing.T) {
+	m := testModule(t, "plan-count-inc")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountIncreaseStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_countIncreaseFromOne(t *testing.T) {
+	m := testModule(t, "plan-count-inc")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountIncreaseFromOneStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+// https://github.com/PeoplePerHour/terraform/pull/11
+//
+// This tests a case where both a "resource" and "resource.0" are in
+// the state file, which apparently is a reasonable backwards compatibility
+// concern found in the above 3rd party repo.
+func TestContext2Plan_countIncreaseFromOneCorrupted(t *testing.T) {
+	m := testModule(t, "plan-count-inc")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"foo":  "foo",
+								"type": "aws_instance",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanCountIncreaseFromOneCorruptedStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_destroy(t *testing.T) {
+	m := testModule(t, "plan-destroy")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.one": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+					"aws_instance.two": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State:   s,
+		Destroy: true,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if len(plan.Diff.RootModule().Resources) != 2 {
+		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleDestroy(t *testing.T) {
+	m := testModule(t, "plan-module-destroy")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State:   s,
+		Destroy: true,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleDestroyStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+// GH-1835
+func TestContext2Plan_moduleDestroyCycle(t *testing.T) {
+	m := testModule(t, "plan-module-destroy-gh-1835")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: []string{"root", "a_module"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.a": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "a",
+						},
+					},
+				},
+			},
+			&ModuleState{
+				Path: []string{"root", "b_module"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.b": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "b",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State:   s,
+		Destroy: true,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleDestroyCycleStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_moduleDestroyMultivar(t *testing.T) {
+	m := testModule(t, "plan-module-destroy-multivar")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path:      rootModulePath,
+				Resources: map[string]*ResourceState{},
+			},
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo.0": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar0",
+						},
+					},
+					"aws_instance.foo.1": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar1",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State:   s,
+		Destroy: true,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanModuleDestroyMultivarStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_pathVar(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	m := testModule(t, "plan-path-var")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanPathVarStr)
+
+	// Warning: this ordering REALLY matters for this test. The
+	// order is: cwd, module, root.
+	expected = fmt.Sprintf(
+		expected,
+		cwd,
+		m.Config().Dir,
+		m.Config().Dir)
+
+	if actual != expected {
+		t.Fatalf("bad:\n%s\n\nexpected:\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Plan_diffVar(t *testing.T) {
+	m := testModule(t, "plan-diffvar")
+	p := testProvider("aws")
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Primary: &InstanceState{
+							ID: "bar",
+							Attributes: map[string]string{
+								"num": "2",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	p.DiffFn = func(
+		info *InstanceInfo,
+		s *InstanceState,
+		c *ResourceConfig) (*InstanceDiff, error) {
+		if s.ID != "bar" {
+			return testDiffFn(info, s, c)
+		}
+
+		return &InstanceDiff{
+			Attributes: map[string]*ResourceAttrDiff{
+				"num": &ResourceAttrDiff{
+					Old: "2",
+					New: "3",
+				},
+			},
+		}, nil
+	}
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanDiffVarStr)
+	if actual != expected {
+		t.Fatalf("actual:\n%s\n\nexpected:\n%s", actual, expected)
+	}
+}
+
+func TestContext2Plan_hook(t *testing.T) {
+	m := testModule(t, "plan-good")
+	h := new(MockHook)
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !h.PreDiffCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostDiffCalled {
+		t.Fatal("should be called")
+	}
+}
+
+func TestContext2Plan_orphan(t *testing.T) {
+	m := testModule(t, "plan-orphan")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.baz": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanOrphanStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_state(t *testing.T) {
+	m := testModule(t, "plan-good")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if len(plan.Diff.RootModule().Resources) < 2 {
+		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanStateStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s\n\nexpected:\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Plan_taint(t *testing.T) {
+	m := testModule(t, "plan-taint")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID:         "bar",
+							Attributes: map[string]string{"num": "2"},
+						},
+					},
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "baz",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanTaintStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_multiple_taint(t *testing.T) {
+	m := testModule(t, "plan-taint")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID:         "bar",
+							Attributes: map[string]string{"num": "2"},
+						},
+					},
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "baz",
+							},
+							&InstanceState{
+								ID: "zip",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanMultipleTaintStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestContext2Plan_targeted(t *testing.T) {
+	m := testModule(t, "plan-targeted")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo"},
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(`
+DIFF:
+
+CREATE: aws_instance.foo
+  num:  "" => "2"
+  type: "" => "aws_instance"
+
+STATE:
+
+<no state>
+	`)
+	if actual != expected {
+		t.Fatalf("expected:\n%s\n\ngot:\n%s", expected, actual)
+	}
+}
+
+func TestContext2Plan_provider(t *testing.T) {
+	m := testModule(t, "plan-provider")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+
+	var value interface{}
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		value, _ = c.Get("foo")
+		return nil
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "bar",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if value != "bar" {
+		t.Fatalf("bad: %#v", value)
+	}
+}
+
+func TestContext2Plan_varListErr(t *testing.T) {
+	m := testModule(t, "plan-var-list-err")
+	p := testProvider("aws")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err == nil {
+		t.Fatal("should error")
+	}
+}
diff --git a/terraform/context_refresh_test.go b/terraform/context_refresh_test.go
new file mode 100644
index 000000000..a657e767f
--- /dev/null
+++ b/terraform/context_refresh_test.go
@@ -0,0 +1,705 @@
+package terraform
+
+import (
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+func TestContext2Refresh(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.web": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	s, err := ctx.Refresh()
+	mod := s.RootModule()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !p.RefreshCalled {
+		t.Fatal("refresh should be called")
+	}
+	if p.RefreshState.ID != "foo" {
+		t.Fatalf("bad: %#v", p.RefreshState)
+	}
+	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
+		t.Fatalf("bad: %#v %#v", mod.Resources["aws_instance.web"], p.RefreshReturn)
+	}
+
+	for _, r := range mod.Resources {
+		if r.Type == "" {
+			t.Fatalf("no type: %#v", r)
+		}
+	}
+}
+
+func TestContext2Refresh_targeted(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-targeted")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
+						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.me":    resourceState("aws_instance", "i-abc123"),
+						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{"aws_instance.me"},
+	})
+
+	refreshedResources := make([]string, 0, 2)
+	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
+		refreshedResources = append(refreshedResources, i.Id)
+		return is, nil
+	}
+
+	_, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := []string{"aws_vpc.metoo", "aws_instance.me"}
+	if !reflect.DeepEqual(refreshedResources, expected) {
+		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
+	}
+}
+
+func TestContext2Refresh_targetedCount(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-targeted-count")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
+						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.me.0":  resourceState("aws_instance", "i-abc123"),
+						"aws_instance.me.1":  resourceState("aws_instance", "i-cde567"),
+						"aws_instance.me.2":  resourceState("aws_instance", "i-cde789"),
+						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{"aws_instance.me"},
+	})
+
+	refreshedResources := make([]string, 0, 2)
+	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
+		refreshedResources = append(refreshedResources, i.Id)
+		return is, nil
+	}
+
+	_, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	// Target didn't specify index, so we should get all our instances
+	expected := []string{
+		"aws_vpc.metoo",
+		"aws_instance.me.0",
+		"aws_instance.me.1",
+		"aws_instance.me.2",
+	}
+	sort.Strings(expected)
+	sort.Strings(refreshedResources)
+	if !reflect.DeepEqual(refreshedResources, expected) {
+		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
+	}
+}
+
+func TestContext2Refresh_targetedCountIndex(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-targeted-count")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
+						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.me.0":  resourceState("aws_instance", "i-abc123"),
+						"aws_instance.me.1":  resourceState("aws_instance", "i-cde567"),
+						"aws_instance.me.2":  resourceState("aws_instance", "i-cde789"),
+						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{"aws_instance.me[0]"},
+	})
+
+	refreshedResources := make([]string, 0, 2)
+	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
+		refreshedResources = append(refreshedResources, i.Id)
+		return is, nil
+	}
+
+	_, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := []string{"aws_vpc.metoo", "aws_instance.me.0"}
+	if !reflect.DeepEqual(refreshedResources, expected) {
+		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
+	}
+}
+
+func TestContext2Refresh_moduleComputedVar(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-module-computed-var")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	// This was failing (see GH-2188) at some point, so this test just
+	// verifies that the failure goes away.
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Refresh_delete(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.web": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = nil
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	mod := s.RootModule()
+	if len(mod.Resources) > 0 {
+		t.Fatal("resources should be empty")
+	}
+}
+
+func TestContext2Refresh_ignoreUncreated(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: nil,
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	_, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if p.RefreshCalled {
+		t.Fatal("refresh should not be called")
+	}
+}
+
+func TestContext2Refresh_hook(t *testing.T) {
+	h := new(MockHook)
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.web": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !h.PreRefreshCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostRefreshCalled {
+		t.Fatal("should be called")
+	}
+}
+
+func TestContext2Refresh_modules(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-modules")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "baz",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	p.RefreshFn = func(info *InstanceInfo, s *InstanceState) (*InstanceState, error) {
+		if s.ID != "baz" {
+			return s, nil
+		}
+
+		s.ID = "new"
+		return s, nil
+	}
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(s.String())
+	expected := strings.TrimSpace(testContextRefreshModuleStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Refresh_moduleInputComputedOutput(t *testing.T) {
+	m := testModule(t, "refresh-module-input-computed-output")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Refresh_moduleVarModule(t *testing.T) {
+	m := testModule(t, "refresh-module-var-module")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// GH-70
+func TestContext2Refresh_noState(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-no-state")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestContext2Refresh_output(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-output")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.web": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+								Attributes: map[string]string{
+									"foo": "bar",
+								},
+							},
+						},
+					},
+
+					Outputs: map[string]string{
+						"foo": "foo",
+					},
+				},
+			},
+		},
+	})
+
+	p.RefreshFn = func(info *InstanceInfo, s *InstanceState) (*InstanceState, error) {
+		return s, nil
+	}
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(s.String())
+	expected := strings.TrimSpace(testContextRefreshOutputStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Refresh_outputPartial(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-output-partial")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = nil
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(s.String())
+	expected := strings.TrimSpace(testContextRefreshOutputPartialStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
+	}
+}
+
+func TestContext2Refresh_state(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	originalMod := state.RootModule()
+	mod := s.RootModule()
+	if !p.RefreshCalled {
+		t.Fatal("refresh should be called")
+	}
+	if !reflect.DeepEqual(p.RefreshState, originalMod.Resources["aws_instance.web"].Primary) {
+		t.Fatalf(
+			"bad:\n\n%#v\n\n%#v",
+			p.RefreshState,
+			originalMod.Resources["aws_instance.web"].Primary)
+	}
+	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
+		t.Fatalf("bad: %#v", mod.Resources)
+	}
+}
+
+func TestContext2Refresh_tainted(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-basic")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !p.RefreshCalled {
+		t.Fatal("refresh should be called")
+	}
+
+	actual := strings.TrimSpace(s.String())
+	expected := strings.TrimSpace(testContextRefreshTaintedStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
+	}
+}
+
+// Doing a Refresh (or any operation really, but Refresh usually
+// happens first) with a config with an unknown provider should result in
+// an error. The key bug this found was that this wasn't happening if
+// Providers was _empty_.
+func TestContext2Refresh_unknownProvider(t *testing.T) {
+	m := testModule(t, "refresh-unknown-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module:    m,
+		Providers: map[string]ResourceProviderFactory{},
+	})
+
+	if _, err := ctx.Refresh(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
+func TestContext2Refresh_vars(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-vars")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.web": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "foo",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	p.RefreshFn = nil
+	p.RefreshReturn = &InstanceState{
+		ID: "foo",
+	}
+
+	s, err := ctx.Refresh()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	mod := s.RootModule()
+	if !p.RefreshCalled {
+		t.Fatal("refresh should be called")
+	}
+	if p.RefreshState.ID != "foo" {
+		t.Fatalf("bad: %#v", p.RefreshState)
+	}
+	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
+		t.Fatalf("bad: %#v", mod.Resources["aws_instance.web"])
+	}
+
+	for _, r := range mod.Resources {
+		if r.Type == "" {
+			t.Fatalf("no type: %#v", r)
+		}
+	}
+}
+
+func TestContext2Validate(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-good")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
diff --git a/terraform/context_test.go b/terraform/context_test.go
index 15bb62778..8bcbf1b2b 100644
--- a/terraform/context_test.go
+++ b/terraform/context_test.go
@@ -1,6540 +1,11 @@
 package terraform
 
 import (
-	"bytes"
 	"fmt"
-	"os"
-	"reflect"
-	"sort"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"testing"
-	"time"
 )
 
-func TestContext2Plan(t *testing.T) {
-	m := testModule(t, "plan-good")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if len(plan.Diff.RootModule().Resources) < 2 {
-		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_emptyDiff(t *testing.T) {
-	m := testModule(t, "plan-empty")
-	p := testProvider("aws")
-	p.DiffFn = func(
-		info *InstanceInfo,
-		s *InstanceState,
-		c *ResourceConfig) (*InstanceDiff, error) {
-		return nil, nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanEmptyStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_minimal(t *testing.T) {
-	m := testModule(t, "plan-empty")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanEmptyStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_modules(t *testing.T) {
-	m := testModule(t, "plan-modules")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModulesStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-// GH-1475
-func TestContext2Plan_moduleCycle(t *testing.T) {
-	m := testModule(t, "plan-module-cycle")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleCycleStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleInput(t *testing.T) {
-	m := testModule(t, "plan-module-input")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleInputStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleInputComputed(t *testing.T) {
-	m := testModule(t, "plan-module-input-computed")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleInputComputedStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleInputFromVar(t *testing.T) {
-	m := testModule(t, "plan-module-input-var")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "52",
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleInputVarStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleMultiVar(t *testing.T) {
-	m := testModule(t, "plan-module-multi-var")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleMultiVarStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleOrphans(t *testing.T) {
-	m := testModule(t, "plan-modules-remove")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: []string{"root", "child"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleOrphansStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleProviderInherit(t *testing.T) {
-	var l sync.Mutex
-	var calls []string
-
-	m := testModule(t, "plan-module-provider-inherit")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": func() (ResourceProvider, error) {
-				l.Lock()
-				defer l.Unlock()
-
-				p := testProvider("aws")
-				p.ConfigureFn = func(c *ResourceConfig) error {
-					if v, ok := c.Get("from"); !ok || v.(string) != "root" {
-						return fmt.Errorf("bad")
-					}
-
-					return nil
-				}
-				p.DiffFn = func(
-					info *InstanceInfo,
-					state *InstanceState,
-					c *ResourceConfig) (*InstanceDiff, error) {
-					v, _ := c.Get("from")
-					calls = append(calls, v.(string))
-					return testDiffFn(info, state, c)
-				}
-				return p, nil
-			},
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := calls
-	sort.Strings(actual)
-	expected := []string{"child", "root"}
-	if !reflect.DeepEqual(actual, expected) {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Plan_moduleProviderDefaults(t *testing.T) {
-	var l sync.Mutex
-	var calls []string
-	toCount := 0
-
-	m := testModule(t, "plan-module-provider-defaults")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": func() (ResourceProvider, error) {
-				l.Lock()
-				defer l.Unlock()
-
-				p := testProvider("aws")
-				p.ConfigureFn = func(c *ResourceConfig) error {
-					if v, ok := c.Get("from"); !ok || v.(string) != "root" {
-						return fmt.Errorf("bad")
-					}
-					if v, ok := c.Get("to"); ok && v.(string) == "child" {
-						toCount++
-					}
-
-					return nil
-				}
-				p.DiffFn = func(
-					info *InstanceInfo,
-					state *InstanceState,
-					c *ResourceConfig) (*InstanceDiff, error) {
-					v, _ := c.Get("from")
-					calls = append(calls, v.(string))
-					return testDiffFn(info, state, c)
-				}
-				return p, nil
-			},
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if toCount != 1 {
-		t.Fatalf(
-			"provider in child didn't set proper config\n\n"+
-				"toCount: %d", toCount)
-	}
-
-	actual := calls
-	sort.Strings(actual)
-	expected := []string{"child", "root"}
-	if !reflect.DeepEqual(actual, expected) {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Plan_moduleProviderDefaultsVar(t *testing.T) {
-	var l sync.Mutex
-	var calls []string
-
-	m := testModule(t, "plan-module-provider-defaults-var")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": func() (ResourceProvider, error) {
-				l.Lock()
-				defer l.Unlock()
-
-				p := testProvider("aws")
-				p.ConfigureFn = func(c *ResourceConfig) error {
-					var buf bytes.Buffer
-					if v, ok := c.Get("from"); ok {
-						buf.WriteString(v.(string) + "\n")
-					}
-					if v, ok := c.Get("to"); ok {
-						buf.WriteString(v.(string) + "\n")
-					}
-
-					calls = append(calls, buf.String())
-					return nil
-				}
-				p.DiffFn = testDiffFn
-				return p, nil
-			},
-		},
-		Variables: map[string]string{
-			"foo": "root",
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := []string{
-		"root\n",
-		"root\nchild\n",
-	}
-	if !reflect.DeepEqual(calls, expected) {
-		t.Fatalf("BAD: %#v", calls)
-	}
-}
-
-func TestContext2Plan_moduleVar(t *testing.T) {
-	m := testModule(t, "plan-module-var")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleVarStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleVarComputed(t *testing.T) {
-	m := testModule(t, "plan-module-var-computed")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleVarComputedStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_nil(t *testing.T) {
-	m := testModule(t, "plan-nil")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if len(plan.Diff.RootModule().Resources) != 0 {
-		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
-	}
-}
-
-func TestContext2Plan_preventDestroy_bad(t *testing.T) {
-	m := testModule(t, "plan-prevent-destroy-bad")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "i-abc123",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	plan, err := ctx.Plan()
-
-	expectedErr := "aws_instance.foo: plan would destroy"
-	if !strings.Contains(fmt.Sprintf("%s", err), expectedErr) {
-		t.Fatalf("expected err would contain %q\nerr: %s\nplan: %s",
-			expectedErr, err, plan)
-	}
-}
-
-func TestContext2Plan_preventDestroy_good(t *testing.T) {
-	m := testModule(t, "plan-prevent-destroy-good")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "i-abc123",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if !plan.Diff.Empty() {
-		t.Fatalf("Expected empty plan, got %s", plan.String())
-	}
-}
-
-func TestContext2Plan_preventDestroy_destroyPlan(t *testing.T) {
-	m := testModule(t, "plan-prevent-destroy-good")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "i-abc123",
-							},
-						},
-					},
-				},
-			},
-		},
-		Destroy: true,
-	})
-
-	plan, err := ctx.Plan()
-
-	expectedErr := "aws_instance.foo: plan would destroy"
-	if !strings.Contains(fmt.Sprintf("%s", err), expectedErr) {
-		t.Fatalf("expected err would contain %q\nerr: %s\nplan: %s",
-			expectedErr, err, plan)
-	}
-}
-
-func TestContext2Plan_providerAliasMissing(t *testing.T) {
-	m := testModule(t, "apply-provider-alias-missing")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type:     "aws_instance",
-						Provider: "aws.foo",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err == nil {
-		t.Fatal("should err")
-	}
-}
-
-func TestContext2Plan_computed(t *testing.T) {
-	m := testModule(t, "plan-computed")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanComputedStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_computedList(t *testing.T) {
-	m := testModule(t, "plan-computed-list")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanComputedListStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_count(t *testing.T) {
-	m := testModule(t, "plan-count")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if len(plan.Diff.RootModule().Resources) < 6 {
-		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countComputed(t *testing.T) {
-	m := testModule(t, "plan-count-computed")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err == nil {
-		t.Fatal("should error")
-	}
-}
-
-func TestContext2Plan_countIndex(t *testing.T) {
-	m := testModule(t, "plan-count-index")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountIndexStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countIndexZero(t *testing.T) {
-	m := testModule(t, "plan-count-index-zero")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountIndexZeroStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countVar(t *testing.T) {
-	m := testModule(t, "plan-count-var")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"count": "3",
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountVarStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countZero(t *testing.T) {
-	m := testModule(t, "plan-count-zero")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountZeroStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countOneIndex(t *testing.T) {
-	m := testModule(t, "plan-count-one-index")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountOneIndexStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countDecreaseToOne(t *testing.T) {
-	m := testModule(t, "plan-count-dec")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.1": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-					"aws_instance.foo.2": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountDecreaseStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countIncreaseFromNotSet(t *testing.T) {
-	m := testModule(t, "plan-count-inc")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountIncreaseStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_countIncreaseFromOne(t *testing.T) {
-	m := testModule(t, "plan-count-inc")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountIncreaseFromOneStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-// https://github.com/PeoplePerHour/terraform/pull/11
-//
-// This tests a case where both a "resource" and "resource.0" are in
-// the state file, which apparently is a reasonable backwards compatibility
-// concern found in the above 3rd party repo.
-func TestContext2Plan_countIncreaseFromOneCorrupted(t *testing.T) {
-	m := testModule(t, "plan-count-inc")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanCountIncreaseFromOneCorruptedStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_destroy(t *testing.T) {
-	m := testModule(t, "plan-destroy")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.one": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-					"aws_instance.two": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State:   s,
-		Destroy: true,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if len(plan.Diff.RootModule().Resources) != 2 {
-		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleDestroy(t *testing.T) {
-	m := testModule(t, "plan-module-destroy")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-			&ModuleState{
-				Path: []string{"root", "child"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State:   s,
-		Destroy: true,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-// GH-1835
-func TestContext2Plan_moduleDestroyCycle(t *testing.T) {
-	m := testModule(t, "plan-module-destroy-gh-1835")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: []string{"root", "a_module"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.a": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "a",
-						},
-					},
-				},
-			},
-			&ModuleState{
-				Path: []string{"root", "b_module"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.b": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "b",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State:   s,
-		Destroy: true,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleDestroyCycleStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_moduleDestroyMultivar(t *testing.T) {
-	m := testModule(t, "plan-module-destroy-multivar")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path:      rootModulePath,
-				Resources: map[string]*ResourceState{},
-			},
-			&ModuleState{
-				Path: []string{"root", "child"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar0",
-						},
-					},
-					"aws_instance.foo.1": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar1",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State:   s,
-		Destroy: true,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanModuleDestroyMultivarStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_pathVar(t *testing.T) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	m := testModule(t, "plan-path-var")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanPathVarStr)
-
-	// Warning: this ordering REALLY matters for this test. The
-	// order is: cwd, module, root.
-	expected = fmt.Sprintf(
-		expected,
-		cwd,
-		m.Config().Dir,
-		m.Config().Dir)
-
-	if actual != expected {
-		t.Fatalf("bad:\n%s\n\nexpected:\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Plan_diffVar(t *testing.T) {
-	m := testModule(t, "plan-diffvar")
-	p := testProvider("aws")
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"num": "2",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	p.DiffFn = func(
-		info *InstanceInfo,
-		s *InstanceState,
-		c *ResourceConfig) (*InstanceDiff, error) {
-		if s.ID != "bar" {
-			return testDiffFn(info, s, c)
-		}
-
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					Old: "2",
-					New: "3",
-				},
-			},
-		}, nil
-	}
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanDiffVarStr)
-	if actual != expected {
-		t.Fatalf("actual:\n%s\n\nexpected:\n%s", actual, expected)
-	}
-}
-
-func TestContext2Plan_hook(t *testing.T) {
-	m := testModule(t, "plan-good")
-	h := new(MockHook)
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !h.PreDiffCalled {
-		t.Fatal("should be called")
-	}
-	if !h.PostDiffCalled {
-		t.Fatal("should be called")
-	}
-}
-
-func TestContext2Plan_orphan(t *testing.T) {
-	m := testModule(t, "plan-orphan")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.baz": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanOrphanStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_state(t *testing.T) {
-	m := testModule(t, "plan-good")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if len(plan.Diff.RootModule().Resources) < 2 {
-		t.Fatalf("bad: %#v", plan.Diff.RootModule().Resources)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanStateStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s\n\nexpected:\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Plan_taint(t *testing.T) {
-	m := testModule(t, "plan-taint")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID:         "bar",
-							Attributes: map[string]string{"num": "2"},
-						},
-					},
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "baz",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanTaintStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_multiple_taint(t *testing.T) {
-	m := testModule(t, "plan-taint")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID:         "bar",
-							Attributes: map[string]string{"num": "2"},
-						},
-					},
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "baz",
-							},
-							&InstanceState{
-								ID: "zip",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanMultipleTaintStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_targeted(t *testing.T) {
-	m := testModule(t, "plan-targeted")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"aws_instance.foo"},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(`
-DIFF:
-
-CREATE: aws_instance.foo
-  num:  "" => "2"
-  type: "" => "aws_instance"
-
-STATE:
-
-<no state>
-	`)
-	if actual != expected {
-		t.Fatalf("expected:\n%s\n\ngot:\n%s", expected, actual)
-	}
-}
-
-func TestContext2Plan_provider(t *testing.T) {
-	m := testModule(t, "plan-provider")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-
-	var value interface{}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		value, _ = c.Get("foo")
-		return nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "bar",
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if value != "bar" {
-		t.Fatalf("bad: %#v", value)
-	}
-}
-
-func TestContext2Plan_varMultiCountOne(t *testing.T) {
-	m := testModule(t, "plan-var-multi-count-one")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanVarMultiCountOneStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Plan_varListErr(t *testing.T) {
-	m := testModule(t, "plan-var-list-err")
-	p := testProvider("aws")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err == nil {
-		t.Fatal("should error")
-	}
-}
-
-func TestContext2Refresh(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.web": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	s, err := ctx.Refresh()
-	mod := s.RootModule()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if !p.RefreshCalled {
-		t.Fatal("refresh should be called")
-	}
-	if p.RefreshState.ID != "foo" {
-		t.Fatalf("bad: %#v", p.RefreshState)
-	}
-	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
-		t.Fatalf("bad: %#v %#v", mod.Resources["aws_instance.web"], p.RefreshReturn)
-	}
-
-	for _, r := range mod.Resources {
-		if r.Type == "" {
-			t.Fatalf("no type: %#v", r)
-		}
-	}
-}
-
-func TestContext2Refresh_targeted(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-targeted")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
-						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.me":    resourceState("aws_instance", "i-abc123"),
-						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{"aws_instance.me"},
-	})
-
-	refreshedResources := make([]string, 0, 2)
-	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
-		refreshedResources = append(refreshedResources, i.Id)
-		return is, nil
-	}
-
-	_, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := []string{"aws_vpc.metoo", "aws_instance.me"}
-	if !reflect.DeepEqual(refreshedResources, expected) {
-		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
-	}
-}
-
-func TestContext2Refresh_targetedCount(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-targeted-count")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
-						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.me.0":  resourceState("aws_instance", "i-abc123"),
-						"aws_instance.me.1":  resourceState("aws_instance", "i-cde567"),
-						"aws_instance.me.2":  resourceState("aws_instance", "i-cde789"),
-						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{"aws_instance.me"},
-	})
-
-	refreshedResources := make([]string, 0, 2)
-	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
-		refreshedResources = append(refreshedResources, i.Id)
-		return is, nil
-	}
-
-	_, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Target didn't specify index, so we should get all our instances
-	expected := []string{
-		"aws_vpc.metoo",
-		"aws_instance.me.0",
-		"aws_instance.me.1",
-		"aws_instance.me.2",
-	}
-	sort.Strings(expected)
-	sort.Strings(refreshedResources)
-	if !reflect.DeepEqual(refreshedResources, expected) {
-		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
-	}
-}
-
-func TestContext2Refresh_targetedCountIndex(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-targeted-count")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_vpc.metoo":      resourceState("aws_vpc", "vpc-abc123"),
-						"aws_instance.notme": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.me.0":  resourceState("aws_instance", "i-abc123"),
-						"aws_instance.me.1":  resourceState("aws_instance", "i-cde567"),
-						"aws_instance.me.2":  resourceState("aws_instance", "i-cde789"),
-						"aws_elb.meneither":  resourceState("aws_elb", "lb-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{"aws_instance.me[0]"},
-	})
-
-	refreshedResources := make([]string, 0, 2)
-	p.RefreshFn = func(i *InstanceInfo, is *InstanceState) (*InstanceState, error) {
-		refreshedResources = append(refreshedResources, i.Id)
-		return is, nil
-	}
-
-	_, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := []string{"aws_vpc.metoo", "aws_instance.me.0"}
-	if !reflect.DeepEqual(refreshedResources, expected) {
-		t.Fatalf("expected: %#v, got: %#v", expected, refreshedResources)
-	}
-}
-
-func TestContext2Refresh_delete(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.web": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = nil
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := s.RootModule()
-	if len(mod.Resources) > 0 {
-		t.Fatal("resources should be empty")
-	}
-}
-
-func TestContext2Refresh_ignoreUncreated(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: nil,
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	_, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if p.RefreshCalled {
-		t.Fatal("refresh should not be called")
-	}
-}
-
-func TestContext2Refresh_hook(t *testing.T) {
-	h := new(MockHook)
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.web": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	if _, err := ctx.Refresh(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if !h.PreRefreshCalled {
-		t.Fatal("should be called")
-	}
-	if !h.PostRefreshCalled {
-		t.Fatal("should be called")
-	}
-}
-
-func TestContext2Refresh_modules(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-modules")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "bar",
-							},
-						},
-					},
-				},
-			},
-
-			&ModuleState{
-				Path: []string{"root", "child"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	p.RefreshFn = func(info *InstanceInfo, s *InstanceState) (*InstanceState, error) {
-		if s.ID != "baz" {
-			return s, nil
-		}
-
-		s.ID = "new"
-		return s, nil
-	}
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(s.String())
-	expected := strings.TrimSpace(testContextRefreshModuleStr)
-	if actual != expected {
-		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Refresh_moduleInputComputedOutput(t *testing.T) {
-	m := testModule(t, "refresh-module-input-computed-output")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Refresh(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Refresh_moduleVarModule(t *testing.T) {
-	m := testModule(t, "refresh-module-var-module")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Refresh(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-// GH-70
-func TestContext2Refresh_noState(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-no-state")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	if _, err := ctx.Refresh(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Refresh_output(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-output")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.web": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-								Attributes: map[string]string{
-									"foo": "bar",
-								},
-							},
-						},
-					},
-
-					Outputs: map[string]string{
-						"foo": "foo",
-					},
-				},
-			},
-		},
-	})
-
-	p.RefreshFn = func(info *InstanceInfo, s *InstanceState) (*InstanceState, error) {
-		return s, nil
-	}
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(s.String())
-	expected := strings.TrimSpace(testContextRefreshOutputStr)
-	if actual != expected {
-		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Refresh_outputPartial(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-output-partial")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = nil
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(s.String())
-	expected := strings.TrimSpace(testContextRefreshOutputPartialStr)
-	if actual != expected {
-		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Refresh_state(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	originalMod := state.RootModule()
-	mod := s.RootModule()
-	if !p.RefreshCalled {
-		t.Fatal("refresh should be called")
-	}
-	if !reflect.DeepEqual(p.RefreshState, originalMod.Resources["aws_instance.web"].Primary) {
-		t.Fatalf(
-			"bad:\n\n%#v\n\n%#v",
-			p.RefreshState,
-			originalMod.Resources["aws_instance.web"].Primary)
-	}
-	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-}
-
-func TestContext2Refresh_tainted(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-basic")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if !p.RefreshCalled {
-		t.Fatal("refresh should be called")
-	}
-
-	actual := strings.TrimSpace(s.String())
-	expected := strings.TrimSpace(testContextRefreshTaintedStr)
-	if actual != expected {
-		t.Fatalf("bad:\n\n%s\n\n%s", actual, expected)
-	}
-}
-
-// Doing a Refresh (or any operation really, but Refresh usually
-// happens first) with a config with an unknown provider should result in
-// an error. The key bug this found was that this wasn't happening if
-// Providers was _empty_.
-func TestContext2Refresh_unknownProvider(t *testing.T) {
-	m := testModule(t, "refresh-unknown-provider")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module:    m,
-		Providers: map[string]ResourceProviderFactory{},
-	})
-
-	if _, err := ctx.Refresh(); err == nil {
-		t.Fatal("should error")
-	}
-}
-
-func TestContext2Refresh_vars(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "refresh-vars")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.web": &ResourceState{
-							Type: "aws_instance",
-							Primary: &InstanceState{
-								ID: "foo",
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-
-	p.RefreshFn = nil
-	p.RefreshReturn = &InstanceState{
-		ID: "foo",
-	}
-
-	s, err := ctx.Refresh()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	mod := s.RootModule()
-	if !p.RefreshCalled {
-		t.Fatal("refresh should be called")
-	}
-	if p.RefreshState.ID != "foo" {
-		t.Fatalf("bad: %#v", p.RefreshState)
-	}
-	if !reflect.DeepEqual(mod.Resources["aws_instance.web"].Primary, p.RefreshReturn) {
-		t.Fatalf("bad: %#v", mod.Resources["aws_instance.web"])
-	}
-
-	for _, r := range mod.Resources {
-		if r.Type == "" {
-			t.Fatalf("no type: %#v", r)
-		}
-	}
-}
-
-func TestContext2Validate(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-good")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_badVar(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-bad-var")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_countNegative(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-count-negative")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_countVariable(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "apply-count-variable")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_countVariableNoDefault(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-count-variable")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) != 1 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-/*
-TODO: What should we do here?
-func TestContext2Validate_cycle(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-cycle")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("expected no warns, got: %#v", w)
-	}
-	if len(e) != 1 {
-		t.Fatalf("expected 1 err, got: %s", e)
-	}
-}
-*/
-
-func TestContext2Validate_moduleBadOutput(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-bad-module-output")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_moduleGood(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-good-module")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_moduleBadResource(t *testing.T) {
-	m := testModule(t, "validate-module-bad-rc")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateResourceReturnErrors = []error{fmt.Errorf("bad")}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_moduleDepsShouldNotCycle(t *testing.T) {
-	m := testModule(t, "validate-module-deps-cycle")
-	p := testProvider("aws")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := ctx.Validate()
-
-	if len(w) > 0 {
-		t.Fatalf("expected no warnings, got: %s", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("expected no errors, got: %s", e)
-	}
-}
-
-func TestContext2Validate_moduleProviderInherit(t *testing.T) {
-	m := testModule(t, "validate-module-pc-inherit")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"set"})
-	}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_moduleProviderVar(t *testing.T) {
-	m := testModule(t, "validate-module-pc-vars")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"provider_var": "bar",
-		},
-	})
-
-	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_moduleProviderInheritUnused(t *testing.T) {
-	m := testModule(t, "validate-module-pc-inherit-unused")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_orphans(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-good")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	p.ValidateResourceFn = func(
-		t string, c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_providerConfig_bad(t *testing.T) {
-	m := testModule(t, "validate-bad-pc")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateReturnErrors = []error{fmt.Errorf("bad")}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %s", e)
-	}
-	if !strings.Contains(fmt.Sprintf("%s", e), "bad") {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_providerConfig_badEmpty(t *testing.T) {
-	m := testModule(t, "validate-bad-pc-empty")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateReturnErrors = []error{fmt.Errorf("bad")}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_providerConfig_good(t *testing.T) {
-	m := testModule(t, "validate-bad-pc")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_provisionerConfig_bad(t *testing.T) {
-	m := testModule(t, "validate-bad-prov-conf")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	pr.ValidateReturnErrors = []error{fmt.Errorf("bad")}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_provisionerConfig_good(t *testing.T) {
-	m := testModule(t, "validate-bad-prov-conf")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	pr.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		if c == nil {
-			t.Fatalf("missing resource config for provisioner")
-		}
-		return nil, c.CheckSet([]string{"command"})
-	}
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_requiredVar(t *testing.T) {
-	m := testModule(t, "validate-required-var")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_resourceConfig_bad(t *testing.T) {
-	m := testModule(t, "validate-bad-rc")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ValidateResourceReturnErrors = []error{fmt.Errorf("bad")}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_resourceConfig_good(t *testing.T) {
-	m := testModule(t, "validate-bad-rc")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_resourceNameSymbol(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-resource-name-symbol")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) == 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_selfRef(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-self-ref")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_selfRefMulti(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-self-ref-multi")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_selfRefMultiAll(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-self-ref-multi-all")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) == 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_tainted(t *testing.T) {
-	p := testProvider("aws")
-	m := testModule(t, "validate-good")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	p.ValidateResourceFn = func(
-		t string, c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	w, e := c.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %#v", e)
-	}
-}
-
-func TestContext2Validate_targetedDestroy(t *testing.T) {
-	m := testModule(t, "validate-targeted")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.bar": resourceState("aws_instance", "i-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{"aws_instance.foo"},
-		Destroy: true,
-	})
-
-	w, e := ctx.Validate()
-	if len(w) > 0 {
-		warnStr := ""
-		for _, v := range w {
-			warnStr = warnStr + " " + v
-		}
-		t.Fatalf("bad: %s", warnStr)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-}
-
-func TestContext2Validate_varRef(t *testing.T) {
-	m := testModule(t, "validate-variable-ref")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	computed := false
-	p.ValidateResourceFn = func(t string, c *ResourceConfig) ([]string, []error) {
-		computed = c.IsComputed("foo")
-		return nil, nil
-	}
-
-	c.Validate()
-	if !computed {
-		t.Fatal("should be computed")
-	}
-}
-
-func TestContext2Validate_varRefFilled(t *testing.T) {
-	m := testModule(t, "validate-variable-ref")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "bar",
-		},
-	})
-
-	var value interface{}
-	p.ValidateResourceFn = func(t string, c *ResourceConfig) ([]string, []error) {
-		value, _ = c.Get("foo")
-		return nil, nil
-	}
-
-	c.Validate()
-	if value != "bar" {
-		t.Fatalf("bad: %#v", value)
-	}
-}
-
-func TestContext2Input(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-vars")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo":            "us-west-2",
-			"amis.us-east-1": "override",
-		},
-		UIInput: input,
-	})
-
-	input.InputReturnMap = map[string]string{
-		"var.foo": "us-east-1",
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformInputVarsStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Input_badVarDefault(t *testing.T) {
-	m := testModule(t, "input-bad-var-default")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Config["foo"] = "bar"
-		return c, nil
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Input_provider(t *testing.T) {
-	m := testModule(t, "input-provider")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	var actual interface{}
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Config["foo"] = "bar"
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		actual = c.Config["foo"]
-		return nil
-	}
-	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !reflect.DeepEqual(actual, "bar") {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Input_providerMulti(t *testing.T) {
-	m := testModule(t, "input-provider-multi")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	var actual []interface{}
-	var lock sync.Mutex
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Config["foo"] = "bar"
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		lock.Lock()
-		defer lock.Unlock()
-		actual = append(actual, c.Config["foo"])
-		return nil
-	}
-	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
-		return nil, c.CheckSet([]string{"foo"})
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := []interface{}{"bar", "bar"}
-	if !reflect.DeepEqual(actual, expected) {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Input_providerOnce(t *testing.T) {
-	m := testModule(t, "input-provider-once")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	count := 0
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		count++
-		return nil, nil
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if count != 1 {
-		t.Fatalf("should only be called once: %d", count)
-	}
-}
-
-func TestContext2Input_providerId(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-provider")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		UIInput: input,
-	})
-
-	var actual interface{}
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		v, err := i.Input(&InputOpts{Id: "foo"})
-		if err != nil {
-			return nil, err
-		}
-
-		c.Config["foo"] = v
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		actual = c.Config["foo"]
-		return nil
-	}
-
-	input.InputReturnMap = map[string]string{
-		"provider.aws.foo": "bar",
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !reflect.DeepEqual(actual, "bar") {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Input_providerOnly(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-provider-vars")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "us-west-2",
-		},
-		UIInput: input,
-	})
-
-	input.InputReturnMap = map[string]string{
-		"var.foo": "us-east-1",
-	}
-
-	var actual interface{}
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Config["foo"] = "bar"
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		actual = c.Config["foo"]
-		return nil
-	}
-
-	if err := ctx.Input(InputModeProvider); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !reflect.DeepEqual(actual, "bar") {
-		t.Fatalf("bad: %#v", actual)
-	}
-
-	actualStr := strings.TrimSpace(state.String())
-	expectedStr := strings.TrimSpace(testTerraformInputProviderOnlyStr)
-	if actualStr != expectedStr {
-		t.Fatalf("bad: \n%s", actualStr)
-	}
-}
-
-func TestContext2Input_providerVars(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-provider-with-vars")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "bar",
-		},
-		UIInput: input,
-	})
-
-	input.InputReturnMap = map[string]string{
-		"var.foo": "bar",
-	}
-
-	var actual interface{}
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Config["bar"] = "baz"
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		actual, _ = c.Get("foo")
-		return nil
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !reflect.DeepEqual(actual, "bar") {
-		t.Fatalf("bad: %#v", actual)
-	}
-}
-
-func TestContext2Input_providerVarsModuleInherit(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-provider-with-vars-and-module")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		UIInput: input,
-	})
-
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		if errs := c.CheckSet([]string{"access_key"}); len(errs) > 0 {
-			return c, errs[0]
-		}
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		return nil
-	}
-
-	if err := ctx.Input(InputModeStd); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Input_varOnly(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-provider-vars")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "us-west-2",
-		},
-		UIInput: input,
-	})
-
-	input.InputReturnMap = map[string]string{
-		"var.foo": "us-east-1",
-	}
-
-	var actual interface{}
-	p.InputFn = func(i UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-		c.Raw["foo"] = "bar"
-		return c, nil
-	}
-	p.ConfigureFn = func(c *ResourceConfig) error {
-		actual = c.Raw["foo"]
-		return nil
-	}
-
-	if err := ctx.Input(InputModeVar); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if reflect.DeepEqual(actual, "bar") {
-		t.Fatalf("bad: %#v", actual)
-	}
-
-	actualStr := strings.TrimSpace(state.String())
-	expectedStr := strings.TrimSpace(testTerraformInputVarOnlyStr)
-	if actualStr != expectedStr {
-		t.Fatalf("bad: \n%s", actualStr)
-	}
-}
-
-func TestContext2Input_varOnlyUnset(t *testing.T) {
-	input := new(MockUIInput)
-	m := testModule(t, "input-vars-unset")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo": "foovalue",
-		},
-		UIInput: input,
-	})
-
-	input.InputReturnMap = map[string]string{
-		"var.foo": "nope",
-		"var.bar": "baz",
-	}
-
-	if err := ctx.Input(InputModeVar | InputModeVarUnset); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actualStr := strings.TrimSpace(state.String())
-	expectedStr := strings.TrimSpace(testTerraformInputVarOnlyUnsetStr)
-	if actualStr != expectedStr {
-		t.Fatalf("bad: \n%s", actualStr)
-	}
-}
-
-func TestContext2Apply(t *testing.T) {
-	m := testModule(t, "apply-good")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) < 2 {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_providerAlias(t *testing.T) {
-	m := testModule(t, "apply-provider-alias")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) < 2 {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProviderAliasStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_emptyModule(t *testing.T) {
-	m := testModule(t, "apply-empty-module")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	actual = strings.Replace(actual, "  ", "", -1)
-	expected := strings.TrimSpace(testTerraformApplyEmptyModuleStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s\nexpect:\n%s", actual, expected)
-	}
-}
-
-func TestContext2Apply_createBeforeDestroy(t *testing.T) {
-	m := testModule(t, "apply-good-create-before")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if p, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	} else {
-		t.Logf(p.String())
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 1 {
-		t.Fatalf("bad: %s", state)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCreateBeforeStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_createBeforeDestroyUpdate(t *testing.T) {
-	m := testModule(t, "apply-good-create-before-update")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo": "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if p, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	} else {
-		t.Logf(p.String())
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 1 {
-		t.Fatalf("bad: %s", state)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCreateBeforeUpdateStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_minimal(t *testing.T) {
-	m := testModule(t, "apply-minimal")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyMinimalStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_badDiff(t *testing.T) {
-	m := testModule(t, "apply-good")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"newp": nil,
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Apply(); err == nil {
-		t.Fatal("should error")
-	}
-}
-
-func TestContext2Apply_cancel(t *testing.T) {
-	stopped := false
-
-	m := testModule(t, "apply-cancel")
-	p := testProvider("aws")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ApplyFn = func(*InstanceInfo, *InstanceState, *InstanceDiff) (*InstanceState, error) {
-		if !stopped {
-			stopped = true
-			go ctx.Stop()
-
-			for {
-				if ctx.sh.Stopped() {
-					break
-				}
-			}
-		}
-
-		return &InstanceState{
-			ID: "foo",
-			Attributes: map[string]string{
-				"num": "2",
-			},
-		}, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					New: "bar",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Start the Apply in a goroutine
-	stateCh := make(chan *State)
-	go func() {
-		state, err := ctx.Apply()
-		if err != nil {
-			panic(err)
-		}
-
-		stateCh <- state
-	}()
-
-	state := <-stateCh
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 1 {
-		t.Fatalf("bad: %s", state.String())
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCancelStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_compute(t *testing.T) {
-	m := testModule(t, "apply-compute")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	ctx.variables = map[string]string{"value": "1"}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyComputeStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_countDecrease(t *testing.T) {
-	m := testModule(t, "apply-count-dec")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.1": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.2": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCountDecStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_countDecreaseToOne(t *testing.T) {
-	m := testModule(t, "apply-count-dec-one")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.1": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-					"aws_instance.foo.2": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCountDecToOneStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-// https://github.com/PeoplePerHour/terraform/pull/11
-//
-// This tests a case where both a "resource" and "resource.0" are in
-// the state file, which apparently is a reasonable backwards compatibility
-// concern found in the above 3rd party repo.
-func TestContext2Apply_countDecreaseToOneCorrupted(t *testing.T) {
-	m := testModule(t, "apply-count-dec-one")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "foo",
-								"type": "aws_instance",
-							},
-						},
-					},
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-							Attributes: map[string]string{
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if p, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	} else {
-		testStringMatch(t, p, testTerraformApplyCountDecToOneCorruptedPlanStr)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCountDecToOneCorruptedStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_countTainted(t *testing.T) {
-	m := testModule(t, "apply-count-tainted")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo.0": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "bar",
-								Attributes: map[string]string{
-									"foo":  "foo",
-									"type": "aws_instance",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCountTaintedStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_countVariable(t *testing.T) {
-	m := testModule(t, "apply-count-variable")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyCountVariableStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_module(t *testing.T) {
-	m := testModule(t, "apply-module")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyModuleStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_moduleDestroyOrder(t *testing.T) {
-	m := testModule(t, "apply-module-destroy-order")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-
-	// Create a custom apply function to track the order they were destroyed
-	var order []string
-	var orderLock sync.Mutex
-	p.ApplyFn = func(
-		info *InstanceInfo,
-		is *InstanceState,
-		id *InstanceDiff) (*InstanceState, error) {
-		orderLock.Lock()
-		defer orderLock.Unlock()
-
-		order = append(order, is.ID)
-		return nil, nil
-	}
-
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.b": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "b",
-						},
-					},
-				},
-			},
-
-			&ModuleState{
-				Path: []string{"root", "child"},
-				Resources: map[string]*ResourceState{
-					"aws_instance.a": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "a",
-						},
-					},
-				},
-				Outputs: map[string]string{
-					"a_output": "a",
-				},
-			},
-		},
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State:   state,
-		Destroy: true,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := []string{"b", "a"}
-	if !reflect.DeepEqual(order, expected) {
-		t.Fatalf("bad: %#v", order)
-	}
-
-	{
-		actual := strings.TrimSpace(state.String())
-		expected := strings.TrimSpace(testTerraformApplyModuleDestroyOrderStr)
-		if actual != expected {
-			t.Fatalf("bad: \n%s", actual)
-		}
-	}
-}
-
-func TestContext2Apply_moduleVarResourceCount(t *testing.T) {
-	m := testModule(t, "apply-module-var-resource-count")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"count": "2",
-		},
-		Destroy: true,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	ctx = testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"count": "5",
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-// GH-819
-func TestContext2Apply_moduleBool(t *testing.T) {
-	m := testModule(t, "apply-module-bool")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyModuleBoolStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_multiProvider(t *testing.T) {
-	m := testModule(t, "apply-multi-provider")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-
-	pDO := testProvider("do")
-	pDO.ApplyFn = testApplyFn
-	pDO.DiffFn = testDiffFn
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-			"do":  testProviderFuncFixed(pDO),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) < 2 {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyMultiProviderStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_nilDiff(t *testing.T) {
-	m := testModule(t, "apply-good")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return nil, nil
-	}
-
-	if _, err := ctx.Apply(); err == nil {
-		t.Fatal("should error")
-	}
-}
-
-func TestContext2Apply_outputOrphan(t *testing.T) {
-	m := testModule(t, "apply-output-orphan")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Outputs: map[string]string{
-					"foo": "bar",
-					"bar": "baz",
-				},
-			},
-		},
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyOutputOrphanStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_Provisioner_compute(t *testing.T) {
-	m := testModule(t, "apply-provisioner-compute")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		val, ok := c.Config["foo"]
-		if !ok || val != "computed_dynamical" {
-			t.Fatalf("bad value for foo: %v %#v", val, c)
-		}
-
-		return nil
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		Variables: map[string]string{
-			"value": "1",
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-}
-
-func TestContext2Apply_provisionerCreateFail(t *testing.T) {
-	m := testModule(t, "apply-provisioner-fail-create")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.DiffFn = testDiffFn
-
-	p.ApplyFn = func(
-		info *InstanceInfo,
-		is *InstanceState,
-		id *InstanceDiff) (*InstanceState, error) {
-		is.ID = "foo"
-		return is, fmt.Errorf("error")
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_provisionerCreateFailNoId(t *testing.T) {
-	m := testModule(t, "apply-provisioner-fail-create")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.DiffFn = testDiffFn
-
-	p.ApplyFn = func(
-		info *InstanceInfo,
-		is *InstanceState,
-		id *InstanceDiff) (*InstanceState, error) {
-		return nil, fmt.Errorf("error")
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateNoIdStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_provisionerFail(t *testing.T) {
-	m := testModule(t, "apply-provisioner-fail")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-
-	pr.ApplyFn = func(*InstanceState, *ResourceConfig) error {
-		return fmt.Errorf("EXPLOSION")
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		Variables: map[string]string{
-			"value": "1",
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerFailStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_provisionerFail_createBeforeDestroy(t *testing.T) {
-	m := testModule(t, "apply-provisioner-fail-create-before")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(*InstanceState, *ResourceConfig) error {
-		return fmt.Errorf("EXPLOSION")
-	}
-
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerFailCreateBeforeDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_error_createBeforeDestroy(t *testing.T) {
-	m := testModule(t, "apply-error-create-before")
-	p := testProvider("aws")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
-		return nil, fmt.Errorf("error")
-	}
-	p.DiffFn = testDiffFn
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyErrorCreateBeforeDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s\n\nExpected:\n\n%s", actual, expected)
-	}
-}
-
-func TestContext2Apply_errorDestroy_createBeforeDestroy(t *testing.T) {
-	m := testModule(t, "apply-error-create-before")
-	p := testProvider("aws")
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
-		// Fail the destroy!
-		if id.Destroy {
-			return is, fmt.Errorf("error")
-		}
-
-		// Create should work
-		is = &InstanceState{
-			ID: "foo",
-		}
-		return is, nil
-	}
-	p.DiffFn = testDiffFn
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyErrorDestroyCreateBeforeDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad: actual:\n%s\n\nexpected:\n%s", actual, expected)
-	}
-}
-
-func TestContext2Apply_multiDepose_createBeforeDestroy(t *testing.T) {
-	m := testModule(t, "apply-multi-depose-create-before-destroy")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ps := map[string]ResourceProviderFactory{"aws": testProviderFuncFixed(p)}
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type:    "aws_instance",
-						Primary: &InstanceState{ID: "foo"},
-					},
-				},
-			},
-		},
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module:    m,
-		Providers: ps,
-		State:     state,
-	})
-	createdInstanceId := "bar"
-	// Create works
-	createFunc := func(is *InstanceState) (*InstanceState, error) {
-		return &InstanceState{ID: createdInstanceId}, nil
-	}
-	// Destroy starts broken
-	destroyFunc := func(is *InstanceState) (*InstanceState, error) {
-		return is, fmt.Errorf("destroy failed")
-	}
-	p.ApplyFn = func(info *InstanceInfo, is *InstanceState, id *InstanceDiff) (*InstanceState, error) {
-		if id.Destroy {
-			return destroyFunc(is)
-		} else {
-			return createFunc(is)
-		}
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Destroy is broken, so even though CBD successfully replaces the instance,
-	// we'll have to save the Deposed instance to destroy later
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	checkStateString(t, state, `
-aws_instance.web: (1 deposed)
-  ID = bar
-  Deposed ID 1 = foo
-	`)
-
-	createdInstanceId = "baz"
-	ctx = testContext2(t, &ContextOpts{
-		Module:    m,
-		Providers: ps,
-		State:     state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// We're replacing the primary instance once again. Destroy is _still_
-	// broken, so the Deposed list gets longer
-	state, err = ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	checkStateString(t, state, `
-aws_instance.web: (2 deposed)
-  ID = baz
-  Deposed ID 1 = foo
-  Deposed ID 2 = bar
-	`)
-
-	// Destroy partially fixed!
-	destroyFunc = func(is *InstanceState) (*InstanceState, error) {
-		if is.ID == "foo" || is.ID == "baz" {
-			return nil, nil
-		} else {
-			return is, fmt.Errorf("destroy partially failed")
-		}
-	}
-
-	createdInstanceId = "qux"
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	state, err = ctx.Apply()
-	// Expect error because 1/2 of Deposed destroys failed
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	// foo and baz are now gone, bar sticks around
-	checkStateString(t, state, `
-aws_instance.web: (1 deposed)
-  ID = qux
-  Deposed ID 1 = bar
-	`)
-
-	// Destroy working fully!
-	destroyFunc = func(is *InstanceState) (*InstanceState, error) {
-		return nil, nil
-	}
-
-	createdInstanceId = "quux"
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	state, err = ctx.Apply()
-	if err != nil {
-		t.Fatal("should not have error:", err)
-	}
-
-	// And finally the state is clean
-	checkStateString(t, state, `
-aws_instance.web:
-  ID = quux
-	`)
-}
-
-func TestContext2Apply_provisionerResourceRef(t *testing.T) {
-	m := testModule(t, "apply-provisioner-resource-ref")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		val, ok := c.Config["foo"]
-		if !ok || val != "2" {
-			t.Fatalf("bad value for foo: %v %#v", val, c)
-		}
-
-		return nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerResourceRefStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-}
-
-func TestContext2Apply_provisionerSelfRef(t *testing.T) {
-	m := testModule(t, "apply-provisioner-self-ref")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		val, ok := c.Config["command"]
-		if !ok || val != "bar" {
-			t.Fatalf("bad value for command: %v %#v", val, c)
-		}
-
-		return nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerSelfRefStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-}
-
-func TestContext2Apply_provisionerMultiSelfRef(t *testing.T) {
-	var lock sync.Mutex
-	commands := make([]string, 0, 5)
-
-	m := testModule(t, "apply-provisioner-multi-self-ref")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		lock.Lock()
-		defer lock.Unlock()
-
-		val, ok := c.Config["command"]
-		if !ok {
-			t.Fatalf("bad value for command: %v %#v", val, c)
-		}
-
-		commands = append(commands, val.(string))
-		return nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerMultiSelfRefStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-
-	// Verify our result
-	sort.Strings(commands)
-	expectedCommands := []string{"number 0", "number 1", "number 2"}
-	if !reflect.DeepEqual(commands, expectedCommands) {
-		t.Fatalf("bad: %#v", commands)
-	}
-}
-
-// Provisioner should NOT run on a diff, only create
-func TestContext2Apply_Provisioner_Diff(t *testing.T) {
-	m := testModule(t, "apply-provisioner-diff")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		return nil
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerDiffStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-	pr.ApplyCalled = false
-
-	// Change the state to force a diff
-	mod := state.RootModule()
-	mod.Resources["aws_instance.bar"].Primary.Attributes["foo"] = "baz"
-
-	// Re-create context with state
-	ctx = testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state2, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual = strings.TrimSpace(state2.String())
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was NOT invoked
-	if pr.ApplyCalled {
-		t.Fatalf("provisioner invoked")
-	}
-}
-
-func TestContext2Apply_outputDiffVars(t *testing.T) {
-	m := testModule(t, "apply-good")
-	p := testProvider("aws")
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.baz": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		for k, ad := range d.Attributes {
-			if ad.NewComputed {
-				return nil, fmt.Errorf("%s: computed", k)
-			}
-		}
-
-		result := s.MergeDiff(d)
-		result.ID = "foo"
-		return result, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"foo": &ResourceAttrDiff{
-					NewComputed: true,
-					Type:        DiffAttrOutput,
-				},
-				"bar": &ResourceAttrDiff{
-					New: "baz",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Apply_Provisioner_ConnInfo(t *testing.T) {
-	m := testModule(t, "apply-provisioner-conninfo")
-	p := testProvider("aws")
-	pr := testProvisioner()
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		if s.Ephemeral.ConnInfo == nil {
-			t.Fatalf("ConnInfo not initialized")
-		}
-
-		result, _ := testApplyFn(info, s, d)
-		result.Ephemeral.ConnInfo = map[string]string{
-			"type": "ssh",
-			"host": "127.0.0.1",
-			"port": "22",
-		}
-		return result, nil
-	}
-	p.DiffFn = testDiffFn
-
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		conn := rs.Ephemeral.ConnInfo
-		if conn["type"] != "telnet" {
-			t.Fatalf("Bad: %#v", conn)
-		}
-		if conn["host"] != "127.0.0.1" {
-			t.Fatalf("Bad: %#v", conn)
-		}
-		if conn["port"] != "2222" {
-			t.Fatalf("Bad: %#v", conn)
-		}
-		if conn["user"] != "superuser" {
-			t.Fatalf("Bad: %#v", conn)
-		}
-		if conn["pass"] != "test" {
-			t.Fatalf("Bad: %#v", conn)
-		}
-
-		return nil
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		Variables: map[string]string{
-			"value": "1",
-			"pass":  "test",
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyProvisionerStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Verify apply was invoked
-	if !pr.ApplyCalled {
-		t.Fatalf("provisioner not invoked")
-	}
-}
-
-func TestContext2Apply_destroy(t *testing.T) {
-	m := testModule(t, "apply-destroy")
-	h := new(HookRecordApplyOrder)
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	// First plan and apply a create operation
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Next, plan and apply a destroy operation
-	h.Active = true
-	ctx = testContext2(t, &ContextOpts{
-		Destroy: true,
-		State:   state,
-		Module:  m,
-		Hooks:   []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err = ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Test that things were destroyed
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyDestroyStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-
-	// Test that things were destroyed _in the right order_
-	expected2 := []string{"aws_instance.bar", "aws_instance.foo"}
-	actual2 := h.IDs
-	if !reflect.DeepEqual(actual2, expected2) {
-		t.Fatalf("expected: %#v\n\ngot:%#v", expected2, actual2)
-	}
-}
-
-func TestContext2Apply_destroyOutputs(t *testing.T) {
-	m := testModule(t, "apply-destroy-outputs")
-	h := new(HookRecordApplyOrder)
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	// First plan and apply a create operation
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	// Next, plan and apply a destroy operation
-	h.Active = true
-	ctx = testContext2(t, &ContextOpts{
-		Destroy: true,
-		State:   state,
-		Module:  m,
-		Hooks:   []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err = ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) > 0 {
-		t.Fatalf("bad: %#v", mod)
-	}
-}
-
-func TestContext2Apply_destroyOrphan(t *testing.T) {
-	m := testModule(t, "apply-error")
-	p := testProvider("aws")
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.baz": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		if d.Destroy {
-			return nil, nil
-		}
-
-		result := s.MergeDiff(d)
-		result.ID = "foo"
-		return result, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					New: "bar",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if _, ok := mod.Resources["aws_instance.baz"]; ok {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-}
-
-func TestContext2Apply_destroyTaintedProvisioner(t *testing.T) {
-	m := testModule(t, "apply-destroy-provisioner")
-	p := testProvider("aws")
-	pr := testProvisioner()
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-
-	called := false
-	pr.ApplyFn = func(rs *InstanceState, c *ResourceConfig) error {
-		called = true
-		return nil
-	}
-
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "bar",
-								Attributes: map[string]string{
-									"id": "bar",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Provisioners: map[string]ResourceProvisionerFactory{
-			"shell": testProvisionerFuncFixed(pr),
-		},
-		State:   s,
-		Destroy: true,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if called {
-		t.Fatal("provisioner should not be called")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace("<no state>")
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_error(t *testing.T) {
-	errored := false
-
-	m := testModule(t, "apply-error")
-	p := testProvider("aws")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ApplyFn = func(*InstanceInfo, *InstanceState, *InstanceDiff) (*InstanceState, error) {
-		if errored {
-			state := &InstanceState{
-				ID: "bar",
-			}
-			return state, fmt.Errorf("error")
-		}
-		errored = true
-
-		return &InstanceState{
-			ID: "foo",
-			Attributes: map[string]string{
-				"num": "2",
-			},
-		}, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					New: "bar",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyErrorStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_errorPartial(t *testing.T) {
-	errored := false
-
-	m := testModule(t, "apply-error")
-	p := testProvider("aws")
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		if errored {
-			return s, fmt.Errorf("error")
-		}
-		errored = true
-
-		return &InstanceState{
-			ID: "foo",
-			Attributes: map[string]string{
-				"num": "2",
-			},
-		}, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					New: "bar",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should have error")
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 2 {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyErrorPartialStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_hook(t *testing.T) {
-	m := testModule(t, "apply-good")
-	h := new(MockHook)
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if _, err := ctx.Apply(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if !h.PreApplyCalled {
-		t.Fatal("should be called")
-	}
-	if !h.PostApplyCalled {
-		t.Fatal("should be called")
-	}
-	if !h.PostStateUpdateCalled {
-		t.Fatalf("should call post state update")
-	}
-}
-
-func TestContext2Apply_idAttr(t *testing.T) {
-	m := testModule(t, "apply-idattr")
-	p := testProvider("aws")
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		result := s.MergeDiff(d)
-		result.ID = "foo"
-		result.Attributes = map[string]string{
-			"id": "bar",
-		}
-
-		return result, nil
-	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
-				"num": &ResourceAttrDiff{
-					New: "bar",
-				},
-			},
-		}, nil
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	rs, ok := mod.Resources["aws_instance.foo"]
-	if !ok {
-		t.Fatal("not in state")
-	}
-	if rs.Primary.ID != "foo" {
-		t.Fatalf("bad: %#v", rs.Primary.ID)
-	}
-	if rs.Primary.Attributes["id"] != "foo" {
-		t.Fatalf("bad: %#v", rs.Primary.Attributes)
-	}
-}
-
-func TestContext2Apply_output(t *testing.T) {
-	m := testModule(t, "apply-output")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyOutputStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_outputInvalid(t *testing.T) {
-	m := testModule(t, "apply-output-invalid")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	_, err := ctx.Plan()
-	if err == nil {
-		t.Fatalf("err: %s", err)
-	}
-	if !strings.Contains(err.Error(), "is not a string") {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func TestContext2Apply_outputList(t *testing.T) {
-	m := testModule(t, "apply-output-list")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyOutputListStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_outputMulti(t *testing.T) {
-	m := testModule(t, "apply-output-multi")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyOutputMultiStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_outputMultiIndex(t *testing.T) {
-	m := testModule(t, "apply-output-multi-index")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyOutputMultiIndexStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_taint(t *testing.T) {
-	m := testModule(t, "apply-taint")
-	p := testProvider("aws")
-
-	// destroyCount tests against regression of
-	// https://github.com/hashicorp/terraform/issues/1056
-	var destroyCount = int32(0)
-	var once sync.Once
-	simulateProviderDelay := func() {
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		once.Do(simulateProviderDelay)
-		if d.Destroy {
-			atomic.AddInt32(&destroyCount, 1)
-		}
-		return testApplyFn(info, s, d)
-	}
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "baz",
-								Attributes: map[string]string{
-									"num":  "2",
-									"type": "aws_instance",
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyTaintStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-
-	if destroyCount != 1 {
-		t.Fatalf("Expected 1 destroy, got %d", destroyCount)
-	}
-}
-
-func TestContext2Apply_taintDep(t *testing.T) {
-	m := testModule(t, "apply-taint-dep")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "baz",
-								Attributes: map[string]string{
-									"num":  "2",
-									"type": "aws_instance",
-								},
-							},
-						},
-					},
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "baz",
-								"num":  "2",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if p, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	} else {
-		t.Logf("plan: %s", p)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyTaintDepStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Apply_taintDepRequiresNew(t *testing.T) {
-	m := testModule(t, "apply-taint-dep-requires-new")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	s := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type: "aws_instance",
-						Tainted: []*InstanceState{
-							&InstanceState{
-								ID: "baz",
-								Attributes: map[string]string{
-									"num":  "2",
-									"type": "aws_instance",
-								},
-							},
-						},
-					},
-					"aws_instance.bar": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"foo":  "baz",
-								"num":  "2",
-								"type": "aws_instance",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: s,
-	})
-
-	if p, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	} else {
-		t.Logf("plan: %s", p)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyTaintDepRequireNewStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
-func TestContext2Apply_targeted(t *testing.T) {
-	m := testModule(t, "apply-targeted")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"aws_instance.foo"},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 1 {
-		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
-	}
-
-	checkStateString(t, state, `
-aws_instance.foo:
-  ID = foo
-  num = 2
-  type = aws_instance
-	`)
-}
-
-func TestContext2Apply_targetedCount(t *testing.T) {
-	m := testModule(t, "apply-targeted-count")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"aws_instance.foo"},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	checkStateString(t, state, `
-aws_instance.foo.0:
-  ID = foo
-aws_instance.foo.1:
-  ID = foo
-aws_instance.foo.2:
-  ID = foo
-	`)
-}
-
-func TestContext2Apply_targetedCountIndex(t *testing.T) {
-	m := testModule(t, "apply-targeted-count")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"aws_instance.foo[1]"},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	checkStateString(t, state, `
-aws_instance.foo.1:
-  ID = foo
-	`)
-}
-
-func TestContext2Apply_targetedDestroy(t *testing.T) {
-	m := testModule(t, "apply-targeted")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.bar": resourceState("aws_instance", "i-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{"aws_instance.foo"},
-		Destroy: true,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) != 1 {
-		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
-	}
-
-	checkStateString(t, state, `
-aws_instance.bar:
-  ID = i-abc123
-	`)
-}
-
-func TestContext2Apply_targetedDestroyCountIndex(t *testing.T) {
-	m := testModule(t, "apply-targeted-count")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: &State{
-			Modules: []*ModuleState{
-				&ModuleState{
-					Path: rootModulePath,
-					Resources: map[string]*ResourceState{
-						"aws_instance.foo.0": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.foo.1": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.foo.2": resourceState("aws_instance", "i-bcd345"),
-						"aws_instance.bar.0": resourceState("aws_instance", "i-abc123"),
-						"aws_instance.bar.1": resourceState("aws_instance", "i-abc123"),
-						"aws_instance.bar.2": resourceState("aws_instance", "i-abc123"),
-					},
-				},
-			},
-		},
-		Targets: []string{
-			"aws_instance.foo[2]",
-			"aws_instance.bar[1]",
-		},
-		Destroy: true,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	checkStateString(t, state, `
-aws_instance.bar.0:
-  ID = i-abc123
-aws_instance.bar.2:
-  ID = i-abc123
-aws_instance.foo.0:
-  ID = i-bcd345
-aws_instance.foo.1:
-  ID = i-bcd345
-	`)
-}
-
-func TestContext2Apply_targetedModule(t *testing.T) {
-	m := testModule(t, "apply-targeted-module")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"module.child"},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.ModuleByPath([]string{"root", "child"})
-	if mod == nil {
-		t.Fatalf("no child module found in the state!\n\n%#v", state)
-	}
-	if len(mod.Resources) != 2 {
-		t.Fatalf("expected 2 resources, got: %#v", mod.Resources)
-	}
-
-	checkStateString(t, state, `
-<no state>
-module.child:
-  aws_instance.bar:
-    ID = foo
-    num = 2
-    type = aws_instance
-  aws_instance.foo:
-    ID = foo
-    num = 2
-    type = aws_instance
-	`)
-}
-
-func TestContext2Apply_targetedModuleResource(t *testing.T) {
-	m := testModule(t, "apply-targeted-module-resource")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Targets: []string{"module.child.aws_instance.foo"},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.ModuleByPath([]string{"root", "child"})
-	if len(mod.Resources) != 1 {
-		t.Fatalf("expected 1 resource, got: %#v", mod.Resources)
-	}
-
-	checkStateString(t, state, `
-<no state>
-module.child:
-  aws_instance.foo:
-    ID = foo
-    num = 2
-    type = aws_instance
-	`)
-}
-
-func TestContext2Apply_unknownAttribute(t *testing.T) {
-	m := testModule(t, "apply-unknown")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err == nil {
-		t.Fatal("should error")
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyUnknownAttrStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_vars(t *testing.T) {
-	m := testModule(t, "apply-vars")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		Variables: map[string]string{
-			"foo":            "us-west-2",
-			"amis.us-east-1": "override",
-		},
-	})
-
-	w, e := ctx.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyVarsStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_varsEnv(t *testing.T) {
-	m := testModule(t, "apply-vars-env")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	// Set the env var
-	old := tempEnv(t, "TF_VAR_ami", "baz")
-	defer os.Setenv("TF_VAR_ami", old)
-
-	w, e := ctx.Validate()
-	if len(w) > 0 {
-		t.Fatalf("bad: %#v", w)
-	}
-	if len(e) > 0 {
-		t.Fatalf("bad: %s", e)
-	}
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyVarsEnvStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s", actual)
-	}
-}
-
-func TestContext2Apply_createBefore_depends(t *testing.T) {
-	m := testModule(t, "apply-depends-create-before")
-	h := new(HookRecordApplyOrder)
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "ami-old",
-							},
-						},
-					},
-					"aws_instance.lb": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-							Attributes: map[string]string{
-								"instance": "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	h.Active = true
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	mod := state.RootModule()
-	if len(mod.Resources) < 2 {
-		t.Fatalf("bad: %#v", mod.Resources)
-	}
-
-	actual := strings.TrimSpace(state.String())
-	expected := strings.TrimSpace(testTerraformApplyDependsCreateBeforeStr)
-	if actual != expected {
-		t.Fatalf("bad: \n%s\n%s", actual, expected)
-	}
-
-	// Test that things were managed _in the right order_
-	order := h.States
-	diffs := h.Diffs
-	if order[0].ID != "" || diffs[0].Destroy {
-		t.Fatalf("should create new instance first: %#v", order)
-	}
-
-	if order[1].ID != "baz" {
-		t.Fatalf("update must happen after create: %#v", order)
-	}
-
-	if order[2].ID != "bar" || !diffs[2].Destroy {
-		t.Fatalf("destroy must happen after update: %#v", order)
-	}
-}
-
-func TestContext2Apply_singleDestroy(t *testing.T) {
-	m := testModule(t, "apply-depends-create-before")
-	h := new(HookRecordApplyOrder)
-	p := testProvider("aws")
-
-	invokeCount := 0
-	p.ApplyFn = func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error) {
-		invokeCount++
-		switch invokeCount {
-		case 1:
-			if d.Destroy {
-				t.Fatalf("should not destroy")
-			}
-			if s.ID != "" {
-				t.Fatalf("should not have ID")
-			}
-		case 2:
-			if d.Destroy {
-				t.Fatalf("should not destroy")
-			}
-			if s.ID != "baz" {
-				t.Fatalf("should have id")
-			}
-		case 3:
-			if !d.Destroy {
-				t.Fatalf("should destroy")
-			}
-			if s.ID == "" {
-				t.Fatalf("should have ID")
-			}
-		default:
-			t.Fatalf("bad invoke count %d", invokeCount)
-		}
-		return testApplyFn(info, s, d)
-	}
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.web": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "ami-old",
-							},
-						},
-					},
-					"aws_instance.lb": &ResourceState{
-						Type: "aws_instance",
-						Primary: &InstanceState{
-							ID: "baz",
-							Attributes: map[string]string{
-								"instance": "bar",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Hooks:  []Hook{h},
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	h.Active = true
-	state, err := ctx.Apply()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if invokeCount != 3 {
-		t.Fatalf("bad: %d", invokeCount)
-	}
-}
-
 func testContext2(t *testing.T, opts *ContextOpts) *Context {
 	return NewContext(opts)
 }
diff --git a/terraform/context_validate_test.go b/terraform/context_validate_test.go
new file mode 100644
index 000000000..f7f03b94b
--- /dev/null
+++ b/terraform/context_validate_test.go
@@ -0,0 +1,736 @@
+package terraform
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestContext2Validate_badVar(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-bad-var")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_computedVar(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-computed-var")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(testProvider("test")),
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		if !c.IsComputed("value") {
+			return nil, []error{fmt.Errorf("value isn't computed")}
+		}
+
+		return nil, c.CheckSet([]string{"value"})
+	}
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		return fmt.Errorf("Configure should not be called for provider")
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_countNegative(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-count-negative")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_countVariable(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "apply-count-variable")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_countVariableNoDefault(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-count-variable")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) != 1 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+/*
+TODO: What should we do here?
+func TestContext2Validate_cycle(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-cycle")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("expected no warns, got: %#v", w)
+	}
+	if len(e) != 1 {
+		t.Fatalf("expected 1 err, got: %s", e)
+	}
+}
+*/
+
+func TestContext2Validate_moduleBadOutput(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-bad-module-output")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_moduleGood(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-good-module")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_moduleBadResource(t *testing.T) {
+	m := testModule(t, "validate-module-bad-rc")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateResourceReturnErrors = []error{fmt.Errorf("bad")}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_moduleDepsShouldNotCycle(t *testing.T) {
+	m := testModule(t, "validate-module-deps-cycle")
+	p := testProvider("aws")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := ctx.Validate()
+
+	if len(w) > 0 {
+		t.Fatalf("expected no warnings, got: %s", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("expected no errors, got: %s", e)
+	}
+}
+
+func TestContext2Validate_moduleProviderInherit(t *testing.T) {
+	m := testModule(t, "validate-module-pc-inherit")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"set"})
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_moduleProviderInheritOrphan(t *testing.T) {
+	m := testModule(t, "validate-module-pc-inherit-orphan")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: []string{"root", "child"},
+					Resources: map[string]*ResourceState{
+						"aws_instance.bar": &ResourceState{
+							Type: "aws_instance",
+							Primary: &InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		v, ok := c.Get("set")
+		if !ok {
+			return nil, []error{fmt.Errorf("not set")}
+		}
+		if v != "bar" {
+			return nil, []error{fmt.Errorf("bad: %#v", v)}
+		}
+
+		return nil, nil
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_moduleProviderVar(t *testing.T) {
+	m := testModule(t, "validate-module-pc-vars")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"provider_var": "bar",
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_moduleProviderInheritUnused(t *testing.T) {
+	m := testModule(t, "validate-module-pc-inherit-unused")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_orphans(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-good")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.web": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	p.ValidateResourceFn = func(
+		t string, c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_providerConfig_bad(t *testing.T) {
+	m := testModule(t, "validate-bad-pc")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateReturnErrors = []error{fmt.Errorf("bad")}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %s", e)
+	}
+	if !strings.Contains(fmt.Sprintf("%s", e), "bad") {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_providerConfig_badEmpty(t *testing.T) {
+	m := testModule(t, "validate-bad-pc-empty")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateReturnErrors = []error{fmt.Errorf("bad")}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_providerConfig_good(t *testing.T) {
+	m := testModule(t, "validate-bad-pc")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_provisionerConfig_bad(t *testing.T) {
+	m := testModule(t, "validate-bad-prov-conf")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	pr.ValidateReturnErrors = []error{fmt.Errorf("bad")}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_provisionerConfig_good(t *testing.T) {
+	m := testModule(t, "validate-bad-prov-conf")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	pr.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		if c == nil {
+			t.Fatalf("missing resource config for provisioner")
+		}
+		return nil, c.CheckSet([]string{"command"})
+	}
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_requiredVar(t *testing.T) {
+	m := testModule(t, "validate-required-var")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_resourceConfig_bad(t *testing.T) {
+	m := testModule(t, "validate-bad-rc")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	p.ValidateResourceReturnErrors = []error{fmt.Errorf("bad")}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_resourceConfig_good(t *testing.T) {
+	m := testModule(t, "validate-bad-rc")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_resourceNameSymbol(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-resource-name-symbol")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) == 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_selfRef(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-self-ref")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_selfRefMulti(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-self-ref-multi")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_selfRefMultiAll(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-self-ref-multi-all")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) == 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_tainted(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-good")
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Tainted: []*InstanceState{
+							&InstanceState{
+								ID: "bar",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: state,
+	})
+
+	p.ValidateResourceFn = func(
+		t string, c *ResourceConfig) ([]string, []error) {
+		return nil, c.CheckSet([]string{"foo"})
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
+func TestContext2Validate_targetedDestroy(t *testing.T) {
+	m := testModule(t, "validate-targeted")
+	p := testProvider("aws")
+	pr := testProvisioner()
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"shell": testProvisionerFuncFixed(pr),
+		},
+		State: &State{
+			Modules: []*ModuleState{
+				&ModuleState{
+					Path: rootModulePath,
+					Resources: map[string]*ResourceState{
+						"aws_instance.foo": resourceState("aws_instance", "i-bcd345"),
+						"aws_instance.bar": resourceState("aws_instance", "i-abc123"),
+					},
+				},
+			},
+		},
+		Targets: []string{"aws_instance.foo"},
+		Destroy: true,
+	})
+
+	w, e := ctx.Validate()
+	if len(w) > 0 {
+		warnStr := ""
+		for _, v := range w {
+			warnStr = warnStr + " " + v
+		}
+		t.Fatalf("bad: %s", warnStr)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %s", e)
+	}
+}
+
+func TestContext2Validate_varRefFilled(t *testing.T) {
+	m := testModule(t, "validate-variable-ref")
+	p := testProvider("aws")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"foo": "bar",
+		},
+	})
+
+	var value interface{}
+	p.ValidateResourceFn = func(t string, c *ResourceConfig) ([]string, []error) {
+		value, _ = c.Get("foo")
+		return nil, nil
+	}
+
+	c.Validate()
+	if value != "bar" {
+		t.Fatalf("bad: %#v", value)
+	}
+}
diff --git a/terraform/diff.go b/terraform/diff.go
index 7cd907422..d77cd77d3 100644
--- a/terraform/diff.go
+++ b/terraform/diff.go
@@ -149,15 +149,11 @@ func (d *ModuleDiff) ChangeType() DiffChangeType {
 	for _, r := range d.Resources {
 		change := r.ChangeType()
 		switch change {
-		case DiffCreate:
-			fallthrough
-		case DiffDestroy:
+		case DiffCreate, DiffDestroy:
 			if result == DiffNone {
 				result = change
 			}
-		case DiffDestroyCreate:
-			fallthrough
-		case DiffUpdate:
+		case DiffDestroyCreate, DiffUpdate:
 			result = DiffUpdate
 		}
 	}
diff --git a/terraform/eval_context.go b/terraform/eval_context.go
index 8a838afb7..f4427939a 100644
--- a/terraform/eval_context.go
+++ b/terraform/eval_context.go
@@ -28,6 +28,9 @@ type EvalContext interface {
 	// initialized) or returns nil if the provider isn't initialized.
 	Provider(string) ResourceProvider
 
+	// CloseProvider closes provider connections that aren't needed anymore.
+	CloseProvider(string) error
+
 	// ConfigureProvider configures the provider with the given
 	// configuration. This is a separate context call because this call
 	// is used to store the provider configuration for inheritance lookups
@@ -51,6 +54,10 @@ type EvalContext interface {
 	// initialized) or returns nil if the provisioner isn't initialized.
 	Provisioner(string) ResourceProvisioner
 
+	// CloseProvisioner closes provisioner connections that aren't needed
+	// anymore.
+	CloseProvisioner(string) error
+
 	// Interpolate takes the given raw configuration and completes
 	// the interpolations, returning the processed ResourceConfig.
 	//
diff --git a/terraform/eval_context_builtin.go b/terraform/eval_context_builtin.go
index efc7d04fe..a25c1c6a1 100644
--- a/terraform/eval_context_builtin.go
+++ b/terraform/eval_context_builtin.go
@@ -114,6 +114,28 @@ func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
 	return ctx.ProviderCache[PathCacheKey(providerPath)]
 }
 
+func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
+	ctx.once.Do(ctx.init)
+
+	ctx.ProviderLock.Lock()
+	defer ctx.ProviderLock.Unlock()
+
+	providerPath := make([]string, len(ctx.Path())+1)
+	copy(providerPath, ctx.Path())
+	providerPath[len(providerPath)-1] = n
+
+	var provider interface{}
+	provider = ctx.ProviderCache[PathCacheKey(providerPath)]
+	if provider != nil {
+		if p, ok := provider.(ResourceProviderCloser); ok {
+			delete(ctx.ProviderCache, PathCacheKey(providerPath))
+			return p.Close()
+		}
+	}
+
+	return nil
+}
+
 func (ctx *BuiltinEvalContext) ConfigureProvider(
 	n string, cfg *ResourceConfig) error {
 	p := ctx.Provider(n)
@@ -146,14 +168,32 @@ func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
 	ctx.ProviderLock.Lock()
 	defer ctx.ProviderLock.Unlock()
 
-	return ctx.ProviderInputConfig[n]
+	// Make a copy of the path so we can safely edit it
+	path := ctx.Path()
+	pathCopy := make([]string, len(path)+1)
+	copy(pathCopy, path)
+
+	// Go up the tree.
+	for i := len(path) - 1; i >= 0; i-- {
+		pathCopy[i+1] = n
+		k := PathCacheKey(pathCopy[:i+2])
+		if v, ok := ctx.ProviderInputConfig[k]; ok {
+			return v
+		}
+	}
+
+	return nil
 }
 
 func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface{}) {
-	ctx.ProviderLock.Lock()
-	defer ctx.ProviderLock.Unlock()
+	providerPath := make([]string, len(ctx.Path())+1)
+	copy(providerPath, ctx.Path())
+	providerPath[len(providerPath)-1] = n
 
-	ctx.ProviderInputConfig[n] = c
+	// Save the configuration
+	ctx.ProviderLock.Lock()
+	ctx.ProviderInputConfig[PathCacheKey(providerPath)] = c
+	ctx.ProviderLock.Unlock()
 }
 
 func (ctx *BuiltinEvalContext) ParentProviderConfig(n string) *ResourceConfig {
@@ -222,6 +262,28 @@ func (ctx *BuiltinEvalContext) Provisioner(n string) ResourceProvisioner {
 	return ctx.ProvisionerCache[PathCacheKey(provPath)]
 }
 
+func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
+	ctx.once.Do(ctx.init)
+
+	ctx.ProvisionerLock.Lock()
+	defer ctx.ProvisionerLock.Unlock()
+
+	provPath := make([]string, len(ctx.Path())+1)
+	copy(provPath, ctx.Path())
+	provPath[len(provPath)-1] = n
+
+	var prov interface{}
+	prov = ctx.ProvisionerCache[PathCacheKey(provPath)]
+	if prov != nil {
+		if p, ok := prov.(ResourceProvisionerCloser); ok {
+			delete(ctx.ProvisionerCache, PathCacheKey(provPath))
+			return p.Close()
+		}
+	}
+
+	return nil
+}
+
 func (ctx *BuiltinEvalContext) Interpolate(
 	cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
 	if cfg != nil {
diff --git a/terraform/eval_context_builtin_test.go b/terraform/eval_context_builtin_test.go
new file mode 100644
index 000000000..4d07e75e0
--- /dev/null
+++ b/terraform/eval_context_builtin_test.go
@@ -0,0 +1,42 @@
+package terraform
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+)
+
+func TestBuiltinEvalContextProviderInput(t *testing.T) {
+	var lock sync.Mutex
+	cache := make(map[string]map[string]interface{})
+
+	ctx1 := testBuiltinEvalContext(t)
+	ctx1.PathValue = []string{"root"}
+	ctx1.ProviderInputConfig = cache
+	ctx1.ProviderLock = &lock
+
+	ctx2 := testBuiltinEvalContext(t)
+	ctx2.PathValue = []string{"root", "child"}
+	ctx2.ProviderInputConfig = cache
+	ctx2.ProviderLock = &lock
+
+	expected1 := map[string]interface{}{"value": "foo"}
+	ctx1.SetProviderInput("foo", expected1)
+
+	expected2 := map[string]interface{}{"value": "bar"}
+	ctx2.SetProviderInput("foo", expected2)
+
+	actual1 := ctx1.ProviderInput("foo")
+	actual2 := ctx2.ProviderInput("foo")
+
+	if !reflect.DeepEqual(actual1, expected1) {
+		t.Fatalf("bad: %#v %#v", actual1, expected1)
+	}
+	if !reflect.DeepEqual(actual2, expected2) {
+		t.Fatalf("bad: %#v %#v", actual2, expected2)
+	}
+}
+
+func testBuiltinEvalContext(t *testing.T) *BuiltinEvalContext {
+	return &BuiltinEvalContext{}
+}
diff --git a/terraform/eval_context_mock.go b/terraform/eval_context_mock.go
index 2a5856829..60d83c724 100644
--- a/terraform/eval_context_mock.go
+++ b/terraform/eval_context_mock.go
@@ -25,6 +25,10 @@ type MockEvalContext struct {
 	ProviderName     string
 	ProviderProvider ResourceProvider
 
+	CloseProviderCalled   bool
+	CloseProviderName     string
+	CloseProviderProvider ResourceProvider
+
 	ProviderInputCalled bool
 	ProviderInputName   string
 	ProviderInputConfig map[string]interface{}
@@ -55,6 +59,10 @@ type MockEvalContext struct {
 	ProvisionerName        string
 	ProvisionerProvisioner ResourceProvisioner
 
+	CloseProvisionerCalled      bool
+	CloseProvisionerName        string
+	CloseProvisionerProvisioner ResourceProvisioner
+
 	InterpolateCalled       bool
 	InterpolateConfig       *config.RawConfig
 	InterpolateResource     *Resource
@@ -105,6 +113,12 @@ func (c *MockEvalContext) Provider(n string) ResourceProvider {
 	return c.ProviderProvider
 }
 
+func (c *MockEvalContext) CloseProvider(n string) error {
+	c.CloseProviderCalled = true
+	c.CloseProviderName = n
+	return nil
+}
+
 func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error {
 	c.ConfigureProviderCalled = true
 	c.ConfigureProviderName = n
@@ -150,6 +164,12 @@ func (c *MockEvalContext) Provisioner(n string) ResourceProvisioner {
 	return c.ProvisionerProvisioner
 }
 
+func (c *MockEvalContext) CloseProvisioner(n string) error {
+	c.CloseProvisionerCalled = true
+	c.CloseProvisionerName = n
+	return nil
+}
+
 func (c *MockEvalContext) Interpolate(
 	config *config.RawConfig, resource *Resource) (*ResourceConfig, error) {
 	c.InterpolateCalled = true
diff --git a/terraform/eval_provider.go b/terraform/eval_provider.go
index e5205a556..61efcc235 100644
--- a/terraform/eval_provider.go
+++ b/terraform/eval_provider.go
@@ -71,6 +71,17 @@ func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
 	return ctx.InitProvider(n.Name)
 }
 
+// EvalCloseProvider is an EvalNode implementation that closes provider
+// connections that aren't needed anymore.
+type EvalCloseProvider struct {
+	Name string
+}
+
+func (n *EvalCloseProvider) Eval(ctx EvalContext) (interface{}, error) {
+	ctx.CloseProvider(n.Name)
+	return nil, nil
+}
+
 // EvalGetProvider is an EvalNode implementation that retrieves an already
 // initialized provider instance for the given name.
 type EvalGetProvider struct {
diff --git a/terraform/eval_provider_test.go b/terraform/eval_provider_test.go
index 5d50d746b..5719b62c5 100644
--- a/terraform/eval_provider_test.go
+++ b/terraform/eval_provider_test.go
@@ -112,6 +112,22 @@ func TestEvalInitProvider(t *testing.T) {
 	}
 }
 
+func TestEvalCloseProvider(t *testing.T) {
+	n := &EvalCloseProvider{Name: "foo"}
+	provider := &MockResourceProvider{}
+	ctx := &MockEvalContext{CloseProviderProvider: provider}
+	if _, err := n.Eval(ctx); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !ctx.CloseProviderCalled {
+		t.Fatal("should be called")
+	}
+	if ctx.CloseProviderName != "foo" {
+		t.Fatalf("bad: %#v", ctx.CloseProviderName)
+	}
+}
+
 func TestEvalGetProvider_impl(t *testing.T) {
 	var _ EvalNode = new(EvalGetProvider)
 }
diff --git a/terraform/eval_provisioner.go b/terraform/eval_provisioner.go
index 362a26e84..89579c055 100644
--- a/terraform/eval_provisioner.go
+++ b/terraform/eval_provisioner.go
@@ -15,6 +15,17 @@ func (n *EvalInitProvisioner) Eval(ctx EvalContext) (interface{}, error) {
 	return ctx.InitProvisioner(n.Name)
 }
 
+// EvalCloseProvisioner is an EvalNode implementation that closes provisioner
+// connections that aren't needed anymore.
+type EvalCloseProvisioner struct {
+	Name string
+}
+
+func (n *EvalCloseProvisioner) Eval(ctx EvalContext) (interface{}, error) {
+	ctx.CloseProvisioner(n.Name)
+	return nil, nil
+}
+
 // EvalGetProvisioner is an EvalNode implementation that retrieves an already
 // initialized provisioner instance for the given name.
 type EvalGetProvisioner struct {
diff --git a/terraform/eval_provisioner_test.go b/terraform/eval_provisioner_test.go
index 1225c5abb..390bc364d 100644
--- a/terraform/eval_provisioner_test.go
+++ b/terraform/eval_provisioner_test.go
@@ -24,6 +24,22 @@ func TestEvalInitProvisioner(t *testing.T) {
 	}
 }
 
+func TestEvalCloseProvisioner(t *testing.T) {
+	n := &EvalCloseProvisioner{Name: "foo"}
+	provisioner := &MockResourceProvisioner{}
+	ctx := &MockEvalContext{CloseProvisionerProvisioner: provisioner}
+	if _, err := n.Eval(ctx); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !ctx.CloseProvisionerCalled {
+		t.Fatal("should be called")
+	}
+	if ctx.CloseProvisionerName != "foo" {
+		t.Fatalf("bad: %#v", ctx.CloseProvisionerName)
+	}
+}
+
 func TestEvalGetProvisioner_impl(t *testing.T) {
 	var _ EvalNode = new(EvalGetProvisioner)
 }
diff --git a/terraform/evaltree_provider.go b/terraform/evaltree_provider.go
index 59916d9b5..1910bc091 100644
--- a/terraform/evaltree_provider.go
+++ b/terraform/evaltree_provider.go
@@ -62,6 +62,20 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
 					Provider: &provider,
 					Config:   &resourceConfig,
 				},
+				&EvalSetProviderConfig{
+					Provider: n,
+					Config:   &resourceConfig,
+				},
+			},
+		},
+	})
+
+	// We configure on everything but validate, since validate may
+	// not have access to all the variables.
+	seq = append(seq, &EvalOpFilter{
+		Ops: []walkOperation{walkRefresh, walkPlan, walkApply},
+		Node: &EvalSequence{
+			Nodes: []EvalNode{
 				&EvalConfigProvider{
 					Provider: n,
 					Config:   &resourceConfig,
@@ -72,3 +86,9 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
 
 	return &EvalSequence{Nodes: seq}
 }
+
+// CloseProviderEvalTree returns the evaluation tree for closing
+// provider connections that aren't needed anymore.
+func CloseProviderEvalTree(n string) EvalNode {
+	return &EvalCloseProvider{Name: n}
+}
diff --git a/terraform/graph_builder.go b/terraform/graph_builder.go
index 28a76e513..0ec3f8b20 100644
--- a/terraform/graph_builder.go
+++ b/terraform/graph_builder.go
@@ -116,13 +116,11 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 		// Provider-related transformations
 		&MissingProviderTransformer{Providers: b.Providers},
 		&ProviderTransformer{},
-		&PruneProviderTransformer{},
 		&DisableProviderTransformer{},
 
 		// Provisioner-related transformations
 		&MissingProvisionerTransformer{Provisioners: b.Provisioners},
 		&ProvisionerTransformer{},
-		&PruneProvisionerTransformer{},
 
 		// Run our vertex-level transforms
 		&VertexTransformer{
@@ -140,10 +138,6 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 		// Make sure all the connections that are proxies are connected through
 		&ProxyTransformer{},
 
-		// Optionally reduces the graph to a user-specified list of targets and
-		// their dependencies.
-		&TargetsTransformer{Targets: b.Targets, Destroy: b.Destroy},
-
 		// Make sure we have a single root
 		&RootTransformer{},
 	}
@@ -152,6 +146,16 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 	// We don't do the following for modules.
 	if len(path) <= 1 {
 		steps = append(steps,
+			// Optionally reduces the graph to a user-specified list of targets and
+			// their dependencies.
+			&TargetsTransformer{Targets: b.Targets, Destroy: b.Destroy},
+
+			// Prune the providers and provisioners. This must happen
+			// only once because flattened modules might depend on empty
+			// providers.
+			&PruneProviderTransformer{},
+			&PruneProvisionerTransformer{},
+
 			// Create the destruction nodes
 			&DestroyTransformer{FullDestroy: b.Destroy},
 			&CreateBeforeDestroyTransformer{},
@@ -160,6 +164,10 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 				Then: &PruneDestroyTransformer{Diff: b.Diff, State: b.State},
 			}),
 
+			// Insert nodes to close opened plugin connections
+			&CloseProviderTransformer{},
+			&CloseProvisionerTransformer{},
+
 			// Make sure we have a single root after the above changes.
 			// This is the 2nd root transformer. In practice this shouldn't
 			// actually matter as the RootTransformer is idempotent.
diff --git a/terraform/graph_builder_test.go b/terraform/graph_builder_test.go
index 1f7f25055..dbc8ae61e 100644
--- a/terraform/graph_builder_test.go
+++ b/terraform/graph_builder_test.go
@@ -154,6 +154,49 @@ func TestBuiltinGraphBuilder_multiLevelModule(t *testing.T) {
 	}
 }
 
+func TestBuiltinGraphBuilder_orphanDeps(t *testing.T) {
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "foo",
+						},
+					},
+
+					"aws_instance.bar": &ResourceState{
+						Type:         "aws_instance",
+						Dependencies: []string{"aws_instance.foo"},
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	b := &BuiltinGraphBuilder{
+		Root:     testModule(t, "graph-builder-orphan-deps"),
+		State:    state,
+		Validate: true,
+	}
+
+	g, err := b.Build(RootModulePath)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(testBuiltinGraphBuilderOrphanDepsStr)
+	if actual != expected {
+		t.Fatalf("bad: %s", actual)
+	}
+}
+
 /*
 TODO: This exposes a really bad bug we need to fix after we merge
 the f-ast-branch. This bug still exists in master.
@@ -196,6 +239,8 @@ aws_instance.db
 aws_instance.web
   aws_instance.db
 provider.aws
+provider.aws (close)
+  aws_instance.web
 `
 
 const testBuiltinGraphBuilderVerboseStr = `
@@ -213,8 +258,38 @@ aws_instance.web (destroy tainted)
 aws_instance.web (destroy)
   provider.aws
 provider.aws
+provider.aws (close)
+  aws_instance.web
 `
 
+const testBuiltinGraphBuilderMultiLevelStr = `
+module.foo.module.bar.output.value
+  module.foo.module.bar.var.bar
+module.foo.module.bar.plan-destroy
+module.foo.module.bar.var.bar
+  module.foo.var.foo
+module.foo.plan-destroy
+module.foo.var.foo
+root
+  module.foo.module.bar.output.value
+  module.foo.module.bar.plan-destroy
+  module.foo.plan-destroy
+`
+
+const testBuiltinGraphBuilderOrphanDepsStr = `
+aws_instance.bar (orphan)
+  provider.aws
+aws_instance.foo (orphan)
+  aws_instance.bar (orphan)
+provider.aws
+provider.aws (close)
+  aws_instance.foo (orphan)
+`
+
+/*
+TODO: Commented out this const as it's likely this needs to
+be updated when the TestBuiltinGraphBuilder_modules test is
+enabled again.
 const testBuiltinGraphBuilderModuleStr = `
 aws_instance.web
   aws_instance.web (destroy)
@@ -231,17 +306,4 @@ module.consul (expanded)
   provider.aws
 provider.aws
 `
-
-const testBuiltinGraphBuilderMultiLevelStr = `
-module.foo.module.bar.output.value
-  module.foo.module.bar.var.bar
-module.foo.module.bar.plan-destroy
-module.foo.module.bar.var.bar
-  module.foo.var.foo
-module.foo.plan-destroy
-module.foo.var.foo
-root
-  module.foo.module.bar.output.value
-  module.foo.module.bar.plan-destroy
-  module.foo.plan-destroy
-`
+*/
diff --git a/terraform/graph_config_node_resource.go b/terraform/graph_config_node_resource.go
index 30667cb43..2235f4925 100644
--- a/terraform/graph_config_node_resource.go
+++ b/terraform/graph_config_node_resource.go
@@ -148,9 +148,7 @@ func (n *GraphNodeConfigResource) DynamicExpand(ctx EvalContext) (*Graph, error)
 	// Primary and non-destroy modes are responsible for creating/destroying
 	// all the nodes, expanding counts.
 	switch n.DestroyMode {
-	case DestroyNone:
-		fallthrough
-	case DestroyPrimary:
+	case DestroyNone, DestroyPrimary:
 		steps = append(steps, &ResourceCountTransformer{
 			Resource: n.Resource,
 			Destroy:  n.DestroyMode != DestroyNone,
@@ -311,6 +309,7 @@ func (n *GraphNodeConfigResourceFlat) DestroyNode(mode GraphNodeDestroyMode) Gra
 	return &graphNodeResourceDestroyFlat{
 		graphNodeResourceDestroy: node,
 		PathValue:                n.PathValue,
+		FlatCreateNode:           n,
 	}
 }
 
@@ -318,6 +317,9 @@ type graphNodeResourceDestroyFlat struct {
 	*graphNodeResourceDestroy
 
 	PathValue []string
+
+	// Needs to be able to properly yield back a flattened create node to prevent
+	FlatCreateNode *GraphNodeConfigResourceFlat
 }
 
 func (n *graphNodeResourceDestroyFlat) Name() string {
@@ -329,6 +331,17 @@ func (n *graphNodeResourceDestroyFlat) Path() []string {
 	return n.PathValue
 }
 
+func (n *graphNodeResourceDestroyFlat) CreateNode() dag.Vertex {
+	return n.FlatCreateNode
+}
+
+func (n *graphNodeResourceDestroyFlat) ProvidedBy() []string {
+	prefix := modulePrefixStr(n.PathValue)
+	return modulePrefixList(
+		n.GraphNodeConfigResource.ProvidedBy(),
+		prefix)
+}
+
 // graphNodeResourceDestroy represents the logical destruction of a
 // resource. This node doesn't mean it will be destroyed for sure, but
 // instead that if a destroy were to happen, it must happen at this point.
diff --git a/terraform/graph_dot.go b/terraform/graph_dot.go
index b2c064e63..b9313fa24 100644
--- a/terraform/graph_dot.go
+++ b/terraform/graph_dot.go
@@ -178,7 +178,7 @@ func graphDotFindOrigins(g *Graph) ([]dag.Vertex, error) {
 	}
 
 	if len(origin) == 0 {
-		return nil, fmt.Errorf("No DOT origin nodes found.\nGraph: %s", g)
+		return nil, fmt.Errorf("No DOT origin nodes found.\nGraph: %s", g.String())
 	}
 
 	return origin, nil
diff --git a/terraform/graphnodeconfigtype_string.go b/terraform/graphnodeconfigtype_string.go
index de24c2dcd..d8c1724f4 100644
--- a/terraform/graphnodeconfigtype_string.go
+++ b/terraform/graphnodeconfigtype_string.go
@@ -9,7 +9,7 @@ const _GraphNodeConfigType_name = "GraphNodeConfigTypeInvalidGraphNodeConfigType
 var _GraphNodeConfigType_index = [...]uint8{0, 26, 53, 80, 105, 130, 157}
 
 func (i GraphNodeConfigType) String() string {
-	if i < 0 || i+1 >= GraphNodeConfigType(len(_GraphNodeConfigType_index)) {
+	if i < 0 || i >= GraphNodeConfigType(len(_GraphNodeConfigType_index)-1) {
 		return fmt.Sprintf("GraphNodeConfigType(%d)", i)
 	}
 	return _GraphNodeConfigType_name[_GraphNodeConfigType_index[i]:_GraphNodeConfigType_index[i+1]]
diff --git a/terraform/instancetype_string.go b/terraform/instancetype_string.go
index fc8697644..3114bc157 100644
--- a/terraform/instancetype_string.go
+++ b/terraform/instancetype_string.go
@@ -9,7 +9,7 @@ const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
 
 func (i InstanceType) String() string {
-	if i < 0 || i+1 >= InstanceType(len(_InstanceType_index)) {
+	if i < 0 || i >= InstanceType(len(_InstanceType_index)-1) {
 		return fmt.Sprintf("InstanceType(%d)", i)
 	}
 	return _InstanceType_name[_InstanceType_index[i]:_InstanceType_index[i+1]]
diff --git a/terraform/interpolate.go b/terraform/interpolate.go
index 96c2c7521..83f6265e1 100644
--- a/terraform/interpolate.go
+++ b/terraform/interpolate.go
@@ -49,11 +49,6 @@ func (i *Interpolater) Values(
 		}
 		for _, v := range mod.Config().Variables {
 			for k, val := range v.DefaultsMap() {
-				envKey := VarEnvPrefix + strings.TrimPrefix(k, "var.")
-				if v := os.Getenv(envKey); v != "" {
-					val = v
-				}
-
 				result[k] = ast.Variable{
 					Value: val,
 					Type:  ast.TypeString,
@@ -367,7 +362,7 @@ MISSING:
 	// Validation for missing interpolations should happen at a higher
 	// semantic level. If we reached this point and don't have variables,
 	// just return the computed value.
-	if scope == nil || scope.Resource == nil {
+	if scope == nil && scope.Resource == nil {
 		return config.UnknownVariableValue, nil
 	}
 
@@ -442,6 +437,14 @@ func (i *Interpolater) computeResourceMultiVariable(
 	}
 
 	if len(values) == 0 {
+		// If the operation is refresh, it isn't an error for a value to
+		// be unknown. Instead, we return that the value is computed so
+		// that the graph can continue to refresh other nodes. It doesn't
+		// matter because the config isn't interpolated anyways.
+		if i.Operation == walkRefresh {
+			return config.UnknownVariableValue, nil
+		}
+
 		return "", fmt.Errorf(
 			"Resource '%s' does not have attribute '%s' "+
 				"for variable '%s'",
@@ -450,7 +453,7 @@ func (i *Interpolater) computeResourceMultiVariable(
 			v.FullKey())
 	}
 
-	return strings.Join(values, config.InterpSplitDelim), nil
+	return config.NewStringList(values).String(), nil
 }
 
 func (i *Interpolater) resourceVariableInfo(
diff --git a/terraform/resource_provider.go b/terraform/resource_provider.go
index d8705232d..ea23b031d 100644
--- a/terraform/resource_provider.go
+++ b/terraform/resource_provider.go
@@ -71,6 +71,12 @@ type ResourceProvider interface {
 	Refresh(*InstanceInfo, *InstanceState) (*InstanceState, error)
 }
 
+// ResourceProviderCloser is an interface that providers that can close
+// connections that aren't needed anymore must implement.
+type ResourceProviderCloser interface {
+	Close() error
+}
+
 // ResourceType is a type of resource that a resource provider can manage.
 type ResourceType struct {
 	Name string
diff --git a/terraform/resource_provider_mock.go b/terraform/resource_provider_mock.go
index fa2bd24c6..3b2b351dc 100644
--- a/terraform/resource_provider_mock.go
+++ b/terraform/resource_provider_mock.go
@@ -10,6 +10,8 @@ type MockResourceProvider struct {
 	// Anything you want, in case you need to store extra data with the mock.
 	Meta interface{}
 
+	CloseCalled                  bool
+	CloseError                   error
 	InputCalled                  bool
 	InputInput                   UIInput
 	InputConfig                  *ResourceConfig
@@ -55,6 +57,11 @@ type MockResourceProvider struct {
 	ValidateResourceReturnErrors []error
 }
 
+func (p *MockResourceProvider) Close() error {
+	p.CloseCalled = true
+	return p.CloseError
+}
+
 func (p *MockResourceProvider) Input(
 	input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
 	p.InputCalled = true
diff --git a/terraform/resource_provider_mock_test.go b/terraform/resource_provider_mock_test.go
index 0beaf87d1..ebefadf29 100644
--- a/terraform/resource_provider_mock_test.go
+++ b/terraform/resource_provider_mock_test.go
@@ -6,4 +6,5 @@ import (
 
 func TestMockResourceProvider_impl(t *testing.T) {
 	var _ ResourceProvider = new(MockResourceProvider)
+	var _ ResourceProviderCloser = new(MockResourceProvider)
 }
diff --git a/terraform/resource_provisioner.go b/terraform/resource_provisioner.go
index acc80d054..3327e3000 100644
--- a/terraform/resource_provisioner.go
+++ b/terraform/resource_provisioner.go
@@ -23,6 +23,12 @@ type ResourceProvisioner interface {
 	Apply(UIOutput, *InstanceState, *ResourceConfig) error
 }
 
+// ResourceProvisionerCloser is an interface that provisioners that can close
+// connections that aren't needed anymore must implement.
+type ResourceProvisionerCloser interface {
+	Close() error
+}
+
 // ResourceProvisionerFactory is a function type that creates a new instance
 // of a resource provisioner.
 type ResourceProvisionerFactory func() (ResourceProvisioner, error)
diff --git a/terraform/terraform_test.go b/terraform/terraform_test.go
index e30d27a13..59dad38d4 100644
--- a/terraform/terraform_test.go
+++ b/terraform/terraform_test.go
@@ -56,7 +56,7 @@ func tempEnv(t *testing.T, k string, v string) string {
 }
 
 func testConfig(t *testing.T, name string) *config.Config {
-	c, err := config.Load(filepath.Join(fixtureDir, name, "main.tf"))
+	c, err := config.LoadFile(filepath.Join(fixtureDir, name, "main.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -379,6 +379,23 @@ do_instance.foo:
   type = do_instance
 `
 
+const testTerraformApplyModuleOnlyProviderStr = `
+<no state>
+module.child:
+  aws_instance.foo:
+    ID = foo
+  test_instance.foo:
+    ID = foo
+`
+
+const testTerraformApplyModuleProviderAliasStr = `
+<no state>
+module.child:
+  aws_instance.foo:
+    ID = foo
+    provider = aws.eu
+`
+
 const testTerraformApplyOutputOrphanStr = `
 <no state>
 Outputs:
diff --git a/terraform/test-fixtures/apply-blank/main.tf b/terraform/test-fixtures/apply-blank/main.tf
new file mode 100644
index 000000000..0081db186
--- /dev/null
+++ b/terraform/test-fixtures/apply-blank/main.tf
@@ -0,0 +1 @@
+// Nothing!
diff --git a/terraform/test-fixtures/apply-module-only-provider/child/main.tf b/terraform/test-fixtures/apply-module-only-provider/child/main.tf
new file mode 100644
index 000000000..e15099c17
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-only-provider/child/main.tf
@@ -0,0 +1,2 @@
+resource "aws_instance" "foo" {}
+resource "test_instance" "foo" {}
diff --git a/terraform/test-fixtures/apply-module-only-provider/main.tf b/terraform/test-fixtures/apply-module-only-provider/main.tf
new file mode 100644
index 000000000..2276b5f36
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-only-provider/main.tf
@@ -0,0 +1,5 @@
+provider "aws" {}
+
+module "child" {
+    source = "./child"
+}
diff --git a/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf b/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf
new file mode 100644
index 000000000..e334ff2c7
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf
@@ -0,0 +1,3 @@
+provider "aws" {
+    value = "foo"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-alias/child/main.tf b/terraform/test-fixtures/apply-module-provider-alias/child/main.tf
new file mode 100644
index 000000000..ee923f255
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-alias/child/main.tf
@@ -0,0 +1,7 @@
+provider "aws" {
+    alias = "eu"
+}
+
+resource "aws_instance" "foo" {
+    provider = "aws.eu"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-alias/main.tf b/terraform/test-fixtures/apply-module-provider-alias/main.tf
new file mode 100644
index 000000000..0f6991c53
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-alias/main.tf
@@ -0,0 +1,3 @@
+module "child" {
+    source = "./child"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-close-nested/child/main.tf b/terraform/test-fixtures/apply-module-provider-close-nested/child/main.tf
new file mode 100644
index 000000000..852bce8b9
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-close-nested/child/main.tf
@@ -0,0 +1,3 @@
+module "subchild" {
+    source = "./subchild"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-close-nested/child/subchild/main.tf b/terraform/test-fixtures/apply-module-provider-close-nested/child/subchild/main.tf
new file mode 100644
index 000000000..919f140bb
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-close-nested/child/subchild/main.tf
@@ -0,0 +1 @@
+resource "aws_instance" "foo" {}
diff --git a/terraform/test-fixtures/apply-module-provider-close-nested/main.tf b/terraform/test-fixtures/apply-module-provider-close-nested/main.tf
new file mode 100644
index 000000000..0f6991c53
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-close-nested/main.tf
@@ -0,0 +1,3 @@
+module "child" {
+    source = "./child"
+}
diff --git a/terraform/test-fixtures/apply-multi-var/main.tf b/terraform/test-fixtures/apply-multi-var/main.tf
new file mode 100644
index 000000000..22eb1988e
--- /dev/null
+++ b/terraform/test-fixtures/apply-multi-var/main.tf
@@ -0,0 +1,10 @@
+variable "count" {}
+
+resource "aws_instance" "bar" {
+    foo = "bar${count.index}"
+    count = "${var.count}"
+}
+
+output "output" {
+    value = "${join(",", aws_instance.bar.*.foo)}"
+}
diff --git a/terraform/test-fixtures/apply-provider-alias-missing/main.tf b/terraform/test-fixtures/apply-provider-alias-missing/main.tf
deleted file mode 100644
index ea50084fd..000000000
--- a/terraform/test-fixtures/apply-provider-alias-missing/main.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-provider "aws" {
-	alias = "bar"
-}
-
-resource "aws_instance" "bar" {
-    foo = "bar"
-    provider = "aws.bar"
-}
diff --git a/terraform/test-fixtures/apply-provider-computed/main.tf b/terraform/test-fixtures/apply-provider-computed/main.tf
new file mode 100644
index 000000000..4a39bb546
--- /dev/null
+++ b/terraform/test-fixtures/apply-provider-computed/main.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+    value = "${test_instance.foo.value}"
+}
+
+resource "aws_instance" "bar" {}
+
+resource "test_instance" "foo" {
+    value = "yes"
+}
diff --git a/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf b/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf
new file mode 100644
index 000000000..90a7c407b
--- /dev/null
+++ b/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf
@@ -0,0 +1,5 @@
+resource "aws_instance" "mod" { }
+
+output "output" {
+  value = "${aws_instance.mod.id}"
+}
diff --git a/terraform/test-fixtures/apply-targeted-module-dep/main.tf b/terraform/test-fixtures/apply-targeted-module-dep/main.tf
new file mode 100644
index 000000000..754219c3e
--- /dev/null
+++ b/terraform/test-fixtures/apply-targeted-module-dep/main.tf
@@ -0,0 +1,7 @@
+module "child" {
+    source = "./child"
+}
+
+resource "aws_instance" "foo" {
+    foo = "${module.child.output}"
+}
diff --git a/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf b/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf
new file mode 100644
index 000000000..6a2f85930
--- /dev/null
+++ b/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf
@@ -0,0 +1 @@
+variable "value" {}
diff --git a/terraform/test-fixtures/apply-unknown-interpolate/main.tf b/terraform/test-fixtures/apply-unknown-interpolate/main.tf
new file mode 100644
index 000000000..1ee7dd6cb
--- /dev/null
+++ b/terraform/test-fixtures/apply-unknown-interpolate/main.tf
@@ -0,0 +1,6 @@
+resource "aws_instance" "foo" {}
+
+module "child" {
+    source = "./child"
+    value = "${aws_instance.foo.nope}"
+}
diff --git a/terraform/test-fixtures/graph-builder-orphan-deps/main.tf b/terraform/test-fixtures/graph-builder-orphan-deps/main.tf
new file mode 100644
index 000000000..b21d3b6ab
--- /dev/null
+++ b/terraform/test-fixtures/graph-builder-orphan-deps/main.tf
@@ -0,0 +1 @@
+provider "aws" {}
diff --git a/terraform/test-fixtures/input-var-default/main.tf b/terraform/test-fixtures/input-var-default/main.tf
new file mode 100644
index 000000000..59dc34e58
--- /dev/null
+++ b/terraform/test-fixtures/input-var-default/main.tf
@@ -0,0 +1,7 @@
+variable "foo" {
+  default = 123
+}
+
+resource "aws_instance" "foo" {
+  foo = "${var.foo}"
+}
diff --git a/terraform/test-fixtures/plan-cbd-maintain-root/main.tf b/terraform/test-fixtures/plan-cbd-maintain-root/main.tf
new file mode 100644
index 000000000..9a826475c
--- /dev/null
+++ b/terraform/test-fixtures/plan-cbd-maintain-root/main.tf
@@ -0,0 +1,13 @@
+resource "aws_instance" "foo" {
+  count = "2"
+  lifecycle { create_before_destroy = true }
+}
+
+resource "aws_instance" "bar" {
+  count = "2"
+  lifecycle { create_before_destroy = true }
+}
+
+output "out" {
+  value = "${aws_instance.foo.0.id}"
+}
diff --git a/terraform/test-fixtures/plan-module-deadlock/child/main.tf b/terraform/test-fixtures/plan-module-deadlock/child/main.tf
new file mode 100644
index 000000000..ccee7bfb4
--- /dev/null
+++ b/terraform/test-fixtures/plan-module-deadlock/child/main.tf
@@ -0,0 +1,4 @@
+resource "aws_instance" "foo" {
+  count = "${length("abc")}"
+  lifecycle { create_before_destroy = true }
+}
diff --git a/terraform/test-fixtures/plan-module-deadlock/main.tf b/terraform/test-fixtures/plan-module-deadlock/main.tf
new file mode 100644
index 000000000..1f95749fa
--- /dev/null
+++ b/terraform/test-fixtures/plan-module-deadlock/main.tf
@@ -0,0 +1,3 @@
+module "child" {
+  source = "./child"
+}
diff --git a/terraform/test-fixtures/plan-var-multi-count-one/main.tf b/terraform/test-fixtures/plan-var-multi-count-one/main.tf
deleted file mode 100644
index 6fd84932f..000000000
--- a/terraform/test-fixtures/plan-var-multi-count-one/main.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-resource "aws_instance" "foo" {
-    num = "2"
-
-    count = 1
-}
-
-resource "aws_instance" "bar" {
-    foo = "${aws_instance.foo.*.num}"
-}
diff --git a/terraform/test-fixtures/refresh-module-computed-var/child/main.tf b/terraform/test-fixtures/refresh-module-computed-var/child/main.tf
new file mode 100644
index 000000000..38260d637
--- /dev/null
+++ b/terraform/test-fixtures/refresh-module-computed-var/child/main.tf
@@ -0,0 +1,5 @@
+variable "value" {}
+
+output "value" {
+    value = "${var.value}"
+}
diff --git a/terraform/test-fixtures/refresh-module-computed-var/main.tf b/terraform/test-fixtures/refresh-module-computed-var/main.tf
new file mode 100644
index 000000000..a8573327b
--- /dev/null
+++ b/terraform/test-fixtures/refresh-module-computed-var/main.tf
@@ -0,0 +1,8 @@
+module "child" {
+    source = "./child"
+    value = "${join(" ", aws_instance.test.*.id)}"
+}
+
+resource "aws_instance" "test" {
+    value = "yes"
+}
diff --git a/terraform/test-fixtures/transform-provider-missing/main.tf b/terraform/test-fixtures/transform-provider-missing/main.tf
new file mode 100644
index 000000000..976f3e5af
--- /dev/null
+++ b/terraform/test-fixtures/transform-provider-missing/main.tf
@@ -0,0 +1,3 @@
+provider "aws" {}
+resource "aws_instance" "web" {}
+resource "foo_instance" "web" {}
diff --git a/terraform/test-fixtures/validate-computed-var/main.tf b/terraform/test-fixtures/validate-computed-var/main.tf
new file mode 100644
index 000000000..4a39bb546
--- /dev/null
+++ b/terraform/test-fixtures/validate-computed-var/main.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+    value = "${test_instance.foo.value}"
+}
+
+resource "aws_instance" "bar" {}
+
+resource "test_instance" "foo" {
+    value = "yes"
+}
diff --git a/terraform/test-fixtures/validate-module-pc-inherit-orphan/main.tf b/terraform/test-fixtures/validate-module-pc-inherit-orphan/main.tf
new file mode 100644
index 000000000..a5c34f64d
--- /dev/null
+++ b/terraform/test-fixtures/validate-module-pc-inherit-orphan/main.tf
@@ -0,0 +1,9 @@
+variable "foo" {
+    default = "bar"
+}
+
+provider "aws" {
+    set = "${var.foo}"
+}
+
+resource "aws_instance" "foo" {}
diff --git a/terraform/transform_destroy.go b/terraform/transform_destroy.go
index 3fe585664..8d5aeb4c9 100644
--- a/terraform/transform_destroy.go
+++ b/terraform/transform_destroy.go
@@ -105,6 +105,12 @@ func (t *DestroyTransformer) transform(
 		nodeToCn[n] = cn
 		nodeToDn[cn] = n
 
+		// If the creation node is equal to the destroy node, then
+		// don't do any of the edge jump rope below.
+		if n.(interface{}) == cn.(interface{}) {
+			continue
+		}
+
 		// Add it to the graph
 		g.Add(n)
 
@@ -193,6 +199,14 @@ func (t *CreateBeforeDestroyTransformer) Transform(g *Graph) error {
 		// This ensures that.
 		for _, sourceRaw := range g.UpEdges(cn).List() {
 			source := sourceRaw.(dag.Vertex)
+
+			// If the graph has a "root" node (one added by a RootTransformer and not
+			// just a resource that happens to have no ancestors), we don't want to
+			// add any edges to it, because then it ceases to be a root.
+			if _, ok := source.(graphNodeRoot); ok {
+				continue
+			}
+
 			connect = append(connect, dag.BasicEdge(dn, source))
 		}
 
diff --git a/terraform/transform_expand.go b/terraform/transform_expand.go
index 85d660206..3251ea36e 100644
--- a/terraform/transform_expand.go
+++ b/terraform/transform_expand.go
@@ -59,3 +59,7 @@ func (n *GraphNodeBasicSubgraph) Name() string {
 func (n *GraphNodeBasicSubgraph) Subgraph() *Graph {
 	return n.Graph
 }
+
+func (n *GraphNodeBasicSubgraph) FlattenGraph() *Graph {
+	return n.Graph
+}
diff --git a/terraform/transform_orphan.go b/terraform/transform_orphan.go
index 448aae794..8e609f609 100644
--- a/terraform/transform_orphan.go
+++ b/terraform/transform_orphan.go
@@ -256,6 +256,7 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 	})
 
 	// Apply
+	var err error
 	seq.Nodes = append(seq.Nodes, &EvalOpFilter{
 		Ops: []walkOperation{walkApply},
 		Node: &EvalSequence{
@@ -278,6 +279,7 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 					Diff:     &diff,
 					Provider: &provider,
 					Output:   &state,
+					Error:    &err,
 				},
 				&EvalWriteState{
 					Name:         n.ResourceName,
@@ -286,6 +288,11 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 					Dependencies: n.DependentOn(),
 					State:        &state,
 				},
+				&EvalApplyPost{
+					Info:  info,
+					State: &state,
+					Error: &err,
+				},
 				&EvalUpdateStateHook{},
 			},
 		},
@@ -298,6 +305,24 @@ func (n *graphNodeOrphanResource) dependableName() string {
 	return n.ResourceName
 }
 
+// GraphNodeDestroyable impl.
+func (n *graphNodeOrphanResource) DestroyNode(mode GraphNodeDestroyMode) GraphNodeDestroy {
+	if mode != DestroyPrimary {
+		return nil
+	}
+
+	return n
+}
+
+// GraphNodeDestroy impl.
+func (n *graphNodeOrphanResource) CreateBeforeDestroy() bool {
+	return false
+}
+
+func (n *graphNodeOrphanResource) CreateNode() dag.Vertex {
+	return n
+}
+
 // Same as graphNodeOrphanResource, but for flattening
 type graphNodeOrphanResourceFlat struct {
 	*graphNodeOrphanResource
@@ -313,3 +338,21 @@ func (n *graphNodeOrphanResourceFlat) Name() string {
 func (n *graphNodeOrphanResourceFlat) Path() []string {
 	return n.PathValue
 }
+
+// GraphNodeDestroyable impl.
+func (n *graphNodeOrphanResourceFlat) DestroyNode(mode GraphNodeDestroyMode) GraphNodeDestroy {
+	if mode != DestroyPrimary {
+		return nil
+	}
+
+	return n
+}
+
+// GraphNodeDestroy impl.
+func (n *graphNodeOrphanResourceFlat) CreateBeforeDestroy() bool {
+	return false
+}
+
+func (n *graphNodeOrphanResourceFlat) CreateNode() dag.Vertex {
+	return n
+}
diff --git a/terraform/transform_output.go b/terraform/transform_output.go
index 7741f9d3d..5ea48a016 100644
--- a/terraform/transform_output.go
+++ b/terraform/transform_output.go
@@ -2,6 +2,8 @@ package terraform
 
 import (
 	"fmt"
+
+	"github.com/hashicorp/terraform/dag"
 )
 
 // GraphNodeOutput is an interface that nodes that are outputs must
@@ -66,3 +68,31 @@ func (n *graphNodeOrphanOutput) EvalTree() EvalNode {
 		},
 	}
 }
+
+// GraphNodeFlattenable impl.
+func (n *graphNodeOrphanOutput) Flatten(p []string) (dag.Vertex, error) {
+	return &graphNodeOrphanOutputFlat{
+		graphNodeOrphanOutput: n,
+		PathValue:             p,
+	}, nil
+}
+
+type graphNodeOrphanOutputFlat struct {
+	*graphNodeOrphanOutput
+
+	PathValue []string
+}
+
+func (n *graphNodeOrphanOutputFlat) Name() string {
+	return fmt.Sprintf(
+		"%s.%s", modulePrefixStr(n.PathValue), n.graphNodeOrphanOutput.Name())
+}
+
+func (n *graphNodeOrphanOutputFlat) EvalTree() EvalNode {
+	return &EvalOpFilter{
+		Ops: []walkOperation{walkApply, walkRefresh},
+		Node: &EvalDeleteOutput{
+			Name: n.OutputName,
+		},
+	}
+}
diff --git a/terraform/transform_provider.go b/terraform/transform_provider.go
index b9ac53ccb..8a6655182 100644
--- a/terraform/transform_provider.go
+++ b/terraform/transform_provider.go
@@ -2,6 +2,7 @@ package terraform
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform/config"
@@ -17,6 +18,13 @@ type GraphNodeProvider interface {
 	ProviderConfig() *config.RawConfig
 }
 
+// GraphNodeCloseProvider is an interface that nodes that can be a close
+// provider must implement. The CloseProviderName returned is the name of
+// the provider they satisfy.
+type GraphNodeCloseProvider interface {
+	CloseProviderName() string
+}
+
 // GraphNodeProviderConsumer is an interface that nodes that require
 // a provider must implement. ProvidedBy must return the name of the provider
 // to use.
@@ -98,6 +106,50 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
 	return err
 }
 
+// CloseProviderTransformer is a GraphTransformer that adds nodes to the
+// graph that will close open provider connections that aren't needed anymore.
+// A provider connection is not needed anymore once all depended resources
+// in the graph are evaluated.
+type CloseProviderTransformer struct{}
+
+func (t *CloseProviderTransformer) Transform(g *Graph) error {
+	pm := providerVertexMap(g)
+	cpm := closeProviderVertexMap(g)
+	var err error
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProviderConsumer); ok {
+			for _, p := range pv.ProvidedBy() {
+				source := cpm[p]
+
+				if source == nil {
+					// Create a new graphNodeCloseProvider and add it to the graph
+					source = &graphNodeCloseProvider{ProviderNameValue: p}
+					g.Add(source)
+
+					// Close node needs to depend on provider
+					provider, ok := pm[p]
+					if !ok {
+						err = multierror.Append(err, fmt.Errorf(
+							"%s: provider %s couldn't be found for closing",
+							dag.VertexName(v), p))
+						continue
+					}
+					g.Connect(dag.BasicEdge(source, provider))
+
+					// Make sure we also add the new graphNodeCloseProvider to the map
+					// so we don't create and add any duplicate graphNodeCloseProviders.
+					cpm[p] = source
+				}
+
+				// Close node depends on all nodes provided by the provider
+				g.Connect(dag.BasicEdge(source, v))
+			}
+		}
+	}
+
+	return err
+}
+
 // MissingProviderTransformer is a GraphTransformer that adds nodes
 // for missing providers into the graph. Specifically, it creates provider
 // configuration nodes for all the providers that we support. These are
@@ -108,15 +160,44 @@ type MissingProviderTransformer struct {
 }
 
 func (t *MissingProviderTransformer) Transform(g *Graph) error {
+	// Create a set of our supported providers
+	supported := make(map[string]struct{}, len(t.Providers))
+	for _, v := range t.Providers {
+		supported[v] = struct{}{}
+	}
+
+	// Get the map of providers we already have in our graph
 	m := providerVertexMap(g)
-	for _, p := range t.Providers {
-		if _, ok := m[p]; ok {
-			// This provider already exists as a configured node
+
+	// Go through all the provider consumers and make sure we add
+	// that provider if it is missing.
+	for _, v := range g.Vertices() {
+		pv, ok := v.(GraphNodeProviderConsumer)
+		if !ok {
 			continue
 		}
 
-		// Add our own missing provider node to the graph
-		g.Add(&graphNodeMissingProvider{ProviderNameValue: p})
+		for _, p := range pv.ProvidedBy() {
+			if _, ok := m[p]; ok {
+				// This provider already exists as a configure node
+				continue
+			}
+
+			// If the provider has an alias in it, we just want the type
+			ptype := p
+			if idx := strings.IndexRune(p, '.'); idx != -1 {
+				ptype = p[:idx]
+			}
+
+			if _, ok := supported[ptype]; !ok {
+				// If we don't support the provider type, skip it.
+				// Validation later will catch this as an error.
+				continue
+			}
+
+			// Add our own missing provider node to the graph
+			m[p] = g.Add(&graphNodeMissingProvider{ProviderNameValue: p})
+		}
 	}
 
 	return nil
@@ -143,6 +224,28 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
 	return nil
 }
 
+func providerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvider); ok {
+			m[pv.ProviderName()] = v
+		}
+	}
+
+	return m
+}
+
+func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeCloseProvider); ok {
+			m[pv.CloseProviderName()] = v
+		}
+	}
+
+	return m
+}
+
 type graphNodeDisabledProvider struct {
 	GraphNodeProvider
 }
@@ -173,6 +276,14 @@ func (n *graphNodeDisabledProvider) EvalTree() EvalNode {
 	}
 }
 
+// GraphNodeFlattenable impl.
+func (n *graphNodeDisabledProvider) Flatten(p []string) (dag.Vertex, error) {
+	return &graphNodeDisabledProviderFlat{
+		graphNodeDisabledProvider: n,
+		PathValue:                 p,
+	}, nil
+}
+
 func (n *graphNodeDisabledProvider) Name() string {
 	return fmt.Sprintf("%s (disabled)", dag.VertexName(n.GraphNodeProvider))
 }
@@ -205,6 +316,84 @@ func (n *graphNodeDisabledProvider) ProviderConfig() *config.RawConfig {
 	return n.GraphNodeProvider.ProviderConfig()
 }
 
+// Same as graphNodeDisabledProvider, but for flattening
+type graphNodeDisabledProviderFlat struct {
+	*graphNodeDisabledProvider
+
+	PathValue []string
+}
+
+func (n *graphNodeDisabledProviderFlat) Name() string {
+	return fmt.Sprintf(
+		"%s.%s", modulePrefixStr(n.PathValue), n.graphNodeDisabledProvider.Name())
+}
+
+func (n *graphNodeDisabledProviderFlat) Path() []string {
+	return n.PathValue
+}
+
+func (n *graphNodeDisabledProviderFlat) ProviderName() string {
+	return fmt.Sprintf(
+		"%s.%s", modulePrefixStr(n.PathValue),
+		n.graphNodeDisabledProvider.ProviderName())
+}
+
+// GraphNodeDependable impl.
+func (n *graphNodeDisabledProviderFlat) DependableName() []string {
+	return []string{n.Name()}
+}
+
+func (n *graphNodeDisabledProviderFlat) DependentOn() []string {
+	var result []string
+
+	// If we're in a module, then depend on our parent's provider
+	if len(n.PathValue) > 1 {
+		prefix := modulePrefixStr(n.PathValue[:len(n.PathValue)-1])
+		if prefix != "" {
+			prefix += "."
+		}
+
+		result = append(result, fmt.Sprintf(
+			"%s%s",
+			prefix, n.graphNodeDisabledProvider.Name()))
+	}
+
+	return result
+}
+
+type graphNodeCloseProvider struct {
+	ProviderNameValue string
+}
+
+func (n *graphNodeCloseProvider) Name() string {
+	return fmt.Sprintf("provider.%s (close)", n.ProviderNameValue)
+}
+
+// GraphNodeEvalable impl.
+func (n *graphNodeCloseProvider) EvalTree() EvalNode {
+	return CloseProviderEvalTree(n.ProviderNameValue)
+}
+
+// GraphNodeDependable impl.
+func (n *graphNodeCloseProvider) DependableName() []string {
+	return []string{n.Name()}
+}
+
+func (n *graphNodeCloseProvider) CloseProviderName() string {
+	return n.ProviderNameValue
+}
+
+// GraphNodeDotter impl.
+func (n *graphNodeCloseProvider) DotNode(name string, opts *GraphDotOpts) *dot.Node {
+	if !opts.Verbose {
+		return nil
+	}
+	return dot.NewNode(name, map[string]string{
+		"label": n.Name(),
+		"shape": "diamond",
+	})
+}
+
 type graphNodeMissingProvider struct {
 	ProviderNameValue string
 }
@@ -252,17 +441,6 @@ func (n *graphNodeMissingProvider) Flatten(p []string) (dag.Vertex, error) {
 	}, nil
 }
 
-func providerVertexMap(g *Graph) map[string]dag.Vertex {
-	m := make(map[string]dag.Vertex)
-	for _, v := range g.Vertices() {
-		if pv, ok := v.(GraphNodeProvider); ok {
-			m[pv.ProviderName()] = v
-		}
-	}
-
-	return m
-}
-
 // Same as graphNodeMissingProvider, but for flattening
 type graphNodeMissingProviderFlat struct {
 	*graphNodeMissingProvider
diff --git a/terraform/transform_provider_test.go b/terraform/transform_provider_test.go
index fdf764c3f..9c6ff67e7 100644
--- a/terraform/transform_provider_test.go
+++ b/terraform/transform_provider_test.go
@@ -30,7 +30,7 @@ func TestProviderTransformer(t *testing.T) {
 	}
 }
 
-func TestMissingProviderTransformer(t *testing.T) {
+func TestCloseProviderTransformer(t *testing.T) {
 	mod := testModule(t, "transform-provider-basic")
 
 	g := Graph{Path: RootModulePath}
@@ -41,9 +41,80 @@ func TestMissingProviderTransformer(t *testing.T) {
 		}
 	}
 
-	transform := &MissingProviderTransformer{Providers: []string{"foo"}}
-	if err := transform.Transform(&g); err != nil {
-		t.Fatalf("err: %s", err)
+	{
+		transform := &ProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(testTransformCloseProviderBasicStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s", actual)
+	}
+}
+
+func TestCloseProviderTransformer_withTargets(t *testing.T) {
+	mod := testModule(t, "transform-provider-basic")
+
+	g := Graph{Path: RootModulePath}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&ProviderTransformer{},
+		&CloseProviderTransformer{},
+		&TargetsTransformer{
+			Targets: []string{"something.else"},
+		},
+	}
+
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(`
+provider.aws
+provider.aws (close)
+  provider.aws
+	`)
+	if actual != expected {
+		t.Fatalf("expected:%s\n\ngot:\n\n%s", expected, actual)
+	}
+}
+
+func TestMissingProviderTransformer(t *testing.T) {
+	mod := testModule(t, "transform-provider-missing")
+
+	g := Graph{Path: RootModulePath}
+	{
+		tf := &ConfigTransformer{Module: mod}
+		if err := tf.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &MissingProviderTransformer{Providers: []string{"foo", "bar"}}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
 	}
 
 	actual := strings.TrimSpace(g.String())
@@ -78,6 +149,13 @@ func TestPruneProviderTransformer(t *testing.T) {
 		}
 	}
 
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
 	{
 		transform := &PruneProviderTransformer{}
 		if err := transform.Transform(&g); err != nil {
@@ -96,37 +174,17 @@ func TestDisableProviderTransformer(t *testing.T) {
 	mod := testModule(t, "transform-provider-disable")
 
 	g := Graph{Path: RootModulePath}
-	{
-		tf := &ConfigTransformer{Module: mod}
-		if err := tf.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&MissingProviderTransformer{Providers: []string{"aws"}},
+		&ProviderTransformer{},
+		&DisableProviderTransformer{},
+		&CloseProviderTransformer{},
+		&PruneProviderTransformer{},
 	}
 
-	{
-		transform := &MissingProviderTransformer{Providers: []string{"aws"}}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &ProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &PruneProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &DisableProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
 			t.Fatalf("err: %s", err)
 		}
 	}
@@ -134,7 +192,7 @@ func TestDisableProviderTransformer(t *testing.T) {
 	actual := strings.TrimSpace(g.String())
 	expected := strings.TrimSpace(testTransformDisableProviderBasicStr)
 	if actual != expected {
-		t.Fatalf("bad:\n\n%s", actual)
+		t.Fatalf("expected:\n%s\n\ngot:\n%s\n", expected, actual)
 	}
 }
 
@@ -142,37 +200,17 @@ func TestDisableProviderTransformer_keep(t *testing.T) {
 	mod := testModule(t, "transform-provider-disable-keep")
 
 	g := Graph{Path: RootModulePath}
-	{
-		tf := &ConfigTransformer{Module: mod}
-		if err := tf.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&MissingProviderTransformer{Providers: []string{"aws"}},
+		&ProviderTransformer{},
+		&DisableProviderTransformer{},
+		&CloseProviderTransformer{},
+		&PruneProviderTransformer{},
 	}
 
-	{
-		transform := &MissingProviderTransformer{Providers: []string{"aws"}}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &ProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &PruneProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &DisableProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
 			t.Fatalf("err: %s", err)
 		}
 	}
@@ -180,7 +218,7 @@ func TestDisableProviderTransformer_keep(t *testing.T) {
 	actual := strings.TrimSpace(g.String())
 	expected := strings.TrimSpace(testTransformDisableProviderKeepStr)
 	if actual != expected {
-		t.Fatalf("bad:\n\n%s", actual)
+		t.Fatalf("expected:\n%s\n\ngot:\n%s\n", expected, actual)
 	}
 }
 
@@ -203,22 +241,44 @@ aws_instance.web
 provider.aws
 `
 
+const testTransformCloseProviderBasicStr = `
+aws_instance.web
+  provider.aws
+provider.aws
+provider.aws (close)
+  aws_instance.web
+  provider.aws
+`
+
 const testTransformMissingProviderBasicStr = `
 aws_instance.web
+foo_instance.web
 provider.aws
+provider.aws (close)
+  aws_instance.web
+  provider.aws
 provider.foo
+provider.foo (close)
+  foo_instance.web
+  provider.foo
 `
 
 const testTransformPruneProviderBasicStr = `
 foo_instance.web
   provider.foo
 provider.foo
+provider.foo (close)
+  foo_instance.web
+  provider.foo
 `
 
 const testTransformDisableProviderBasicStr = `
 module.child
   provider.aws (disabled)
   var.foo
+provider.aws (close)
+  module.child
+  provider.aws (disabled)
 provider.aws (disabled)
 var.foo
 `
@@ -230,5 +290,9 @@ module.child
   provider.aws
   var.foo
 provider.aws
+provider.aws (close)
+  aws_instance.foo
+  module.child
+  provider.aws
 var.foo
 `
diff --git a/terraform/transform_provisioner.go b/terraform/transform_provisioner.go
index bf661f88a..a99fe48b0 100644
--- a/terraform/transform_provisioner.go
+++ b/terraform/transform_provisioner.go
@@ -14,6 +14,13 @@ type GraphNodeProvisioner interface {
 	ProvisionerName() string
 }
 
+// GraphNodeCloseProvisioner is an interface that nodes that can be a close
+// provisioner must implement. The CloseProvisionerName returned is the name
+// of the provisioner they satisfy.
+type GraphNodeCloseProvisioner interface {
+	CloseProvisionerName() string
+}
+
 // GraphNodeProvisionerConsumer is an interface that nodes that require
 // a provisioner must implement. ProvisionedBy must return the name of the
 // provisioner to use.
@@ -49,6 +56,37 @@ func (t *ProvisionerTransformer) Transform(g *Graph) error {
 	return err
 }
 
+// CloseProvisionerTransformer is a GraphTransformer that adds nodes to the
+// graph that will close open provisioner connections that aren't needed
+// anymore. A provisioner connection is not needed anymore once all depended
+// resources in the graph are evaluated.
+type CloseProvisionerTransformer struct{}
+
+func (t *CloseProvisionerTransformer) Transform(g *Graph) error {
+	m := closeProvisionerVertexMap(g)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvisionerConsumer); ok {
+			for _, p := range pv.ProvisionedBy() {
+				source := m[p]
+
+				if source == nil {
+					// Create a new graphNodeCloseProvisioner and add it to the graph
+					source = &graphNodeCloseProvisioner{ProvisionerNameValue: p}
+					g.Add(source)
+
+					// Make sure we also add the new graphNodeCloseProvisioner to the map
+					// so we don't create and add any duplicate graphNodeCloseProvisioners.
+					m[p] = source
+				}
+
+				g.Connect(dag.BasicEdge(source, v))
+			}
+		}
+	}
+
+	return nil
+}
+
 // MissingProvisionerTransformer is a GraphTransformer that adds nodes
 // for missing provisioners into the graph. Specifically, it creates provisioner
 // configuration nodes for all the provisioners that we support. These are
@@ -94,6 +132,45 @@ func (t *PruneProvisionerTransformer) Transform(g *Graph) error {
 	return nil
 }
 
+func provisionerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvisioner); ok {
+			m[pv.ProvisionerName()] = v
+		}
+	}
+
+	return m
+}
+
+func closeProvisionerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeCloseProvisioner); ok {
+			m[pv.CloseProvisionerName()] = v
+		}
+	}
+
+	return m
+}
+
+type graphNodeCloseProvisioner struct {
+	ProvisionerNameValue string
+}
+
+func (n *graphNodeCloseProvisioner) Name() string {
+	return fmt.Sprintf("provisioner.%s (close)", n.ProvisionerNameValue)
+}
+
+// GraphNodeEvalable impl.
+func (n *graphNodeCloseProvisioner) EvalTree() EvalNode {
+	return &EvalCloseProvisioner{Name: n.ProvisionerNameValue}
+}
+
+func (n *graphNodeCloseProvisioner) CloseProvisionerName() string {
+	return n.ProvisionerNameValue
+}
+
 type graphNodeMissingProvisioner struct {
 	ProvisionerNameValue string
 }
@@ -119,17 +196,6 @@ func (n *graphNodeMissingProvisioner) Flatten(p []string) (dag.Vertex, error) {
 	}, nil
 }
 
-func provisionerVertexMap(g *Graph) map[string]dag.Vertex {
-	m := make(map[string]dag.Vertex)
-	for _, v := range g.Vertices() {
-		if pv, ok := v.(GraphNodeProvisioner); ok {
-			m[pv.ProvisionerName()] = v
-		}
-	}
-
-	return m
-}
-
 // Same as graphNodeMissingProvisioner, but for flattening
 type graphNodeMissingProvisionerFlat struct {
 	*graphNodeMissingProvisioner
diff --git a/terraform/transform_provisioner_test.go b/terraform/transform_provisioner_test.go
index f38a0a045..ea5faff77 100644
--- a/terraform/transform_provisioner_test.go
+++ b/terraform/transform_provisioner_test.go
@@ -18,9 +18,18 @@ func TestMissingProvisionerTransformer(t *testing.T) {
 		}
 	}
 
-	transform := &MissingProvisionerTransformer{Provisioners: []string{"foo"}}
-	if err := transform.Transform(&g); err != nil {
-		t.Fatalf("err: %s", err)
+	{
+		transform := &MissingProvisionerTransformer{Provisioners: []string{"foo"}}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProvisionerTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
 	}
 
 	actual := strings.TrimSpace(g.String())
@@ -56,6 +65,13 @@ func TestPruneProvisionerTransformer(t *testing.T) {
 		}
 	}
 
+	{
+		transform := &CloseProvisionerTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
 	{
 		transform := &PruneProvisionerTransformer{}
 		if err := transform.Transform(&g); err != nil {
@@ -86,10 +102,14 @@ func TestGraphNodeMissingProvisioner_ProvisionerName(t *testing.T) {
 const testTransformMissingProvisionerBasicStr = `
 aws_instance.web
 provisioner.foo
+provisioner.shell (close)
+  aws_instance.web
 `
 
 const testTransformPruneProvisionerBasicStr = `
 aws_instance.web
   provisioner.foo
 provisioner.foo
+provisioner.foo (close)
+  aws_instance.web
 `
diff --git a/terraform/transform_targets.go b/terraform/transform_targets.go
index 84e3aed60..cab8c8b1e 100644
--- a/terraform/transform_targets.go
+++ b/terraform/transform_targets.go
@@ -34,7 +34,7 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
 		for _, v := range g.Vertices() {
 			if _, ok := v.(GraphNodeAddressable); ok {
 				if !targetedNodes.Include(v) {
-					log.Printf("[DEBUG] Removing %s, filtered by targeting.", v)
+					log.Printf("[DEBUG] Removing %q, filtered by targeting.", dag.VertexName(v))
 					g.Remove(v)
 				}
 			}
diff --git a/terraform/version.go b/terraform/version.go
new file mode 100644
index 000000000..9cbc9adb1
--- /dev/null
+++ b/terraform/version.go
@@ -0,0 +1,9 @@
+package terraform
+
+// The main version number that is being run at the moment.
+const Version = "0.6.1"
+
+// A pre-release marker for the version. If this is "" (empty string)
+// then it means that it is a final release. Otherwise, this is a pre-release
+// such as "dev" (in development), "beta", "rc1", etc.
+const VersionPrerelease = "dev"
diff --git a/terraform/walkoperation_string.go b/terraform/walkoperation_string.go
index ddd894f53..423793c3c 100644
--- a/terraform/walkoperation_string.go
+++ b/terraform/walkoperation_string.go
@@ -9,7 +9,7 @@ const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestro
 var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75}
 
 func (i walkOperation) String() string {
-	if i+1 >= walkOperation(len(_walkOperation_index)) {
+	if i >= walkOperation(len(_walkOperation_index)-1) {
 		return fmt.Sprintf("walkOperation(%d)", i)
 	}
 	return _walkOperation_name[_walkOperation_index[i]:_walkOperation_index[i+1]]
diff --git a/version.go b/version.go
index 8e4524d64..31b54445d 100644
--- a/version.go
+++ b/version.go
@@ -1,12 +1,9 @@
 package main
 
+import "github.com/hashicorp/terraform/terraform"
+
 // The git commit that was compiled. This will be filled in by the compiler.
 var GitCommit string
 
-// The main version number that is being run at the moment.
-const Version = "0.5.1"
-
-// A pre-release marker for the version. If this is "" (empty string)
-// then it means that it is a final release. Otherwise, this is a pre-release
-// such as "dev" (in development), "beta", "rc1", etc.
-const VersionPrerelease = "dev"
+const Version = terraform.Version
+const VersionPrerelease = terraform.VersionPrerelease
diff --git a/website/Gemfile b/website/Gemfile
index 850fc4b6c..7384248bf 100644
--- a/website/Gemfile
+++ b/website/Gemfile
@@ -1,3 +1,3 @@
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
-gem 'middleman-hashicorp', git: 'https://github.com/hashicorp/middleman-hashicorp'
+gem "middleman-hashicorp", git: "https://github.com/hashicorp/middleman-hashicorp"
diff --git a/website/Gemfile.lock b/website/Gemfile.lock
index e86360532..8e4867a68 100644
--- a/website/Gemfile.lock
+++ b/website/Gemfile.lock
@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/hashicorp/middleman-hashicorp
-  revision: fb03b8e60efc96f68c2dded0f49632fcd6eb6482
+  revision: 76f0f284ad44cea0457484ea83467192f02daf87
   specs:
     middleman-hashicorp (0.1.0)
       bootstrap-sass (~> 3.3)
@@ -11,6 +11,7 @@ GIT
       middleman-minify-html (~> 3.4)
       middleman-syntax (~> 2.0)
       rack-contrib (~> 1.2)
+      rack-protection (~> 1.5)
       rack-rewrite (~> 1.5)
       rack-ssl-enforcer (~> 0.2)
       redcarpet (~> 3.2)
@@ -20,26 +21,26 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (4.1.10)
+    activesupport (4.1.12)
       i18n (~> 0.6, >= 0.6.9)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.1)
       tzinfo (~> 1.1)
-    autoprefixer-rails (5.1.8)
+    autoprefixer-rails (5.2.1)
       execjs
       json
-    bootstrap-sass (3.3.4.1)
+    bootstrap-sass (3.3.5.1)
       autoprefixer-rails (>= 5.0.0.1)
-      sass (>= 3.2.19)
+      sass (>= 3.3.0)
     builder (3.2.2)
     celluloid (0.16.0)
       timers (~> 4.0.0)
     chunky_png (1.3.4)
-    coffee-script (2.3.0)
+    coffee-script (2.4.1)
       coffee-script-source
       execjs
-    coffee-script-source (1.9.1)
+    coffee-script-source (1.9.1.1)
     commonjs (0.2.7)
     compass (1.0.3)
       chunky_png (~> 1.2)
@@ -53,44 +54,45 @@ GEM
       sass (>= 3.3.0, < 3.5)
     compass-import-once (1.0.5)
       sass (>= 3.2, < 3.5)
-    daemons (1.2.2)
+    daemons (1.2.3)
     em-websocket (0.5.1)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0.6.0)
     erubis (2.7.0)
     eventmachine (1.0.7)
-    execjs (2.4.0)
-    ffi (1.9.8)
+    execjs (2.5.2)
+    ffi (1.9.10)
+    git-version-bump (0.15.1)
     haml (4.0.6)
       tilt
     hike (1.2.3)
     hitimes (1.2.2)
     hooks (0.4.0)
       uber (~> 0.0.4)
-    htmlcompressor (0.1.2)
+    htmlcompressor (0.2.0)
     http_parser.rb (0.6.0)
     i18n (0.7.0)
-    json (1.8.2)
-    kramdown (1.6.0)
+    json (1.8.3)
+    kramdown (1.8.0)
     less (2.6.0)
       commonjs (~> 0.2.7)
-    libv8 (3.16.14.7)
-    listen (2.10.0)
+    libv8 (3.16.14.11)
+    listen (2.10.1)
       celluloid (~> 0.16.0)
       rb-fsevent (>= 0.9.3)
       rb-inotify (>= 0.9)
-    middleman (3.3.10)
+    middleman (3.3.12)
       coffee-script (~> 2.2)
       compass (>= 1.0.0, < 2.0.0)
       compass-import-once (= 1.0.5)
       execjs (~> 2.0)
       haml (>= 4.0.5)
       kramdown (~> 1.2)
-      middleman-core (= 3.3.10)
+      middleman-core (= 3.3.12)
       middleman-sprockets (>= 3.1.2)
       sass (>= 3.4.0, < 4.0)
       uglifier (~> 2.5)
-    middleman-core (3.3.10)
+    middleman-core (3.3.12)
       activesupport (~> 4.1.0)
       bundler (~> 1.1)
       erubis
@@ -106,8 +108,8 @@ GEM
       em-websocket (~> 0.5.1)
       middleman-core (>= 3.3)
       rack-livereload (~> 0.3.15)
-    middleman-minify-html (3.4.0)
-      htmlcompressor (~> 0.1.0)
+    middleman-minify-html (3.4.1)
+      htmlcompressor (~> 0.2.0)
       middleman-core (>= 3.2)
     middleman-sprockets (3.4.2)
       middleman-core (>= 3.3)
@@ -117,31 +119,34 @@ GEM
     middleman-syntax (2.0.0)
       middleman-core (~> 3.2)
       rouge (~> 1.0)
-    minitest (5.5.1)
-    multi_json (1.11.0)
+    minitest (5.7.0)
+    multi_json (1.11.2)
     padrino-helpers (0.12.5)
       i18n (~> 0.6, >= 0.6.7)
       padrino-support (= 0.12.5)
       tilt (~> 1.4.1)
     padrino-support (0.12.5)
       activesupport (>= 3.1)
-    rack (1.6.0)
-    rack-contrib (1.2.0)
-      rack (>= 0.9.1)
-    rack-livereload (0.3.15)
+    rack (1.6.4)
+    rack-contrib (1.3.0)
+      git-version-bump (~> 0.15)
+      rack (~> 1.4)
+    rack-livereload (0.3.16)
+      rack
+    rack-protection (1.5.3)
       rack
     rack-rewrite (1.5.1)
     rack-ssl-enforcer (0.2.8)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rb-fsevent (0.9.4)
+    rb-fsevent (0.9.5)
     rb-inotify (0.9.5)
       ffi (>= 0.5.0)
-    redcarpet (3.2.2)
-    ref (1.0.5)
-    rouge (1.8.0)
-    sass (3.4.13)
-    sprockets (2.12.3)
+    redcarpet (3.3.2)
+    ref (2.0.0)
+    rouge (1.9.1)
+    sass (3.4.16)
+    sprockets (2.12.4)
       hike (~> 1.2)
       multi_json (~> 1.0)
       rack (~> 1.0)
@@ -151,7 +156,7 @@ GEM
     sprockets-sass (1.3.1)
       sprockets (~> 2.0)
       tilt (~> 1.1)
-    therubyracer (0.12.1)
+    therubyracer (0.12.2)
       libv8 (~> 3.16.14.0)
       ref
     thin (1.6.3)
@@ -175,3 +180,6 @@ PLATFORMS
 
 DEPENDENCIES
   middleman-hashicorp!
+
+BUNDLED WITH
+   1.10.5
diff --git a/website/Vagrantfile b/website/Vagrantfile
index d360738a7..4bfc410e2 100644
--- a/website/Vagrantfile
+++ b/website/Vagrantfile
@@ -9,6 +9,8 @@ sudo apt-get -y update
 
 # RVM/Ruby
 sudo apt-get -y install curl
+# manually install GPG key in a proxy-friendly way
+curl -sSL https://rvm.io/mpapis.asc | gpg --import -
 curl -sSL https://get.rvm.io | bash -s stable
 . ~/.bashrc
 . ~/.bash_profile
@@ -17,17 +19,12 @@ rvm --default use 2.0.0
 
 # Middleman deps
 cd /vagrant
+gem install bundle
+sudo apt-get install -y git-core
 bundle
 
-# JS stuff
-sudo apt-get install -y python-software-properties
-sudo add-apt-repository -y ppa:chris-lea/node.js
-sudo apt-get update -y
-sudo apt-get install -y nodejs
-
-# Get JS deps
-cd /vagrant/source
-npm install
+# Run the middleman server
+bundle exec middleman server &
 SCRIPT
 
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
@@ -35,4 +32,5 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
   config.vm.network "private_network", ip: "33.33.30.10"
   config.vm.provision "shell", inline: $script, privileged: false
   config.vm.synced_folder ".", "/vagrant", type: "rsync"
+  config.vm.network "forwarded_port", guest: 4567, host: 4567
 end
diff --git a/website/config.rb b/website/config.rb
index 4bcd629db..80bbb6443 100644
--- a/website/config.rb
+++ b/website/config.rb
@@ -5,8 +5,9 @@
 set :base_url, "https://www.terraform.io/"
 
 activate :hashicorp do |h|
-  h.version      = ENV['TERRAFORM_VERSION']
-  h.bintray_repo = 'mitchellh/terraform'
-  h.bintray_user = 'mitchellh'
-  h.bintray_key  = ENV['BINTRAY_API_KEY']
+  h.version         = ENV["TERRAFORM_VERSION"]
+  h.bintray_enabled = ENV["BINTRAY_ENABLED"]
+  h.bintray_repo    = "mitchellh/terraform"
+  h.bintray_user    = "mitchellh"
+  h.bintray_key     = ENV["BINTRAY_API_KEY"]
 end
diff --git a/website/config.ru b/website/config.ru
index 5cf4e322d..669f200cf 100644
--- a/website/config.ru
+++ b/website/config.ru
@@ -3,6 +3,17 @@ require "rack/contrib/not_found"
 require "rack/contrib/response_headers"
 require "rack/contrib/static_cache"
 require "rack/contrib/try_static"
+require "rack/protection"
+
+# Protect against various bad things
+use Rack::Protection::JsonCsrf
+use Rack::Protection::RemoteReferrer
+use Rack::Protection::HttpOrigin
+use Rack::Protection::EscapedParams
+use Rack::Protection::XSSHeader
+use Rack::Protection::FrameOptions
+use Rack::Protection::PathTraversal
+use Rack::Protection::IPSpoofing
 
 # Properly compress the output if the client can handle it.
 use Rack::Deflater
diff --git a/website/source/assets/stylesheets/_docs.scss b/website/source/assets/stylesheets/_docs.scss
index 48a92b0a7..0cf800715 100755
--- a/website/source/assets/stylesheets/_docs.scss
+++ b/website/source/assets/stylesheets/_docs.scss
@@ -7,22 +7,23 @@ body.page-sub{
 }
 
 body.layout-atlas,
-body.layout-consul,
-body.layout-dnsimple,
-body.layout-dme,
-body.layout-docker,
+body.layout-aws,
+body.layout-azure,
 body.layout-cloudflare,
 body.layout-cloudstack,
+body.layout-consul,
+body.layout-digitalocean,
+body.layout-dme,
+body.layout-dnsimple,
+body.layout-docker,
 body.layout-google,
 body.layout-heroku,
 body.layout-mailgun,
 body.layout-openstack,
 body.layout-template,
-body.layout-digitalocean,
-body.layout-aws,
 body.layout-docs,
-body.layout-inner,
 body.layout-downloads,
+body.layout-inner,
 body.layout-intro{
 	background: $light-black image-url('sidebar-wire.png') left 62px no-repeat;
 
@@ -287,4 +288,3 @@ body.layout-intro{
 		}
 	}
 }
-
diff --git a/website/source/docs/commands/apply.html.markdown b/website/source/docs/commands/apply.html.markdown
index 9bb5acdbf..dec4ea19d 100644
--- a/website/source/docs/commands/apply.html.markdown
+++ b/website/source/docs/commands/apply.html.markdown
@@ -14,7 +14,7 @@ set of actions generated by a `terraform plan` execution plan.
 
 ## Usage
 
-Usage: `terraform apply [options] [dir]`
+Usage: `terraform apply [options] [dir-or-plan]`
 
 By default, `apply` scans the current directory for the configuration
 and applies the changes appropriately. However, a path to another configuration
diff --git a/website/source/docs/commands/destroy.html.markdown b/website/source/docs/commands/destroy.html.markdown
index 0a0f3a738..98f1b79e6 100644
--- a/website/source/docs/commands/destroy.html.markdown
+++ b/website/source/docs/commands/destroy.html.markdown
@@ -18,9 +18,11 @@ Usage: `terraform destroy [options] [dir]`
 Infrastructure managed by Terraform will be destroyed. This will ask for
 confirmation before destroying.
 
-This command accepts all the flags that the
-[apply command](/docs/commands/apply.html) accepts. If `-force` is
-set, then the destroy confirmation will not be shown.
+This command accepts all the arguments and flags that the [apply
+command](/docs/commands/apply.html) accepts, with the exception of a plan file
+argument.
+
+If `-force` is set, then the destroy confirmation will not be shown.
 
 The `-target` flag, instead of affecting "dependencies" will instead also
 destroy any resources that _depend on_ the target(s) specified.
diff --git a/website/source/docs/commands/output.html.markdown b/website/source/docs/commands/output.html.markdown
index ac1ab5a23..f1a70394e 100644
--- a/website/source/docs/commands/output.html.markdown
+++ b/website/source/docs/commands/output.html.markdown
@@ -21,4 +21,8 @@ current directory for the state file to query.
 The command-line flags are all optional. The list of available flags are:
 
 * `-state=path` - Path to the state file. Defaults to "terraform.tfstate".
-
+* `-module=module_name` - The module path which has needed output.
+    By default this is the root path. Other modules can be specified by
+    a period-separated list. Example: "foo" would reference the module
+    "foo" but "foo.bar" would reference the "bar" module in the "foo"
+    module.
diff --git a/website/source/docs/commands/push.html.markdown b/website/source/docs/commands/push.html.markdown
index 1a752e657..8c5af1f8f 100644
--- a/website/source/docs/commands/push.html.markdown
+++ b/website/source/docs/commands/push.html.markdown
@@ -52,10 +52,20 @@ The command-line flags are all optional. The list of available flags are:
 
 * `-no-color` - Disables output with coloring
 
+
+* `-overwrite=foo` - Marks a specific variable to be updated on Atlas.
+  Normally, if a variable is already set in Atlas, Terraform will not
+  send the local value (even if it is different). This forces it to
+  send the local value to Atlas. This flag can be repeated multiple times.
+
 * `-token=<token>` - Atlas API token to use to authorize the upload.
   If blank or unspecified, the `ATLAS_TOKEN` environmental variable
   will be used.
 
+* `-var='foo=bar'` - Set the value of a variable for the Terraform configuration.
+
+* `-var-file=foo` - Set the value of variables using a variable file.
+
 * `-vcs=true` - If true (default), then Terraform will detect if a VCS
   is in use, such as Git, and will only upload files that are comitted to
   version control. If no version control system is detected, Terraform will
@@ -78,6 +88,30 @@ all the files to be safe. To exclude certain files, specify the `-exclude`
 flag when pushing, or specify the `exclude` parameter in the
 [Atlas configuration section](/docs/configuration/atlas.html).
 
+## Terraform Variables
+
+When you `push`, Terraform will automatically set the local values of
+your Terraform variables on Atlas. The values are only set if they
+don't already exist on Atlas. If you want to force push a certain
+variable value to update it, use the `-overwrite` flag.
+
+All the variable values stored on Atlas are encrypted and secured
+using [Vault](https://vaultproject.io). We blogged about the
+[architecture of our secure storage system](https://hashicorp.com/blog/how-atlas-uses-vault-for-managing-secrets.html) if you want more detail.
+
+The variable values can be updated using the `-overwrite` flag or via
+the [Atlas website](https://atlas.hashicorp.com). An example of updating
+just a single variable `foo` is shown below:
+
+```
+$ terraform push -var 'foo=bar' -overwrite foo
+...
+```
+
+Both the `-var` and `-overwrite` flag are required. The `-var` flag
+sets the value locally (the exact same process as commands such as apply
+or plan), and the `-overwrite` flag tells the push command to update Atlas.
+
 ## Remote State Requirement
 
 `terraform push` requires that
diff --git a/website/source/docs/configuration/interpolation.html.md b/website/source/docs/configuration/interpolation.html.md
index d1e16bfba..ce2796a9d 100644
--- a/website/source/docs/configuration/interpolation.html.md
+++ b/website/source/docs/configuration/interpolation.html.md
@@ -19,6 +19,9 @@ variables, attributes of resources, call functions, etc.
 You can also perform simple math in interpolations, allowing
 you to write expressions such as `${count.index+1}`.
 
+You can escape interpolation with double dollar signs: `$${foo}`
+will be rendered as a literal `${foo}`.
+
 ## Available Variables
 
 **To reference user variables**, use the `var.` prefix followed by the
@@ -69,8 +72,8 @@ are documented below.
 
 The supported built-in functions are:
 
-  * `concat(args...)` - Concatenates the values of multiple arguments into
-      a single string.
+  * `concat(list1, list2)` - Combines two or more lists into a single list.
+     Example: `concat(aws_instance.db.*.tags.Name, aws_instance.web.*.tags.Name)`
 
   * `element(list, index)` - Returns a single element from a list
       at the given index. If the index is greater than the number of
@@ -89,6 +92,16 @@ The supported built-in functions are:
       Example to zero-prefix a count, used commonly for naming servers:
       `format("web-%03d", count.index+1)`.
 
+  * `formatlist(format, args...)` - Formats each element of a list
+      according to the given format, similarly to `format`, and returns a list.
+      Non-list arguments are repeated for each list element.
+      For example, to convert a list of DNS addresses to a list of URLs, you might use:
+      `formatlist("https://%s:%s/", aws_instance.foo.*.public_dns, var.port)`.
+      If multiple args are lists, and they have the same number of elements, then the formatting is applied to the elements of the lists in parallel.
+      Example:
+      `formatlist("instance %v has private ip %v", aws_instance.foo.*.id, aws_instance.foo.*.private_ip)`.
+      Passing lists with different lengths to formatlist results in an error.
+
   * `join(delim, list)` - Joins the list with the delimiter. A list is
       only possible with splat variables from resources with a count
       greater than one. Example: `join(",", aws_instance.foo.*.id)`
@@ -113,14 +126,14 @@ The supported built-in functions are:
   * `split(delim, string)` - Splits the string previously created by `join`
       back into a list. This is useful for pushing lists through module
       outputs since they currently only support string values. Depending on the
-      use, the string this is being performed within may need to be wrapped 
+      use, the string this is being performed within may need to be wrapped
       in brackets to indicate that the output is actually a list, e.g.
       `a_resource_param = ["${split(",", var.CSV_STRING)}"]`.
       Example: `split(",", module.amod.server_ids)`
 
 ## Templates
 
-Long strings can be managed using templates. Templates are [resources](/docs/configuration/resources.html) defined by a filename and some variables to use during interpolation. They have a computed `rendered` attribute containing the result.
+Long strings can be managed using templates. [Templates](/docs/providers/template/index.html) are [resources](/docs/configuration/resources.html) defined by a filename and some variables to use during interpolation. They have a computed `rendered` attribute containing the result.
 
 A template resource looks like:
 
@@ -147,3 +160,42 @@ ${hello} ${world}!
 Then the rendered value would be `goodnight moon!`.
 
 You may use any of the built-in functions in your template.
+
+
+### Using Templates with Count
+
+Here is an example that combines the capabilities of templates with the interpolation
+from `count` to give us a parametized template, unique to each resource instance:
+
+```
+variable "count" {
+  default = 2
+}
+
+variable "hostnames" {
+  default = {
+    "0" = "example1.org"
+    "1" = "example2.net"
+  }
+}
+
+resource "template_file" "web_init" {
+  // here we expand multiple template_files - the same number as we have instances
+  count = "${var.count}"
+  filename = "templates/web_init.tpl"
+  vars {
+    // that gives us access to use count.index to do the lookup
+    hostname = "${lookup(var.hostnames, count.index)}"
+  }
+}
+
+resource "aws_instance" "web" {
+  // ...
+  count = "${var.count}"
+  // here we link each web instance to the proper template_file
+  user_data = "${element(template_file.web_init.*.rendered, count.index)}"
+}
+```
+
+With this, we will build a list of `template_file.web_init` resources which we can
+use in combination with our list of `aws_instance.web` resources.
diff --git a/website/source/docs/configuration/resources.html.md b/website/source/docs/configuration/resources.html.md
index b1d7687d8..1ed50df98 100644
--- a/website/source/docs/configuration/resources.html.md
+++ b/website/source/docs/configuration/resources.html.md
@@ -129,7 +129,7 @@ resource "aws_instance" "app" {
 
 ## Multiple Provider Instances
 
-By default, a resource targets the resource based on its type. For example
+By default, a resource targets the provider based on its type. For example
 an `aws_instance` resource will target the "aws" provider. As of Terraform
 0.5.0, a resource can target any provider by name.
 
diff --git a/website/source/docs/modules/sources.html.markdown b/website/source/docs/modules/sources.html.markdown
index f8a3dd3c7..b0a2b4d0c 100644
--- a/website/source/docs/modules/sources.html.markdown
+++ b/website/source/docs/modules/sources.html.markdown
@@ -124,9 +124,15 @@ to Terraform (using the forced source type syntax documented below) to use
 Git:
 
 ```
+// force https source
 module "consul" {
 	source = "git::https://hashicorp.com/module.git"
 }
+
+// force ssh source
+module "ami" {
+	source = "git::ssh://git@github.com/owner/repo.git"
+}
 ```
 
 URLs for Git repositories (of any protocol) support the following query
diff --git a/website/source/docs/providers/atlas/r/artifact.html.markdown b/website/source/docs/providers/atlas/r/artifact.html.markdown
index 889413f21..3dee419f7 100644
--- a/website/source/docs/providers/atlas/r/artifact.html.markdown
+++ b/website/source/docs/providers/atlas/r/artifact.html.markdown
@@ -24,7 +24,7 @@ to this artifact will trigger a change to that instance.
 # Read the AMI
 resource "atlas_artifact" "web" {
     name = "hashicorp/web"
-    type = "aws.ami"
+    type = "amazon.ami"
     build = "latest"
     metadata {
         arch = "386"
diff --git a/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown b/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
index 10292d7e3..6d6215f22 100644
--- a/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
@@ -26,7 +26,7 @@ resource "aws_elb" "lb" {
 
 resource "aws_app_cookie_stickiness_policy" "foo" {
 	  name = "foo_policy"
-	  load_balancer = "${aws_elb.lb}"
+	  load_balancer = "${aws_elb.lb.id}"
 	  lb_port = 80
 	  cookie_name = "MyAppCookie"
 }
diff --git a/website/source/docs/providers/aws/r/autoscale.html.markdown b/website/source/docs/providers/aws/r/autoscaling_group.html.markdown
similarity index 54%
rename from website/source/docs/providers/aws/r/autoscale.html.markdown
rename to website/source/docs/providers/aws/r/autoscaling_group.html.markdown
index 7f3a4be9d..73715ee91 100644
--- a/website/source/docs/providers/aws/r/autoscale.html.markdown
+++ b/website/source/docs/providers/aws/r/autoscaling_group.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_autoscaling_group"
-sidebar_current: "docs-aws-resource-autoscale"
+sidebar_current: "docs-aws-resource-autoscaling-group"
 description: |-
   Provides an AutoScaling Group resource.
 ---
@@ -43,19 +43,19 @@ The following arguments are supported:
 
 * `name` - (Required) The name of the auto scale group.
 * `max_size` - (Required) The maximum size of the auto scale group.
-* `min_size` - (Required) The minimum size of the auto scale group. Terraform
-  waits after ASG creation for this number of healthy instances to show up in
-  the ASG before continuing. Currently, it will wait for a maxiumum of 10m, if
-  ASG creation is taking more than a few minutes, it's worth investigating for
-  scaling actvity errors caused by problems with the selected Launch
-  Configuration.
-* `availability_zones` - (Required) A list of AZs to launch resources in.
+* `min_size` - (Required) The minimum size of the auto scale group.
+    (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+* `availability_zones` - (Optional) A list of AZs to launch resources in.
+   Required only if you do not specify any `vpc_zone_identifier`
 * `launch_configuration` - (Required) The ID of the launch configuration to use.
 * `health_check_grace_period` - (Optional) Time after instance comes into service before checking health.
 * `health_check_type` - (Optional) "EC2" or "ELB". Controls how health checking is done.
 * `desired_capacity` - (Optional) The number of Amazon EC2 instances that
-  should be running in the group. (If this is specified, Terraform will wait for
-  this number of healthy instances after ASG creation instead of `min_size`.)
+    should be running in the group. (See also [Waiting for
+    Capacity](#waiting-for-capacity) below.)
+* `min_elb_capacity` - (Optional) Setting this will cause Terraform to wait
+    for this number of healthy instances all attached load balancers.
+    (See also [Waiting for Capacity](#waiting-for-capacity) below.)
 * `force_delete` - (Optional) Allows deleting the autoscaling group without waiting
    for all instances in the pool to terminate.
 * `load_balancers` (Optional) A list of load balancer names to add to the autoscaling
@@ -88,3 +88,41 @@ The following attributes are exported:
 * `vpc_zone_identifier` - The VPC zone identifier
 * `load_balancers` (Optional) The load balancer names associated with the
    autoscaling group.
+
+<a id="waiting-for-capacity"></a>
+## Waiting for Capacity
+
+A newly-created ASG is initially empty and begins to scale to `min_size` (or
+`desired_capacity`, if specified) by launching instances using the provided
+Launch Configuration. These instances take time to launch and boot.
+
+Terraform provides two mechanisms to help consistently manage ASG scale up
+time across dependent resources.
+
+#### Waiting for ASG Capacity
+
+The first is default behavior. Terraform waits after ASG creation for
+`min_size` (or `desired_capacity`, if specified) healthy instances to show up
+in the ASG before continuing.
+
+Terraform considers an instance "healthy" when the ASG reports `HealthStatus:
+"Healthy"` and `LifecycleState: "InService"`. See the [AWS AutoScaling
+Docs](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AutoScalingGroupLifecycle.html)
+for more information on an ASG's lifecycle.
+
+Terraform will wait for healthy instances for up to 10 minutes. If ASG creation
+is taking more than a few minutes, it's worth investigating for scaling activity
+errors, which can be caused by problems with the selected Launch Configuration.
+
+#### Waiting for ELB Capacity
+
+The second mechanism is optional, and affects ASGs with attached Load
+Balancers. If `min_elb_capacity` is set, Terraform will wait for that number of
+Instances to be `"InService"` in all attached `load_balancers`. This can be
+used to ensure that service is being provided before Terraform moves on.
+
+As with ASG Capacity, Terraform will wait for up to 10 minutes for
+`"InService"` instances. If ASG creation takes more than a few minutes, this
+could indicate one of a number of configuration problems. See the [AWS Docs on
+Load Balancer Troubleshooting](https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-troubleshooting.html)
+for more information.
diff --git a/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown b/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown
new file mode 100644
index 000000000..e47d337c6
--- /dev/null
+++ b/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown
@@ -0,0 +1,68 @@
+---
+layout: "aws"
+page_title: "AWS: aws_autoscaling_notification"
+sidebar_current: "docs-aws-resource-autoscaling-notification"
+description: |-
+  Provides an AutoScaling Group with Notification support
+---
+
+# aws\_autoscaling\_notification
+
+Provides an AutoScaling Group with Notification support, via SNS Topics. Each of
+the `notifications` map to a [Notification Configuration][2] inside Amazon Web
+Services, and are applied to each AutoScaling Group you supply.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "aws_autoscaling_notification" "example_notifications" {
+  group_names = [
+    "${aws_autoscaling_group.bar.name}",
+    "${aws_autoscaling_group.foo.name}",
+  ]
+  notifications  = [
+    "autoscaling:EC2_INSTANCE_LAUNCH", 
+    "autoscaling:EC2_INSTANCE_TERMINATE",
+    "autoscaling:EC2_INSTANCE_LAUNCH_ERROR"
+  ]
+  topic_arn = "${aws_sns_topic.example.arn}"
+}
+
+resource "aws_sns_topic" "example" {
+  name = "example-topic"
+  # arn is an exported attribute
+}
+
+resource "aws_autoscaling_group" "bar" {
+  name = "foobar1-terraform-test"
+  [... ASG attributes ...]
+}
+
+resource "aws_autoscaling_group" "foo" {
+  name = "barfoo-terraform-test"
+  [... ASG attributes ...]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `group_names` - (Required) A list of AutoScaling Group Names
+* `notifications` - (Required) A list of Notification Types that trigger
+notifications. Acceptable are documented [in the AWS documentation here][1]
+* `topic_arn` - (Required) The Topic ARN for notifications to be sent through
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `group_names` 
+* `notifications`
+* `topic_arn` 
+
+
+[1]: http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_NotificationConfiguration.html
+[2]: http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html 
diff --git a/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown b/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown
new file mode 100644
index 000000000..2543c0220
--- /dev/null
+++ b/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown
@@ -0,0 +1,53 @@
+---
+layout: "aws"
+page_title: "AWS: aws_autoscaling_policy"
+sidebar_current: "docs-aws-resource-autoscaling-policy"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+# aws\_autoscaling\_policy
+
+Provides an AutoScaling Scaling Policy resource.
+
+~> **NOTE:** You may want to omit `desired_capacity` attribute from attached `aws_autoscaling_group`
+when using autoscaling policies. It's good practice to pick either
+[manual](http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-manual-scaling.html)
+or [dynamic](http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-scale-based-on-demand.html)
+(policy-based) scaling.
+
+## Example Usage
+```
+resource "aws_autoscaling_policy" "bat" {
+  name = "foobar3-terraform-test"
+  scaling_adjustment = 4
+  adjustment_type = "ChangeInCapacity"
+  cooldown = 300
+  autoscaling_group_name = "${aws_autoscaling_group.bar.name}"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-east-1a"]
+  name = "foobar3-terraform-test"
+  max_size = 5
+  min_size = 2
+  health_check_grace_period = 300
+  health_check_type = "ELB"
+  force_delete = true
+  launch_configuration = "${aws_launch_configuration.foo.name}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the policy.
+* `autoscaling_group_name` - (Required) The name or ARN of the group.
+* `adjustment_type` - (Required) Specifies whether the `scaling_adjustment` is an absolute number or a percentage of the current capacity. Valid values are `ChangeInCapacity`, `ExactCapacity`, and `PercentChangeInCapacity`.
+* `scaling_adjustment` - (Required) The number of instances by which to scale. `adjustment_type` determines the interpretation of this number (e.g., as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity.
+* `cooldown` - (Optional) The amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `min_adjustment_step` - (Optional) Used with `adjustment_type` with the value `PercentChangeInCapacity`, the scaling policy changes the `desired_capacity` of the Auto Scaling group by at least the number of instances specified in the value.
+
+## Attribute Reference
+* `arn` - The ARN assigned by AWS to the scaling policy.
diff --git a/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown b/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown
new file mode 100644
index 000000000..5eec19b1f
--- /dev/null
+++ b/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown
@@ -0,0 +1,75 @@
+---
+layout: "aws"
+page_title: "AWS: cloudwatch_metric_alarm"
+sidebar_current: "docs-aws-resource-cloudwatch-metric-alarm"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+# aws\_cloudwatch\_metric\_alarm
+
+Provides a CloudWatch Metric Alarm resource.
+
+## Example Usage
+```
+resource "aws_cloudwatch_metric_alarm" "foobar" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    insufficient_data_actions = []
+}
+```
+
+## Example in Conjuction with Scaling Policies
+```
+resource "aws_autoscaling_policy" "bat" {
+    name = "foobar3-terraform-test"
+    scaling_adjustment = 4
+    adjustment_type = "ChangeInCapacity"
+    cooldown = 300
+    autoscaling_group_name = "${aws_autoscaling_group.bar.name}"
+}
+
+resource "aws_cloudwatch_metric_alarm" "bat" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    alarm_actions = ["${aws_autoscaling_policy.bat.arn}"]
+}
+```
+## Argument Reference
+
+See [related part of AWS Docs](http://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)
+for details about valid values.
+
+The following arguments are supported:
+
+* `alarm_name` - (Required) The descriptive name for the alarm. This name must be unique within the user's AWS account
+* `comparison_operator` - (Required) The arithmetic operation to use when comparing the specified Statistic and Threshold. The specified Statistic value is used as the first operand. Either of the following is supported: `GreaterThanOrEqualToThreshold`, `GreaterThanThreshold`, `LessThanThreshold`, `LessThanOrEqualToThreshold`.
+* `evaluation_periods` - (Required) The number of periods over which data is compared to the specified threshold.
+* `metric_name` - (Required) The name for the alarm's associated metric.
+  See docs for [supported metrics](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `namespace` - (Required) The namespace for the alarm's associated metric.
+* `period` - (Required) The period in seconds over which the specified `statistic` is applied.
+* `statistic` - (Required) The statistic to apply to the alarm's associated metric.
+   Either of the following is supported: `SampleCount`, `Average`, `Sum`, `Minimum`, `Maximum`
+* `threshold` - (Required) The value against which the specified statistic is compared.
+* `actions_enabled` - (Optional) Indicates whether or not actions should be executed during any changes to the alarm's state. Defaults to `true`.
+* `alarm_actions` - (Optional) The list of actions to execute when this alarm transitions into an ALARM state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `alarm_description` - (Optional) The description for the alarm.
+* `dimensions` - (Optional) The dimensions for the alarm's associated metric.
+* `insufficient_data_actions` - (Optional) The list of actions to execute when this alarm transitions into an INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `ok_actions` - (Optional) The list of actions to execute when this alarm transitions into an OK state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `unit` - (Optional) The unit for the alarm's associated metric.
diff --git a/website/source/docs/providers/aws/r/db_instance.html.markdown b/website/source/docs/providers/aws/r/db_instance.html.markdown
index 61b5b6dcf..c2f0063f4 100644
--- a/website/source/docs/providers/aws/r/db_instance.html.markdown
+++ b/website/source/docs/providers/aws/r/db_instance.html.markdown
@@ -29,6 +29,9 @@ resource "aws_db_instance" "default" {
 
 ## Argument Reference
 
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](http://docs.aws.amazon.com/AmazonRDS/latest/CommandLineReference/CLIReference-cmd-ModifyDBInstance.html).
+
 The following arguments are supported:
 
 * `allocated_storage` - (Required) The allocated storage in gigabytes.
@@ -48,11 +51,14 @@ The following arguments are supported:
     show up in logs, and it will be stored in the state file.
 * `username` - (Required) Username for the master DB user.
 * `availability_zone` - (Optional) The AZ for the RDS instance.
-* `backup_retention_period` - (Optional) The days to retain backups for.
+* `backup_retention_period` - (Optional) The days to retain backups for. Must be
+`1` or greater to be a source for a [Read Replica][1].
 * `backup_window` - (Optional) The backup window.
 * `iops` - (Optional) The amount of provisioned IOPS. Setting this implies a
     storage_type of "io1".
 * `maintenance_window` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+  See [RDS Maintenance Window docs](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AdjustingTheMaintenanceWindow.html) for more.
 * `multi_az` - (Optional) Specifies if the RDS instance is multi-AZ
 * `port` - (Optional) The port on which the DB accepts connections.
 * `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible.
@@ -64,7 +70,18 @@ The following arguments are supported:
 * `storage_encrypted` - (Optional) Specifies whether the DB instance is encrypted. The default is `false` if not specified.
 * `apply_immediately` - (Optional) Specifies whether any database modifications
      are applied immediately, or during the next maintenance window. Default is
-     `false`. See [Amazon RDS Documentation for more for more information.](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+     `false`. See [Amazon RDS Documentation for more information.](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+* `replicate_source_db` - (Optional) Specifies that this resource is a Replicate
+database, and to use this value as the source database. This correlates to the
+`identifier` of another Amazon RDS Database to replicate. See
+[DB Instance Replication][1] and
+[Working with PostgreSQL and MySQL Read Replicas](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html) for
+ more information on using Replication.
+* `snapshot_identifier` - (Optional) Specifies whether or not to create this database from a snapshot. This correlates to the snapshot ID you'd find in the RDS console, e.g: rds:production-2015-06-26-06-05.
+
+~> **NOTE:** Removing the `replicate_source_db` attribute from an existing RDS
+Replicate database managed by Terraform will promote the database to a fully
+standalone database.
 
 ## Attributes Reference
 
@@ -88,3 +105,4 @@ The following attributes are exported:
 * `username` - The master username for the database
 * `storage_encrypted` - Specifies whether the DB instance is encrypted
 
+[1]: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
diff --git a/website/source/docs/providers/aws/r/db_security_group.html.markdown b/website/source/docs/providers/aws/r/db_security_group.html.markdown
index 85041f522..7a9242677 100644
--- a/website/source/docs/providers/aws/r/db_security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/db_security_group.html.markdown
@@ -8,7 +8,10 @@ description: |-
 
 # aws\_db\_security\_group
 
-Provides an RDS security group resource.
+Provides an RDS security group resource. This is only for DB instances in the
+EC2-Classic Platform. For instances inside a VPC, use the
+[`aws_db_instance.vpc_security_group_ids`](/docs/providers/aws/r/db_instance.html#vpc_security_group_ids)
+attribute instead.
 
 ## Example Usage
 
diff --git a/website/source/docs/providers/aws/r/db_subnet_group.html.markdown b/website/source/docs/providers/aws/r/db_subnet_group.html.markdown
index f9050ad45..2937b54e7 100644
--- a/website/source/docs/providers/aws/r/db_subnet_group.html.markdown
+++ b/website/source/docs/providers/aws/r/db_subnet_group.html.markdown
@@ -24,9 +24,9 @@ resource "aws_db_subnet_group" "default" {
 
 The following arguments are supported:
 
-* `name` - (Required) The name of the DB security group.
-* `description` - (Required) The description of the DB security group.
-* `subnet_ids` - (Required) A list of ingress rules.
+* `name` - (Required) The name of the DB subnet group.
+* `description` - (Required) The description of the DB subnet group.
+* `subnet_ids` - (Required) A list of VPC subnet IDs.
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/dynamodb_table.html.markdown b/website/source/docs/providers/aws/r/dynamodb_table.html.markdown
new file mode 100644
index 000000000..29ceb0595
--- /dev/null
+++ b/website/source/docs/providers/aws/r/dynamodb_table.html.markdown
@@ -0,0 +1,113 @@
+---
+layout: "aws"
+page_title: "AWS: dynamodb_table"
+sidebar_current: "docs-aws-resource-dynamodb-table"
+description: |-
+  Provides a DynamoDB table resource
+---
+
+# aws\_dynamodb\_table
+
+Provides a DynamoDB table resource
+
+## Example Usage
+
+The following dynamodb table description models the table and GSI shown
+in the [AWS SDK example documentation](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html)
+
+```
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "GameScores"
+    read_capacity = 20
+    write_capacity = 20
+    hash_key = "UserId"
+    range_key = "GameTitle"
+    attribute {
+      name = "UserId"
+      type = "S"
+    }
+    attribute {
+      name = "GameTitle"
+      type = "S"
+    }
+    attribute {
+      name = "TopScore"
+      type = "N"
+    }
+    global_secondary_index {
+      name = "GameTitleIndex"
+      hash_key = "GameTitle"
+      range_key = "TopScore"
+      write_capacity = 10
+      read_capacity = 10
+      projection_type = "INCLUDE"
+      non_key_attributes = [ "UserId" ]
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the table, this needs to be unique
+  within a region.
+* `read_capacity` - (Required) The number of read units for this table
+* `write_capacity` - (Required) The number of write units for this table
+* `hash_key` - (Required) The attribute to use as the hash key (the
+  attribute must also be defined as an attribute record
+* `range_key` - (Optional) The attribute to use as the range key (must
+  also be defined)
+* `attribute` - Define an attribute, has two properties:
+  * `name` - The name of the attribute
+  * `type` - One of: S, N, or B for (S)tring, (N)umber or (B)inary data
+* `local_secondary_index` - (Optional) Describe an LSI on the table;
+  these can only be allocated *at creation* so you cannot change this
+definition after you have created the resource. 
+* `global_secondary_index` - (Optional) Describe a GSO for the table;
+  subject to the normal limits on the number of GSIs, projected
+attributes, etc.  
+
+For both `local_secondary_index` and `global_secondary_index` objects,
+the following properties are supported:
+
+* `name` - (Required) The name of the LSI or GSI
+* `hash_key` - (Required) The name of the hash key in the index; must be
+  defined as an attribute in the resource
+* `range_key` - (Required) The name of the range key; must be defined
+* `projection_type` - (Required) One of "ALL", "INCLUDE" or "KEYS_ONLY"
+   where *ALL* projects every attribute into the index, *KEYS_ONLY*
+    projects just the hash and range key into the index, and *INCLUDE*
+    projects only the keys specified in the _non_key_attributes_
+parameter. 
+* `non_key_attributes` - (Optional) Only required with *INCLUDE* as a
+  projection type; a list of attributes to project into the index. These
+do not need to be defined as attributes on the table. 
+
+For `global_secondary_index` objects only, you need to specify
+`write_capacity` and `read_capacity` in the same way you would for the
+table as they have separate I/O capacity.
+
+### A note about attributes
+
+Only define attributes on the table object that are going to be used as:
+
+* Table hash key or range key
+* LSI or GSI hash key or range key
+
+The DynamoDB API expects attribute structure (name and type) to be 
+passed along when creating or updating GSI/LSIs or creating the initial 
+table. In these cases it expects the Hash / Range keys to be provided; 
+because these get re-used in numerous places (i.e the table's range key 
+could be a part of one or more GSIs), they are stored on the table 
+object to prevent duplication and increase consistency. If you add 
+attributes here that are not used in these scenarios it can cause an 
+infinite loop in planning.  
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The name of the table
+
diff --git a/website/source/docs/providers/aws/r/ebs_volume.html.md b/website/source/docs/providers/aws/r/ebs_volume.html.md
index 0cc75c7b8..00bb639a6 100644
--- a/website/source/docs/providers/aws/r/ebs_volume.html.md
+++ b/website/source/docs/providers/aws/r/ebs_volume.html.md
@@ -3,7 +3,7 @@ layout: "aws"
 page_title: "AWS: aws_ebs_volume"
 sidebar_current: "docs-aws-resource-ebs-volume"
 description: |-
-  Provides an Elastic IP resource.
+  Provides an elastic block storage resource.
 ---
 
 # aws\_ebs\_volume
@@ -16,6 +16,9 @@ Manages a single EBS volume.
 resource "aws_ebs_volume" "example" {
     availability_zone = "us-west-1a"
     size = 40
+    tags {
+        Name = "HelloWorld"
+    }
 }
 ```
 
@@ -27,6 +30,15 @@ The following arguments are supported:
 * `encrypted` - (Optional) If true, the disk will be encrypted.
 * `iops` - (Optional) The amount of IOPS to provision for the disk.
 * `size` - (Optional) The size of the drive in GB.
-* `snapshot_id` (Optinal) A snapshot to base the EBS volume off of.
+* `snapshot_id` (Optional) A snapshot to base the EBS volume off of.
 * `type` - (Optional) The type of EBS volume.
 * `kms_key_id` - (Optional) The KMS key ID for the volume.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The volume ID (e.g. vol-59fcb34e).
+
+
diff --git a/website/source/docs/providers/aws/r/ecs_cluster.html.markdown b/website/source/docs/providers/aws/r/ecs_cluster.html.markdown
new file mode 100644
index 000000000..d00e05fab
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_cluster.html.markdown
@@ -0,0 +1,32 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+sidebar_current: "docs-aws-resource-ecs-cluster"
+description: |-
+  Provides an ECS cluster.
+---
+
+# aws\_ecs\_cluster
+
+Provides an ECS cluster.
+
+## Example Usage
+
+```
+resource "aws_ecs_cluster" "foo" {
+  name = "white-hart"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `name` - The name of the cluster
+* `id` - The Amazon Resource Name (ARN) that identifies the cluster
diff --git a/website/source/docs/providers/aws/r/ecs_service.html.markdown b/website/source/docs/providers/aws/r/ecs_service.html.markdown
new file mode 100644
index 000000000..1a2d8fd9c
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_service.html.markdown
@@ -0,0 +1,59 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+sidebar_current: "docs-aws-resource-ecs-service"
+description: |-
+  Provides an ECS service.
+---
+
+# aws\_ecs\_service
+
+Provides an ECS service - effectively a task that is expected to run until an error occures or user terminates it (typically a webserver or a database). 
+
+See [ECS Services section in AWS developer guide](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html).
+
+## Example Usage
+
+```
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.foo.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 3
+  iam_role = "${aws_iam_role.foo.arn}"
+
+  load_balancer {
+    elb_name = "${aws_elb.foo.id}"
+    container_name = "mongo"
+    container_port = 8080
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the service (up to 255 letters, numbers, hyphens, and underscores)
+* `task_definition` - (Required) The family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service.
+* `desired_count` - (Required) The number of instances of the task definition to place and keep running
+* `cluster` - (Optional) ARN of an ECS cluster
+* `iam_role` - (Optional) IAM role that allows your Amazon ECS container agent to make calls to your load balancer on your behalf. This parameter is only required if you are using a load balancer with your service.
+* `load_balancer` - (Optional) A load balancer block. Load balancers documented below.
+
+Load balancers support the following:
+
+* `elb_name` - (Required) The name of the load balancer.
+* `container_name` - (Required) The name of the container to associate with the load balancer (as it appears in a container definition).
+* `container_port` - (Required) The port on the container to associate with the load balancer.
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the service
+* `name` - The name of the service
+* `cluster` - The Amazon Resource Name (ARN) of cluster which the service runs on
+* `iam_role` - The ARN of IAM role used for ELB
+* `desired_count` - The number of instances of the task definition
diff --git a/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown b/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown
new file mode 100644
index 000000000..3c761aa62
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown
@@ -0,0 +1,68 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+sidebar_current: "docs-aws-resource-ecs-task-definition"
+description: |-
+  Provides an ECS task definition.
+---
+
+# aws\_ecs\_task\_definition
+
+Provides an ECS task definition to be used in `aws_ecs_service`.
+
+## Example Usage
+
+```
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = "${file("task-definitions/jenkins.json")}"
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+```
+
+### task-definitions/jenkins.json
+
+The below would be passed into the `container_definitions` attribute. This is a small subset of the available parameters, see the [AWS docs](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) for a full list.
+
+```
+[
+  {
+    "name": "jenkins",
+    "image": "jenkins",
+    "cpu": 10,
+    "memory": 500,
+    "essential": true,
+    "portMappings": [
+      {
+        "containerPort": 80,
+        "hostPort": 80
+      }
+    ]
+  }
+]
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `family` - (Required) The family, unique name for your task definition.
+* `container_definitions` - (Required) A list of container definitions in JSON format. See [AWS docs](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-task-definition.html) for syntax. Note, you only need the containerDefinitions array, not the parent hash including the family and volumes keys.
+* `volume` - (Optional) A volume block. Volumes documented below.
+
+Volumes support the following:
+
+* `name` - (Required) The name of the volume. This name is referenced in the `sourceVolume` parameter of container definition `mountPoints`.
+* `host_path` - (Required) The path on the host container instance that is presented to the container.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `arn` - Full ARN of the task definition (including both `family` & `revision`)
+* `family` - The family of the task definition.
+* `revision` - The revision of the task in a particular family.
diff --git a/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown b/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
index 600c04c7e..953b78a9c 100644
--- a/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
@@ -1,14 +1,14 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_cluster"
 sidebar_current: "docs-aws-resource-elasticache-cluster"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Cluster resource.
 ---
 
 # aws\_elasticache\_cluster
 
-Provides an ElastiCache Cluster resource. 
+Provides an ElastiCache Cluster resource.
 
 ## Example Usage
 
@@ -17,6 +17,7 @@ resource "aws_elasticache_cluster" "bar" {
     cluster_id = "cluster-example"
     engine = "memcached"
     node_type = "cache.m1.small"
+    port = 11211
     num_cache_nodes = 1
     parameter_group_name = "default.memcached1.4"
 }
@@ -26,51 +27,60 @@ resource "aws_elasticache_cluster" "bar" {
 
 The following arguments are supported:
 
-* `cluster_id` – (Required) Group identifier. This parameter is stored as a 
+* `cluster_id` – (Required) Group identifier. This parameter is stored as a
 lowercase string
 
 * `engine` – (Required) Name of the cache engine to be used for this cache cluster.
  Valid values for this parameter are `memcached` or `redis`
 
 * `engine_version` – (Optional) Version number of the cache engine to be used.
-See [Selecting a Cache Engine and Version](http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/SelectEngine.html) 
-in the AWS Documentation center for supported versions 
+See [Selecting a Cache Engine and Version](http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/SelectEngine.html)
+in the AWS Documentation center for supported versions
 
-* `node_type` – (Required) The compute and memory capacity of the nodes. See 
+* `maintenance_window` – (Optional) Specifies the weekly time range which maintenance 
+on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). 
+The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`
+
+* `node_type` – (Required) The compute and memory capacity of the nodes. See
 [Available Cache Node Types](http://aws.amazon.com/elasticache/details#Available_Cache_Node_Types) for
 supported node types
 
-* `num_cache_nodes` – (Required) The initial number of cache nodes that the 
+* `num_cache_nodes` – (Required) The initial number of cache nodes that the
 cache cluster will have. For Redis, this value must be 1. For Memcache, this
 value must be between 1 and 20
 
-* `parameter_group_name` – (Optional) Name of the parameter group to associate 
+* `parameter_group_name` – (Required) Name of the parameter group to associate
 with this cache cluster
 
-* `port` – (Optional) The port number on which each of the cache nodes will 
-accept connections. Default 11211.
+* `port` – (Required) The port number on which each of the cache nodes will
+accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
 
-* `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used 
+* `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used
 for the cache cluster.
 
-* `security_group_names` – (Optional, EC2 Classic only) List of security group 
+* `security_group_names` – (Optional, EC2 Classic only) List of security group
 names to associate with this cache cluster
 
-* `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated 
+* `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated
  with the cache cluster
 
+* `apply_immediately` - (Optional) Specifies whether any database modifications
+     are applied immediately, or during the next maintenance window. Default is
+     `false`. See [Amazon ElastiCache Documentation for more information.][1]
+     (Available since v0.6.0)
+
+* `snapshot_arns` – (Optional) A single-element string list containing an 
+Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. 
+Example: `arn:aws:s3:::my_bucket/snapshot1.rdb`
+
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
 
 ## Attributes Reference
 
 The following attributes are exported:
 
-* `cluster_id` 
-* `engine` 
-* `engine_version`
-* `node_type`
-* `num_cache_nodes`
-* `parameter_group_name`
-* `port` 
-* `subnet_group_name`
-* `security_group_names`
-* `security_group_ids`
+* `cache_nodes` - List of node objects including `id`, `address` and `port`.
+   Referenceable e.g. as `${aws_elasticache_cluster.bar.cache_nodes.0.address}`
+
+[1]: http://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html
diff --git a/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown
new file mode 100644
index 000000000..f7cf29340
--- /dev/null
+++ b/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown
@@ -0,0 +1,49 @@
+---
+layout: "aws"
+page_title: "AWS: aws_elasticache_parameter_group"
+sidebar_current: "docs-aws-resource-elasticache-parameter-group"
+---
+
+# aws\_elasticache\_parameter\_group
+
+Provides an ElastiCache parameter group resource.
+
+## Example Usage
+
+```
+resource "aws_elasticache_parameter_group" "default" {
+    name = "cache-params"
+    family = "redis2.8"
+    description = "Cache cluster default param group"
+
+    parameter {
+        name = "activerehashing"
+        value = "yes"
+    }
+
+    parameter {
+        name = "min-slaves-to-write"
+        value = "2"
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the ElastiCache parameter group.
+* `family` - (Required) The family of the ElastiCache parameter group.
+* `description` - (Required) The description of the ElastiCache parameter group.
+* `parameter` - (Optional) A list of ElastiCache parameters to apply.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the ElastiCache parameter.
+* `value` - (Required) The value of the ElastiCache parameter.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ElastiCache parameter group name.
diff --git a/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
index 15370140b..be5e0c877 100644
--- a/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
@@ -1,9 +1,9 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_security_group"
 sidebar_current: "docs-aws-resource-elasticache-security-group"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Security Group to control access to one or more cache clusters.
 ---
 
 # aws\_elasticache\_security\_<wbr>group
diff --git a/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
index ad80e5a29..213987de5 100644
--- a/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
@@ -1,9 +1,9 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_subnet_group"
 sidebar_current: "docs-aws-resource-elasticache-subnet-group"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Subnet Group resource.
 ---
 
 # aws\_elasticache\_subnet\_group
@@ -47,7 +47,7 @@ The following arguments are supported:
 * `description` – (Required) Description for the cache subnet group
 * `name` – (Required) Name for the cache subnet group. This value is stored as 
 a lowercase string
-* `subnet_ids` – (Optional) List of VPC Subnet IDs for the cache subnet group
+* `subnet_ids` – (Required) List of VPC Subnet IDs for the cache subnet group
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/elb.html.markdown b/website/source/docs/providers/aws/r/elb.html.markdown
index 1f4a0b507..9c63788d3 100644
--- a/website/source/docs/providers/aws/r/elb.html.markdown
+++ b/website/source/docs/providers/aws/r/elb.html.markdown
@@ -46,6 +46,10 @@ resource "aws_elb" "bar" {
   idle_timeout = 400
   connection_draining = true
   connection_draining_timeout = 400
+
+  tags {
+    Name = "foobar-terraform-elb"
+  }
 }
 ```
 
@@ -65,6 +69,7 @@ The following arguments are supported:
 * `idle_timeout` - (Optional) The time in seconds that the connection is allowed to be idle. Default: 60.
 * `connection_draining` - (Optional) Boolean to enable connection draining.
 * `connection_draining_timeout` - (Optional) The time in seconds to allow for connections to drain. 
+* `tags` - (Optional) A mapping of tags to assign to the resource.
 
 Exactly one of `availability_zones` or `subnets` must be specified: this
 determines if the ELB exists in a VPC or in EC2-classic.
diff --git a/website/source/docs/providers/aws/r/flow_log.html.markdown b/website/source/docs/providers/aws/r/flow_log.html.markdown
new file mode 100644
index 000000000..0de997c3d
--- /dev/null
+++ b/website/source/docs/providers/aws/r/flow_log.html.markdown
@@ -0,0 +1,84 @@
+---
+layout: "aws"
+page_title: "AWS: aws_flow_log"
+sidebar_current: "docs-aws-resource-flow-log"
+description: |-
+  Provides a VPC/Subnet/ENI Flow Log
+---
+
+# aws\_flow\_log
+
+Provides a VPC/Subnet/ENI Flow Log to capture IP traffic for a specific network
+interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group.
+
+```
+resource "aws_flow_log" "test_flow_log" {
+  # log_group_name needs to exist before hand
+  # until we have a CloudWatch Log Group Resource
+  log_group_name = "tf-test-log-group"
+	iam_role_arn = "${aws_iam_role.test_role.arn}"
+  vpc_id = "${aws_vpc.default.id}"
+  traffic_type = "ALL"
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "vpc-flow-logs.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+} 
+EOF
+}
+
+resource "aws_iam_role_policy" "test_policy" {
+    name = "test_policy"
+    role = "${aws_iam_role.test_role.id}"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}   
+EOF
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `log_group_name` - (Required) The name of the CloudWatch log group
+* `iam_role_arn` - (Required) The ARN for the IAM role that's used to post flow
+  logs to a CloudWatch Logs log group
+* `vpc_id` - (Optional) VPC ID to attach to
+* `subnet_id` - (Optional) Subnet ID to attach to
+* `eni_id` - (Optional) Elastic Network Interface ID to attach to
+* `traffic_type` - (Required) The type of traffic to capture. Valid values:
+  `ACCEPT`,`REJECT`, `ALL`
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Flow Log ID
diff --git a/website/source/docs/providers/aws/r/iam_access_key.html.markdown b/website/source/docs/providers/aws/r/iam_access_key.html.markdown
index 0040c260c..c3baeb998 100644
--- a/website/source/docs/providers/aws/r/iam_access_key.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_access_key.html.markdown
@@ -13,16 +13,15 @@ Provides an IAM access key. This is a set of credentials that allow API requests
 ## Example Usage
 
 ```
+resource "aws_iam_access_key" "lb" {
+    user = "${aws_iam_user.lb.name}"
+}
+
 resource "aws_iam_user" "lb" {
     name = "loadbalancer"
     path = "/system/"
 }
 
-resource "aws_iam_access_key" "lb" {
-    user = "${aws_iam_user.lb.name}"
-    status = "Active"
-}
-
 resource "aws_iam_user_policy" "lb_ro" {
     name = "test"
     user = "${aws_iam_user.lb.name}"
diff --git a/website/source/docs/providers/aws/r/iam_group_membership.html.markdown b/website/source/docs/providers/aws/r/iam_group_membership.html.markdown
new file mode 100644
index 000000000..cdc5715af
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_group_membership.html.markdown
@@ -0,0 +1,56 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_group_membership"
+sidebar_current: "docs-aws-resource-iam-group-membership"
+description: |-
+  Provides a top level resource to manage IAM Group membership for IAM Users.
+---
+
+# aws\_iam\_group\_membership
+
+Provides a top level resource to manage IAM Group membership for IAM Users. For
+more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or
+[IAM Users][2]
+
+## Example Usage
+
+```
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = [
+		"${aws_iam_user.user_one.name}",
+		"${aws_iam_user.user_two.name}",
+	]
+	group = "${aws_iam_group.group.name}"
+}
+
+resource "aws_iam_group" "group" {
+	name = "test-group"
+}
+
+resource "aws_iam_user" "user_one" {
+	name = "test-user"
+}
+
+resource "aws_iam_user" "user_two" {
+	name = "test-user-two"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name to identify the Group Membership
+* `users` - (Required) A list of IAM User names to associate with the Group
+* `group` – (Required) The IAM Group name to attach the list of `users` to
+
+## Attributes Reference
+
+* `name` - The name to identifing the Group Membership
+* `users` - list of IAM User names 
+* `group` – IAM Group name 
+
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
diff --git a/website/source/docs/providers/aws/r/iam_group_policy.html.markdown b/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
index 18603a662..f5efa8619 100644
--- a/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
@@ -13,12 +13,7 @@ Provides an IAM policy attached to a group.
 ## Example Usage
 
 ```
-resource "aws_iam_group" "my_developers" {
-    name = "developers"
-    path = "/users/"
-}
-
-resource "iam_group_policy" "my_developer_policy" {
+resource "aws_iam_group_policy" "my_developer_policy" {
     name = "my_developer_policy"
     group = "${aws_iam_group.my_developers.id}"
     policy = <<EOF
@@ -36,6 +31,11 @@ resource "iam_group_policy" "my_developer_policy" {
 }
 EOF
 }
+
+resource "aws_iam_group" "my_developers" {
+    name = "developers"
+    path = "/users/"
+}
 ```
 
 ## Argument Reference
@@ -43,9 +43,9 @@ EOF
 The following arguments are supported:
 
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `name` - (Required) Name of the policy.
-* `user` - (Required) The IAM group to attach to the policy.
+* `group` - (Required) The IAM group to attach to the policy.
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown b/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
index 79d4e32ed..c09ff6dc8 100644
--- a/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
@@ -13,29 +13,28 @@ Provides an IAM instance profile.
 ## Example Usage
 
 ```
-resource "aws_iam_role" "role" {
-    name = "test_role"
-    path = "/"
-    policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-
 resource "aws_iam_instance_profile" "test_profile" {
     name = "test_profile"
     roles = ["${aws_iam_role.role.name}"]
 }
+
+resource "aws_iam_role" "role" {
+    name = "test_role"
+    path = "/"
+    assume_role_policy = <<EOF
+{
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {"AWS": "*"},
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
 ```
 
 ## Argument Reference
diff --git a/website/source/docs/providers/aws/r/iam_policy.html.markdown b/website/source/docs/providers/aws/r/iam_policy.html.markdown
index db8affeff..aea36b66e 100644
--- a/website/source/docs/providers/aws/r/iam_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_policy.html.markdown
@@ -39,7 +39,7 @@ The following arguments are supported:
 * `description` - (Optional) Description of the IAM policy.
 * `path` - (Optional, default "/") Path in which to create the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `name` (Required) - The name of the policy.
 
 ## Attributes Reference
diff --git a/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown b/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown
new file mode 100644
index 000000000..00099316f
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown
@@ -0,0 +1,54 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_policy_attachment"
+sidebar_current: "docs-aws-resource-iam-policy-attachment"
+description: |-
+  Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+---
+
+# aws\_iam\_policy\_attachment
+
+Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+
+```
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = 	#omitted
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = ["${aws_iam_user.user.name}"]
+    roles = ["${aws_iam_role.role.name}"]
+    groups = ["${aws_iam_group.group.name}"]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` 		(Required) - The name of the policy.
+* `users`		(Optional) - The user(s) the policy should be applied to
+* `roles`		(Optional) - The role(s) the policy should be applied to
+* `groups`		(Optional) - The group(s) the policy should be applied to
+* `policy_arn`	(Required) - The ARN of the policy you want to apply
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The policy's ID.
+* `name` - The name of the policy.
diff --git a/website/source/docs/providers/aws/r/iam_role.html.markdown b/website/source/docs/providers/aws/r/iam_role.html.markdown
new file mode 100644
index 000000000..d7292a9a7
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_role.html.markdown
@@ -0,0 +1,48 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+sidebar_current: "docs-aws-resource-iam-role"
+description: |-
+  Provides an IAM role.
+---
+
+# aws\_iam\_role
+
+Provides an IAM role.
+
+## Example Usage
+
+```
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the role.
+* `assume_role_policy` - (Required) The policy that grants an entity permission to assume the role.
+* `path` - (Optional) The path to the role.
+  See [IAM Identifiers](http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+
+## Attributes Reference
+
+* `arn` - The Amazon Resource Name (ARN) specifying the role.
+* `unique_id` - The stable and unique string identifying the role.
diff --git a/website/source/docs/providers/aws/r/iam_role_policy.html.markdown b/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
index 60f439775..a9418632e 100644
--- a/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
@@ -13,6 +13,24 @@ Provides an IAM role policy.
 ## Example Usage
 
 ```
+resource "aws_iam_role_policy" "test_policy" {
+    name = "test_policy"
+    role = "${aws_iam_role.test_role.id}"
+    policy = <<EOF
+{
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {"AWS": "*"},
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
+
 resource "aws_iam_role" "test_role" {
     name = "test_role"
     assume_role_policy = <<EOF
@@ -31,23 +49,6 @@ resource "aws_iam_role" "test_role" {
 }
 EOF
 }
-
-resource "aws_iam_role_policy" "test_policy" {
-    name = "test_policy"
-    role = "${aws_iam_role.test_role.id}"
-    policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
 ```
 
 ## Argument Reference
@@ -56,7 +57,7 @@ The following arguments are supported:
 
 * `name` - (Required) The name of the role policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `role` - (Required) The IAM role to attach to the policy.
 
 ## Attributes Reference
diff --git a/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown b/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown
new file mode 100644
index 000000000..820bc6f89
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown
@@ -0,0 +1,102 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+sidebar_current: "docs-aws-resource-iam-server-certificate"
+description: |-
+  Provides an IAM Server Certificate
+---
+
+# aws\_iam\_server\_certificate
+
+Provides an IAM Server Certificate resource to upload Server Certificates.
+Certs uploaded to IAM can easily work with other AWS services such as:
+
+- AWS Elastic Beanstalk
+- Elastic Load Balancing
+- CloudFront
+- AWS OpsWorks
+
+For information about server certificates in IAM, see [Managing Server
+Certficates][2] in AWS Documentation.
+
+## Example Usage
+
+**Using certs on file:**
+
+```
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "some_test_cert"
+  certificate_body = "${file("self-ca-cert.pem")}"
+  private_key = "${file("test-key.pem")}"
+}
+```
+
+**Example with cert in-line:**
+
+```
+resource "aws_iam_server_certificate" "test_cert_alt" {
+  name = "alt_test_cert"
+  certificate_body = <<EOF
+-----BEGIN CERTIFICATE-----
+[......] # cert contents
+-----END CERTIFICATE-----
+EOF
+
+  private_key =  <<EOF
+-----BEGIN RSA PRIVATE KEY-----
+[......] # cert contents
+-----END CERTIFICATE-----
+EOF
+}
+```
+
+**Use in combination with an AWS ELB resource:**
+
+```
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "some_test_cert"
+  certificate_body = "${file("self-ca-cert.pem")}"
+  private_key = "${file("test-key.pem")}"
+}
+
+resource "aws_elb" "ourapp" {
+  name = "terraform-asg-deployment-example"
+  availability_zones = ["us-west-2a"]
+  cross_zone_load_balancing = true
+
+  listener {
+    instance_port = 8000
+    instance_protocol = "http"
+    lb_port = 443
+    lb_protocol = "https"
+    ssl_certificate_id = "${aws_iam_server_certificate.test_cert.arn}"
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the Server Certificate. Do not include the 
+  path in this value.
+* `certificate_body` – (Required) The contents of the public key certificate in 
+  PEM-encoded format.
+* `certificate_chain` – (Optional) The contents of the certificate chain. 
+  This is typically a concatenation of the PEM-encoded public key certificates 
+  of the chain. 
+* `private_key` – (Required) The contents of the private key in PEM-encoded format.
+* `path` - (Optional) The IAM path for the server certificate.  If it is not 
+    included, it defaults to a slash (/). If this certificate is for use with
+    AWS CloudFront, the path must be in format `/cloudfront/your_path_here`.
+    See [IAM Identifiers][1] for more details on IAM Paths.
+
+## Attributes Reference
+
+* `id` - The unique Server Certificate name
+* `name` - The name of the Server Certificate
+* `arn` - The Amazon Resource Name (ARN) specifying the server certificate.
+
+
+[1]: http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html
+[2]: http://docs.aws.amazon.com/IAM/latest/UserGuide/ManagingServerCerts.html
diff --git a/website/source/docs/providers/aws/r/iam_user.html.markdown b/website/source/docs/providers/aws/r/iam_user.html.markdown
index 29c9eb871..a8b21c29a 100644
--- a/website/source/docs/providers/aws/r/iam_user.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_user.html.markdown
@@ -20,7 +20,6 @@ resource "aws_iam_user" "lb" {
 
 resource "aws_iam_access_key" "lb" {
     user = "${aws_iam_user.lb.name}"
-    status = "Active"
 }
 
 resource "aws_iam_user_policy" "lb_ro" {
diff --git a/website/source/docs/providers/aws/r/iam_user_policy.html.markdown b/website/source/docs/providers/aws/r/iam_user_policy.html.markdown
index f659588f8..762a6d390 100644
--- a/website/source/docs/providers/aws/r/iam_user_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_user_policy.html.markdown
@@ -13,16 +13,6 @@ Provides an IAM policy attached to a user.
 ## Example Usage
 
 ```
-resource "aws_iam_user" "lb" {
-    name = "loadbalancer"
-    path = "/system/"
-}
-
-resource "aws_iam_access_key" "lb" {
-    user = "${aws_iam_user.lb.name}"
-    status = "Active"
-}
-
 resource "aws_iam_user_policy" "lb_ro" {
     name = "test"
     user = "${aws_iam_user.lb.name}"
@@ -41,6 +31,15 @@ resource "aws_iam_user_policy" "lb_ro" {
 }
 EOF
 }
+
+resource "aws_iam_user" "lb" {
+    name = "loadbalancer"
+    path = "/system/"
+}
+
+resource "aws_iam_access_key" "lb" {
+    user = "${aws_iam_user.lb.name}"
+}
 ```
 
 ## Argument Reference
diff --git a/website/source/docs/providers/aws/r/instance.html.markdown b/website/source/docs/providers/aws/r/instance.html.markdown
index a03fce102..22cbe68cd 100644
--- a/website/source/docs/providers/aws/r/instance.html.markdown
+++ b/website/source/docs/providers/aws/r/instance.html.markdown
@@ -34,8 +34,11 @@ The following arguments are supported:
 * `placement_group` - (Optional) The Placement Group to start the instance in.
 * `ebs_optimized` - (Optional) If true, the launched EC2 instance will be
      EBS-optimized.
+* `disable_api_termination` - (Optional) If true, enables [EC2 Instance
+     Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination)
 * `instance_type` - (Required) The type of instance to start
 * `key_name` - (Optional) The key name to use for the instance.
+* `monitoring` - (Optional) If true, the launched EC2 instance will have detailed monitoring enabled. (Available since v0.6.0)
 * `security_groups` - (Optional) A list of security group names to associate with.
    If you are within a non-default VPC, you'll need to use `vpc_security_group_ids` instead.
 * `vpc_security_group_ids` - (Optional) A list of security group IDs to associate with.
@@ -93,7 +96,7 @@ Each `ebs_block_device` supports the following:
   on instance termination (Default: `true`).
 * `encrypted` - (Optional) Enables [EBS
   encryption](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)
-  on the volume (Default: `false`).
+  on the volume (Default: `false`). Cannot be used with `snapshot_id`.
 
 Modifying any `ebs_block_device` currently requires resource replacement.
 
diff --git a/website/source/docs/providers/aws/r/kinesis_stream.html.markdown b/website/source/docs/providers/aws/r/kinesis_stream.html.markdown
new file mode 100644
index 000000000..a667bb427
--- /dev/null
+++ b/website/source/docs/providers/aws/r/kinesis_stream.html.markdown
@@ -0,0 +1,44 @@
+---
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+sidebar_current: "docs-aws-resource-kinesis-stream"
+description: |-
+  Provides a AWS Kinesis Stream
+---
+
+# aws\_kinesis\_stream
+
+Provides a Kinesis Stream resource. Amazon Kinesis is a managed service that 
+scales elastically for real-time processing of streaming big data.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```
+resource "aws_kinesis_stream" "test_stream" {
+	name = "terraform-kinesis-test"
+	shard_count = 1
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) A name to identify the stream. This is unique to the 
+AWS account and region the Stream is created in.
+* `shard_count` – (Required) The number of shards that the stream will use.
+Amazon has guidlines for specifying the Stream size that should be referenced 
+when creating a Kinesis stream. See [Amazon Kinesis Streams][2] for more.
+
+## Attributes Reference
+
+* `id` - The unique Stream id
+* `name` - The unique Stream name (same as `id`)
+* `shard_count` - The count of Shards for this Stream
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream
+
+
+[1]: http://aws.amazon.com/documentation/kinesis/
+[2]: http://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html
diff --git a/website/source/docs/providers/aws/r/lambda_function.html.markdown b/website/source/docs/providers/aws/r/lambda_function.html.markdown
new file mode 100644
index 000000000..4c931fbad
--- /dev/null
+++ b/website/source/docs/providers/aws/r/lambda_function.html.markdown
@@ -0,0 +1,66 @@
+---
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+sidebar_current: "docs-aws-resource-aws-lambda-function"
+description: |-
+  Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS. The Lambda Function itself includes source code and runtime configuration.
+---
+
+# aws\_lambda\_function
+
+Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS. The Lambda Function itself includes source code and runtime configuration.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+
+## Example Usage
+
+```
+resource "aws_iam_role" "iam_for_lambda" {
+    name = "iam_for_lambda"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_lambda_function" "test_lambda" {
+    filename = "lambda_function_payload.zip"
+    function_name = "lambda_function_name"
+    role = "${aws_iam_role.iam_for_lambda.arn}"
+    handler = "exports.test"
+}
+```
+
+## Argument Reference
+
+* `filename` - (Required) A [zip file][2] containing your lambda function source code.
+* `function_name` - (Required) A unique name for your Lambda Function.
+* `handler` - (Required) The function [entrypoint][3] in your code.
+* `role` - (Required) IAM role attached to the Lambda Function. This governs both who / what can invoke your Lambda Function, as well as what resources our Lambda Function has access to. See [Lambda Permission Model][4] for more details.
+* `description` - (Optional) Description of what your Lambda Function does.
+* `memory_size` - (Optional) Amount of memory in MB your Lambda Function can use at runtime. Defaults to `128`. See [Limits][5]
+* `runtime` - (Optional) Defaults to `nodejs`.
+* `timeout` - (Optional) The amount of time your Lambda Function has to run in seconds. Defaults to `3`. See [Limits][5]
+
+## Attributes Reference
+
+* `arn` - The Amazon Resource Name (ARN) identifying your Lambda Function.
+* `last_modified` - The date this resource was last modified.
+
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/walkthrough-s3-events-adminuser-create-test-function-create-function.html
+[3]: http://docs.aws.amazon.com/lambda/latest/dg/walkthrough-custom-events-create-test-function.html
+[4]: http://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
+[5]: http://docs.aws.amazon.com/lambda/latest/dg/limits.html
diff --git a/website/source/docs/providers/aws/r/launch_config.html.markdown b/website/source/docs/providers/aws/r/launch_configuration.html.markdown
similarity index 92%
rename from website/source/docs/providers/aws/r/launch_config.html.markdown
rename to website/source/docs/providers/aws/r/launch_configuration.html.markdown
index 67954017a..ccd77235a 100644
--- a/website/source/docs/providers/aws/r/launch_config.html.markdown
+++ b/website/source/docs/providers/aws/r/launch_configuration.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_launch_configuration"
-sidebar_current: "docs-aws-resource-launch-config"
+sidebar_current: "docs-aws-resource-launch-configuration"
 description: |-
   Provides a resource to create a new launch configuration, used for autoscaling groups.
 ---
@@ -34,6 +34,8 @@ The following arguments are supported:
 * `security_groups` - (Optional) A list of associated security group IDS.
 * `associate_public_ip_address` - (Optional) Associate a public ip address with an instance in a VPC.
 * `user_data` - (Optional) The user data to provide when launching the instance.
+* `enable_monitoring` - (Optional) Enables/disables detailed monitoring. This is enabled by default.
+* `ebs_optimized` - (Optional) If true, the launched EC2 instance will be EBS-optimized.
 * `block_device_mapping` - (Optional) A list of block devices to add. Their keys are documented below.
 
 <a id="block-devices"></a>
@@ -60,7 +62,7 @@ replacement.
 
 Each `ebs_block_device` supports the following:
 
-* `device_name` - The name of the device to mount.
+* `device_name` - (Required) The name of the device to mount.
 * `snapshot_id` - (Optional) The Snapshot ID to mount.
 * `volume_type` - (Optional) The type of volume. Can be `"standard"`, `"gp2"`,
   or `"io1"`. (Default: `"standard"`).
diff --git a/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown b/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
index ea3e0f63e..bb4ad524e 100644
--- a/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
@@ -26,7 +26,7 @@ resource "aws_elb" "lb" {
 
 resource "aws_lb_cookie_stickiness_policy" "foo" {
 	  name = "foo_policy"
-	  load_balancer = "${aws_elb.lb}"
+	  load_balancer = "${aws_elb.lb.id}"
 	  lb_port = 80
 	  cookie_expiration_period = 600
 }
diff --git a/website/source/docs/providers/aws/r/network_acl.html.markdown b/website/source/docs/providers/aws/r/network_acl.html.markdown
index 71b93fda3..1dc11e902 100644
--- a/website/source/docs/providers/aws/r/network_acl.html.markdown
+++ b/website/source/docs/providers/aws/r/network_acl.html.markdown
@@ -45,7 +45,9 @@ resource "aws_network_acl" "main" {
 The following arguments are supported:
 
 * `vpc_id` - (Required) The ID of the associated VPC.
-* `subnet_id` - (Optional) The ID of the associated subnet.
+* `subnet_ids` - (Optional) A list of Subnet IDs to apply the ACL to
+* `subnet_id` - (Optional, Deprecated) The ID of the associated Subnet. This
+attribute is deprecated, please use the `subnet_ids` attribute instead
 * `ingress` - (Optional) Specifies an ingress rule. Parameters defined below.
 * `egress` - (Optional) Specifies an egress rule. Parameters defined below.
 * `tags` - (Optional) A mapping of tags to assign to the resource.
@@ -60,6 +62,10 @@ Both `egress` and `ingress` support the following keys:
 protocol, you must specify a from and to port of 0.
 * `cidr_block` - (Optional) The CIDR block to match. This must be a
 valid network mask.
+* `icmp_type` - (Optional) The ICMP type to be used. Default 0.
+* `icmp_code` - (Optional) The ICMP type code to be used. Default 0.
+
+~> Note: For more information on ICMP types and codes, see here: http://www.nthelp.com/icmp.html
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/network_interface.markdown b/website/source/docs/providers/aws/r/network_interface.markdown
new file mode 100644
index 000000000..8144d8f0f
--- /dev/null
+++ b/website/source/docs/providers/aws/r/network_interface.markdown
@@ -0,0 +1,51 @@
+---
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+sidebar_current: "docs-aws-resource-network-interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+# aws\_network\_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```
+resource "aws_network_interface" "test" {
+    subnet_id = "${aws_subnet.public_a.id}"
+	private_ips = ["10.0.0.50"]
+	security_groups = ["${aws_security_group.web.name}"]
+	attachment {
+		instance = "${aws_instance.test.id}"
+		device_index = 1
+	}
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `subnet_id` - (Required) Subnet ID to create the ENI in.
+* `private_ips` - (Optional) List of private IPs to assign to the ENI.
+* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
+* `attachment` - (Required) Block to define the attachment of the ENI. Documented below.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+The `attachment` block supports:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `device_index` - (Required) Integer to define the devices index.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `subnet_id` - Subnet ID the ENI is in.
+* `private_ips` - List of private IPs assigned to the ENI.
+* `security_groups` - List of security groups attached to the ENI.
+* `attachment` - Block defining the attachment of the ENI.
+* `tags` - Tags assigned to the ENI.
+
diff --git a/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown b/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown
new file mode 100644
index 000000000..907000077
--- /dev/null
+++ b/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown
@@ -0,0 +1,44 @@
+---
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+sidebar_current: "docs-aws-resource-route53-delegation-set"
+description: |-
+  Provides a Route53 Delegation Set resource.
+---
+
+# aws\_route53\_delegation_set
+
+Provides a [Route53 Delegation Set](http://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html) resource.
+
+## Example Usage
+
+```
+resource "aws_route53_delegation_set" "main" {
+    reference_name = "DynDNS"
+}
+
+resource "aws_route53_zone" "primary" {
+    name = "hashicorp.com"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+
+resource "aws_route53_zone" "secondary" {
+    name = "terraform.io"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `reference_name` - (Optional) This is a reference name used in Caller Reference
+  (helpful for identifying single delegation set amongst others)
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The delegation set ID
+* `name_servers` - A list of authoritative name servers for the hosted zone
+  (effectively a list of NS records).
diff --git a/website/source/docs/providers/aws/r/route53_health_check.html.markdown b/website/source/docs/providers/aws/r/route53_health_check.html.markdown
new file mode 100644
index 000000000..0f810784a
--- /dev/null
+++ b/website/source/docs/providers/aws/r/route53_health_check.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "aws"
+page_title: "AWS: aws_route53_health_check"
+sidebar_current: "docs-aws-resource-route53-health-check"
+description: |-
+  Provides a Route53 health check.
+---
+# aws\_route53\_health\_check
+
+Provides a Route53 health check.
+
+## Example Usage
+
+```
+resource "aws_route53_health_check" "foo" {
+  fqdn = "foobar.terraform.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "5"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `fqdn` - (Optional) The fully qualified domain name of the endpoint to be checked.
+* `ip_address` - (Optional) The IP address of the endpoint to be checked.
+* `failure_threshold` - (Required) The number of consecutive health checks that an endpoint must pass or fai.
+* `request_interval` - (Required) The number of seconds between the time that Amazon Route 53 gets a response from your endpoint and the time that it sends the next health-check request.
+* `resource_path` - (Optional) The path that you want Amazon Route 53 to request when performing health checks.
+* `search_string` - (Optional) String searched in respoonse body for check to considered healthy.
+* `tags` - (Optional) A mapping of tags to assign to the health check.
+
+Exactly one of `fqdn` or `ip_address` must be specified.
+
diff --git a/website/source/docs/providers/aws/r/route53_record.html.markdown b/website/source/docs/providers/aws/r/route53_record.html.markdown
index 8183258f3..e7455ba13 100644
--- a/website/source/docs/providers/aws/r/route53_record.html.markdown
+++ b/website/source/docs/providers/aws/r/route53_record.html.markdown
@@ -54,7 +54,7 @@ See [related part of AWS Route53 Developer Guide](http://docs.aws.amazon.com/Rou
 to understand differences between alias and non-alias records.
 
 TTL for all alias records is [60 seconds](http://aws.amazon.com/route53/faqs/#dns_failover_do_i_need_to_adjust),
-you cannot change this, therefore `ttl` has to be ommitted in alias records.
+you cannot change this, therefore `ttl` has to be omitted in alias records.
 
 ```
 resource "aws_elb" "main" {
@@ -89,12 +89,15 @@ The following arguments are supported:
 * `zone_id` - (Required) The ID of the hosted zone to contain this record.
 * `name` - (Required) The name of the record.
 * `type` - (Required) The record type.
-* `ttl` - (Required) The TTL of the record.
-* `records` - (Required) A string list of records.
+* `ttl` - (Required for non-alias records) The TTL of the record.
+* `records` - (Required for non-alias records) A string list of records.
 * `weight` - (Optional) The weight of weighted record (0-255).
 * `set_identifier` - (Optional) Unique identifier to differentiate weighted
-  record from one another. Required for each weighted record.
-* `alias` - (Optional) An alias block. Alias record documented below.
+record from one another. Required for each weighted record.
+* `failover` - (Optional) The routing behavior when associated health check fails. Must be PRIMARY or SECONDARY.
+* `health_check_id` - (Optional) The health check the record should be associated with.
+* `alias` - (Optional) An alias block. Conflicts with `ttl` & `records`.
+  Alias record documented below.
 
 Exactly one of `records` or `alias` must be specified: this determines whether it's an alias record.
 
diff --git a/website/source/docs/providers/aws/r/route53_zone.html.markdown b/website/source/docs/providers/aws/r/route53_zone.html.markdown
index 71c03a10e..2533a76c2 100644
--- a/website/source/docs/providers/aws/r/route53_zone.html.markdown
+++ b/website/source/docs/providers/aws/r/route53_zone.html.markdown
@@ -54,12 +54,16 @@ resource "aws_route53_record" "dev-ns" {
 The following arguments are supported:
 
 * `name` - (Required) This is the name of the hosted zone.
+* `comment` - (Optional) A comment for the hosted zone. Defaults to 'Managed by Terraform'.
 * `tags` - (Optional) A mapping of tags to assign to the zone.
+* `vpc_id` - (Optional) The VPC to associate with a private hosted zone. Specifying `vpc_id` will create a private hosted zone.
+* `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+* `delegation_set_id` - (Optional) The ID of the reusable delgation set whose NS records you want to assign to the hosted zone.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
 * `zone_id` - The Hosted Zone ID. This can be referenced by zone records.
-* `name_servers` - A list of name servers in a default delegation set.
+* `name_servers` - A list of name servers in associated (or default) delegation set.
   Find more about delegation sets in [AWS docs](http://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html).
diff --git a/website/source/docs/providers/aws/r/route53_zone_association.html.markdown b/website/source/docs/providers/aws/r/route53_zone_association.html.markdown
new file mode 100644
index 000000000..7275290af
--- /dev/null
+++ b/website/source/docs/providers/aws/r/route53_zone_association.html.markdown
@@ -0,0 +1,54 @@
+---
+layout: "aws"
+page_title: "AWS: aws_route53_zone_association"
+sidebar_current: "docs-aws-resource-route53-zone-association"
+description: |-
+  Provides a Route53 private Hosted Zone to VPC association resource.
+---
+
+# aws\_route53\_zone\_association
+
+Provides a Route53 private Hosted Zone to VPC association resource.
+
+## Example Usage
+
+```
+resource "aws_vpc" "primary" {
+  cidr_block = "10.6.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support = true
+}
+
+resource "aws_vpc" "secondary" {
+  cidr_block = "10.7.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support = true
+}
+
+resource "aws_route53_zone" "example" {
+  name = "example.com"
+  vpc_id = "${aws_vpc.primary.id}"
+}
+
+resource "aws_route53_zone_association" "secondary" {
+  zone_id = "${aws_route53_zone.example.id}"
+  vpc_id = "${aws_vpc.secondary.id}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `zone_id` - (Required) The private hosted zone to associate.
+* `vpc_id` - (Required) The VPC to associate with the private hosted zone.
+* `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The calculated unique identifier for the association.
+* `zone_id` - The ID of the hosted zone for the association.
+* `vpc_id` - The ID of the VPC for the association.
+* `vpc_region` - The region in which the VPC identified by `vpc_id` was created.
diff --git a/website/source/docs/providers/aws/r/route_table_assoc.html.markdown b/website/source/docs/providers/aws/r/route_table_association.html.markdown
similarity index 92%
rename from website/source/docs/providers/aws/r/route_table_assoc.html.markdown
rename to website/source/docs/providers/aws/r/route_table_association.html.markdown
index 712a1dd9c..d7ba450f1 100644
--- a/website/source/docs/providers/aws/r/route_table_assoc.html.markdown
+++ b/website/source/docs/providers/aws/r/route_table_association.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_route_table_association"
-sidebar_current: "docs-aws-resource-route-table-assoc"
+sidebar_current: "docs-aws-resource-route-table-association"
 description: |-
   Provides a resource to create an association between a subnet and routing table.
 ---
diff --git a/website/source/docs/providers/aws/r/s3_bucket.html.markdown b/website/source/docs/providers/aws/r/s3_bucket.html.markdown
index 204be87e0..4f367d4f8 100644
--- a/website/source/docs/providers/aws/r/s3_bucket.html.markdown
+++ b/website/source/docs/providers/aws/r/s3_bucket.html.markdown
@@ -32,6 +32,7 @@ resource "aws_s3_bucket" "b" {
 resource "aws_s3_bucket" "b" {
     bucket = "s3-website-test.hashicorp.com"
     acl = "public-read"
+    policy = "${file("policy.json")}"
 
     website {
         index_document = "index.html"
@@ -46,13 +47,17 @@ The following arguments are supported:
 
 * `bucket` - (Required) The name of the bucket.
 * `acl` - (Optional) The [canned ACL](http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Defaults to "private".
+* `policy` - (Optional) A valid [bucket policy](http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html) JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a `terraform plan`. In this case, please make sure you use the verbose/specific version of the policy.
+
 * `tags` - (Optional) A mapping of tags to assign to the bucket.
+* `force_destroy` - (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are *not* recoverable.
 * `website` - (Optional) A website object (documented below).
 
 The website object supports the following:
 
-* `index_document` - (Required) Amazon S3 returns this index document when requests are made to the root domain or any of the subfolders.
+* `index_document` - (Required, unless using `redirect_all_requests_to`) Amazon S3 returns this index document when requests are made to the root domain or any of the subfolders.
 * `error_document` - (Optional) An absolute path to the document to return in case of a 4XX error.
+* `redirect_all_requests_to` - (Optional) A hostname to redirect all website requests for this bucket to.
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/security_group.html.markdown b/website/source/docs/providers/aws/r/security_group.html.markdown
index 83757be39..ebd21bc73 100644
--- a/website/source/docs/providers/aws/r/security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/security_group.html.markdown
@@ -28,14 +28,14 @@ resource "aws_security_group" "allow_all" {
 
   ingress {
       from_port = 0
-      to_port = 65535
+      to_port = 0
       protocol = "-1"
       cidr_blocks = ["0.0.0.0/0"]
   }
 
   egress {
       from_port = 0
-      to_port = 65535
+      to_port = 0
       protocol = "-1"
       cidr_blocks = ["0.0.0.0/0"]
   }
@@ -112,7 +112,7 @@ be in place, you can use this `egress` block:
       from_port = 0
       to_port = 0
       protocol = "-1"
-      cidr_block = "0.0.0.0/0"
+      cidr_blocks = ["0.0.0.0/0"]
     }
 
 ## Attributes Reference
diff --git a/website/source/docs/providers/aws/r/security_group_rule.html.markdown b/website/source/docs/providers/aws/r/security_group_rule.html.markdown
index dbc0c1c72..b77286296 100644
--- a/website/source/docs/providers/aws/r/security_group_rule.html.markdown
+++ b/website/source/docs/providers/aws/r/security_group_rule.html.markdown
@@ -8,7 +8,7 @@ description: |-
 
 # aws\_security\_group\_rule
 
-Provides a security group rule resource. Represents a signle `ingress` or
+Provides a security group rule resource. Represents a single `ingress` or
 `egress` group rule, which can be added to external Security Groups.
 
 ~> **NOTE on Security Groups and Security Group Rules:** Terraform currently
@@ -44,7 +44,7 @@ or `egress` (outbound).
 * `cidr_blocks` - (Optional) List of CIDR blocks.
 * `from_port` - (Required) The start port.
 * `protocol` - (Required) The protocol.
-* `security_group_id` - (Required) The security group to apply this rule too.
+* `security_group_id` - (Required) The security group to apply this rule to.
 * `source_security_group_id` - (Optional) The security group id to allow access to/from,
      depending on the `type`.
 * `self` - (Optional) If true, the security group itself will be added as
diff --git a/website/source/docs/providers/aws/r/sns_topic.html.markdown b/website/source/docs/providers/aws/r/sns_topic.html.markdown
new file mode 100644
index 000000000..62a3c23f7
--- /dev/null
+++ b/website/source/docs/providers/aws/r/sns_topic.html.markdown
@@ -0,0 +1,35 @@
+---
+layout: "aws"
+page_title: "AWS: sns_topic"
+sidebar_current: "docs-aws-resource-sns-topic"
+description: |-
+  Provides an SNS topic resource.
+---
+
+# aws\_sns\_topic
+
+Provides an SNS topic resource
+
+## Example Usage
+
+```
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The friendly name for the SNS topic
+* `policy` - (Optional) The fully-formed AWS policy as JSON
+* `delivery_policy` - (Optional) The SNS delivery policy
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ARN of the SNS topic
+* `arn` - The ARN of the SNS topic, as a more obvious property (clone of id)
+
diff --git a/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown b/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown
new file mode 100644
index 000000000..f27644350
--- /dev/null
+++ b/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown
@@ -0,0 +1,93 @@
+---
+layout: "aws"
+page_title: "AWS: sns_topic_subscription"
+sidebar_current: "docs-aws-resource-sns-topic-subscription"
+description: |-
+  Provides a resource for subscribing to SNS topics.
+---
+
+# aws\_sns\_topic\_subscription
+
+  Provides a resource for subscribing to SNS topics. Requires that an SNS topic exist for the subscription to attach to.
+This resource allows you to automatically place messages sent to SNS topics in SQS queues, send them as HTTP(S) POST requests
+to a given endpoint, send SMS messages, or notify devices / applications. The most likely use case for Terraform users will
+probably be SQS queues.
+
+## Example Usage
+
+You can directly supply a topic and ARN by hand in the `topic_arn` property along with the queue ARN:
+
+```
+resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
+    topic_arn = "arn:aws:sns:us-west-2:432981146916:user-updates-topic"
+    protocol = "sqs"
+    endpoint = "arn:aws:sqs:us-west-2:432981146916:terraform-queue-too"
+}
+```
+
+Alternatively you can use the ARN properties of a managed SNS topic and SQS queue:
+
+```
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+
+resource "aws_sqs_queue" "user_updates_queue" {
+	name = "user-updates-queue"
+}
+
+resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
+    topic_arn = "${aws_sns_topic.user_updates.arn}"
+    protocol  = "sqs"
+    endpoint  = "${aws_sqs_queue.user_updates_queue.arn}"
+}
+```
+
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `topic_arn` - (Required) The ARN of the SNS topic to subscribe to
+* `protocol` - (Required) The protocol to use. The possible values for this are: `sqs`, `http`, `https`, `sms`, or `application`. (`email` is an option but unsupported, see below)
+* `endpoint` - (Required) The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
+* `raw_message_delivery` - (Optional) Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
+
+### Protocols supported
+
+Supported SNS protocols include:
+
+* `http` -- delivery of JSON-encoded message via HTTP POST
+* `https` -- delivery of JSON-encoded message via HTTPS POST
+* `sms` -- delivery of message via SMS
+* `sqs` -- delivery of JSON-encoded message to an Amazon SQS queue
+* `application` -- delivery of JSON-encoded message to an EndpointArn for a mobile app and device
+
+Unsupported protocols include the following:
+
+* `email` -- delivery of message via SMTP
+* `email-json` -- delivery of JSON-encoded message via SMTP
+
+These are unsupported because the email address needs to be authorized and does not generate an ARN until the target email address has been validated. This breaks
+the Terraform model and as a result are not currently supported.
+
+### Specifying endpoints
+
+Endpoints have different format requirements according to the protocol that is chosen.
+
+* HTTP/HTTPS endpoints will require a URL to POST data to
+* SMS endpoints are mobile numbers that are capable of receiving an SMS
+* SQS endpoints come in the form of the SQS queue's ARN (not the URL of the queue) e.g: `arn:aws:sqs:us-west-2:432981146916:terraform-queue-too`
+* Application endpoints are also the endpoint ARN for the mobile app and device.
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ARN of the subscription
+* `topic_arn` - The ARN of the topic the subscription belongs to
+* `protocol` - The protocol being used
+* `endpoint` - The full endpoint to send data to (SQS ARN, HTTP(S) URL, Application ARN, SMS number, etc.)
+* `arn` - The ARN of the subscription stored as a more user-friendly property
+
diff --git a/website/source/docs/providers/aws/r/spot_instance_request.html.markdown b/website/source/docs/providers/aws/r/spot_instance_request.html.markdown
new file mode 100644
index 000000000..abb1f4705
--- /dev/null
+++ b/website/source/docs/providers/aws/r/spot_instance_request.html.markdown
@@ -0,0 +1,71 @@
+---
+layout: "aws"
+page_title: "AWS: aws_spot_instance_request"
+sidebar_current: "docs-aws-resource-spot-instance-request"
+description: |-
+  Provides a Spot Instance Request resource.
+---
+
+# aws\_spot\_instance\_request
+
+Provides an EC2 Spot Instance Request resource. This allows instances to be
+requested on the spot market.
+
+Terraform always creates Spot Instance Requests with a `persistent` type, which
+means that for the duration of their lifetime, AWS will launch an instance
+with the configured details if and when the spot market will accept the
+requested price.
+
+On destruction, Terraform will make an attempt to terminate the associated Spot
+Instance if there is one present.
+
+~> **NOTE:** Because their behavior depends on the live status of the spot
+market, Spot Instance Requests have a unique lifecycle that makes them behave
+differently than other Terraform resources. Most importantly: there is __no
+guarantee__ that a Spot Instance exists to fulfill the request at any given
+point in time. See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information.
+
+
+## Example Usage
+
+```
+# Request a spot instance at $0.03
+resource "aws_spot_instance_request" "cheap_worker" {
+    ami = "ami-1234"
+    spot_price = "0.03"
+    instance_type = "c4.xlarge"
+    tags {
+        Name = "CheapWorker"
+    }
+}
+```
+
+## Argument Reference
+
+Spot Instance Requests support all the same arguments as
+[`aws_instance`](instance.html), with the addition of:
+
+* `spot_price` - (Required) The price to request on the spot market.
+* `wait_for_fulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Spot Instance Request ID.
+
+These attributes are exported, but they are expected to change over time and so
+should only be used for informational purposes, not for resource dependencies:
+
+* `spot_bid_status` - The current [bid
+  status](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html)
+  of the Spot Instance Request.
+* `spot_request_state` The current [request
+  state](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html#creating-spot-request-status)
+  of the Spot Instance Request.
+* `spot_instance_id` - The Instance ID (if any) that is currently fulfilling
+  the Spot Instance request.
diff --git a/website/source/docs/providers/aws/r/sqs_queue.html.markdown b/website/source/docs/providers/aws/r/sqs_queue.html.markdown
new file mode 100644
index 000000000..a3bf25c57
--- /dev/null
+++ b/website/source/docs/providers/aws/r/sqs_queue.html.markdown
@@ -0,0 +1,40 @@
+---
+layout: "aws"
+page_title: "AWS: aws_sqs_queue"
+sidebar_current: "docs-aws-resource-sqs"
+description: |-
+  Provides a SQS resource.
+---
+
+# aws\_sqs\_queue
+
+## Example Usage
+
+```
+resource "aws_sqs_queue" "terraform_queue" {
+  name = "terraform-example-queue"
+  delay_seconds = 90
+  max_message_size = 2048
+  message_retention_seconds = 86400
+  receive_wait_time_seconds = 10
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) This is the human-readable name of the queue
+* `visibility_timeout_seconds` - (Optional) The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes). The default for this attribute is 30 seconds
+* `message_retention_seconds` - (Optional) The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). The default for this attribute is 345600 (4 days).
+* `max_message_size` - (Optional) The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB).
+* `delay_seconds` - (Optional) The visibility timeout for the queue. An integer from 0 to 43200 (12 hours). The default for this attribute is 30. For more information about visibility timeout.
+* `receive_wait_time_seconds` - (Optional) The time for which a ReceiveMessage call will wait for a message to arrive (long polling) before returning. An integer from 0 to 20 (seconds). The default for this attribute is 0, meaning that the call will return immediately.
+* `policy` - (Optional) The JSON policy for the SQS queue
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The URL for the created Amazon SQS queue.
+* `arn` - The ARN of the SQS queue
diff --git a/website/source/docs/providers/aws/r/volume_attachment.html.markdown b/website/source/docs/providers/aws/r/volume_attachment.html.markdown
new file mode 100644
index 000000000..d3421dc8c
--- /dev/null
+++ b/website/source/docs/providers/aws/r/volume_attachment.html.markdown
@@ -0,0 +1,57 @@
+---
+layout: "aws"
+page_title: "AWS: aws_volume_attachment"
+sidebar_current: "docs-aws-resource-volume-attachment"
+description: |-
+  Provides an AWS EBS Volume Attachment
+---
+
+# aws\_volume\_attachment
+
+Provides an AWS EBS Volume Attachment as a top level resource, to attach and
+detach volumes from AWS Instances.
+
+## Example Usage
+
+```
+resource "aws_volume_attachment" "ebs_att" {
+  device_name = "/dev/sdh"
+  volume_id = "${aws_ebs_volume.example.id}"
+  instance_id = "${aws_instance.web.id}"
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-21f78e11"
+  availability_zone = "us-west-2a"
+  instance_type = "t1.micro"
+  tags {
+    Name = "HelloWorld"
+  }
+}
+
+resource "aws_ebs_volume" "example" {
+  availability_zone = "us-west-2a"
+  size = 1
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `device_name` - (Required) The device name to expose to the instance (for 
+example, `/dev/sdh` or `xvdh`)
+* `instance_id` - (Required) ID of the Instance to attach to
+* `volume_id` - (Required) ID of the Volume to be attached
+* `force_detach` - (Optional, Boolean) Set to `true` if you want to force the
+volume to detach. Useful if previous attempts failed, but use this option only 
+as a last resort, as this can result in **data loss**. See 
+[Detaching an Amazon EBS Volume from an Instance][1] for more information.
+
+## Attributes Reference
+
+* `device_name` - The device name exposed to the instance
+* `instance_id` - ID of the Instance
+* `volume_id` - ID of the Volume 
+
+[1]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html
diff --git a/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown b/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
index 3e595adcc..c2e05743f 100644
--- a/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
+++ b/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
@@ -59,8 +59,5 @@ The following attributes are exported:
 
 * `id` - The ID of the DHCP Options Set.
 
-## Known Issues
-* https://github.com/awslabs/aws-sdk-go/issues/210
-
 You can find more technical documentation about DHCP Options Set in the
 official [AWS User Guide](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html).
diff --git a/website/source/docs/providers/aws/r/vpc_endpoint.html.markdown b/website/source/docs/providers/aws/r/vpc_endpoint.html.markdown
new file mode 100644
index 000000000..813aba329
--- /dev/null
+++ b/website/source/docs/providers/aws/r/vpc_endpoint.html.markdown
@@ -0,0 +1,37 @@
+---
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint"
+sidebar_current: "docs-aws-resource-vpc-endpoint"
+description: |-
+  Provides a VPC Endpoint resource.
+---
+
+# aws\_vpc\_endpoint
+
+Provides a VPC Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "aws_vpc_endpoint" "private-s3" {
+    vpc_id = "${aws_vpc.main.id}"
+    service_name = "com.amazonaws.us-west-2.s3"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `vpc_id` - (Required) The ID of the VPC in which the endpoint will be used.
+* `service_name` - (Required) The AWS service name, in the form `com.amazonaws.region.service`.
+* `policy_document` - (Optional) A policy to attach to the endpoint that controls access to the service.
+* `route_table_ids` - (Optional) One or more route table IDs.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ID of the VPC endpoint.
diff --git a/website/source/docs/providers/aws/r/vpc_peering.html.markdown b/website/source/docs/providers/aws/r/vpc_peering.html.markdown
index 4e9720eff..cf3e16eb0 100644
--- a/website/source/docs/providers/aws/r/vpc_peering.html.markdown
+++ b/website/source/docs/providers/aws/r/vpc_peering.html.markdown
@@ -46,16 +46,16 @@ The following arguments are supported:
 * `peer_owner_id` - (Required) The AWS account ID of the owner of the peer VPC.
 * `peer_vpc_id` - (Required) The ID of the VPC with which you are creating the VPC peering connection.
 * `vpc_id` - (Required) The ID of the requester VPC.
-* `auto_accept` - (Optional) Accept the peering ( you need to be the owner of both vpc)
+* `auto_accept` - (Optional) Accept the peering (you need to be the owner of both VPCs).
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
-* `id` - The ID of the VPC Peering Connectiona
+* `id` - The ID of the VPC Peering Connections
 * `accept_status` - The Status of the VPC peering connection request.
 
 
 ## Notes
-You still have to accept the peering with the aws console, aws-cli or aws-sdk-go.
+You still have to accept the peering with the AWS Console, aws-cli or aws-sdk-go.
diff --git a/website/source/docs/providers/aws/r/vpn_connection.html.markdown b/website/source/docs/providers/aws/r/vpn_connection.html.markdown
index dd4a9ecea..ecfd197d2 100644
--- a/website/source/docs/providers/aws/r/vpn_connection.html.markdown
+++ b/website/source/docs/providers/aws/r/vpn_connection.html.markdown
@@ -46,7 +46,7 @@ The following arguments are supported:
 * `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
 * `vpn_gateway_id` - (Required) The ID of the virtual private gateway.
 
-## Attrubute Reference
+## Attribute Reference
 
 The following attributes are exported:
 
diff --git a/website/source/docs/providers/azure/index.html.markdown b/website/source/docs/providers/azure/index.html.markdown
new file mode 100644
index 000000000..eec8494a1
--- /dev/null
+++ b/website/source/docs/providers/azure/index.html.markdown
@@ -0,0 +1,59 @@
+---
+layout: "azure"
+page_title: "Provider: Azure"
+sidebar_current: "docs-azure-index"
+description: |-
+  The Azure provider is used to interact with the many resources supported by Azure. The provider needs to be configured with a publish settings file and optionally a subscription ID before it can be used.
+---
+
+# Azure Provider
+
+The Azure provider is used to interact with the many resources supported
+by Azure. The provider needs to be configured with a [publish settings
+file](https://manage.windowsazure.com/publishsettings) and optionally a
+subscription ID before it can be used.
+
+Use the navigation to the left to read about the available resources.
+
+## Example Usage
+
+```
+# Configure the Azure Provider
+provider "azure" {
+    settings_file = "${var.azure_settings_file}"
+}
+
+# Create a web server
+resource "azure_instance" "web" {
+    ...
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `settings_file` - (Optional) The path to a publish settings file used to
+  authenticate with the Azure API. You can download the settings file here:
+  https://manage.windowsazure.com/publishsettings. You must either provide
+  (or source from the `AZURE_SETTINGS_FILE` environment variable) a settings
+  file or both a `subscription_id` and `certificate`.
+
+* `subscription_id` - (Optional) The subscription ID to use. If a
+  `settings_file` is not provided `subscription_id` is required. It can also
+  be sourced from the `AZURE_SUBSCRIPTION_ID` environment variable.
+
+* `certificate` - (Optional) The certificate used to authenticate with the
+  Azure API. If a `settings_file` is not provided `certificate` is required.
+  It can also be sourced from the `AZURE_CERTIFICATE` environment variable.
+
+## Testing:
+
+The following environment variables must be set for the running of the
+acceptance test suite:
+
+* A valid combination of the above which are required for authentification.
+
+* `AZURE_STORAGE` - The name of a storage account to be used in tests which
+  require a storage backend. The storage account needs to be located in
+  the Western US Azure region.
diff --git a/website/source/docs/providers/azure/r/affinity_group.html.markdown b/website/source/docs/providers/azure/r/affinity_group.html.markdown
new file mode 100644
index 000000000..906f73070
--- /dev/null
+++ b/website/source/docs/providers/azure/r/affinity_group.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "azure"
+page_title: "Azure: azure_affinity_group"
+sidebar_current: "docs-azure-affinity-group"
+description: |-
+    Creates a new affinity group on Azure.
+---
+
+# azure\_affinity\_group
+
+Creates a new affinity group on Azure.
+
+## Example Usage
+
+```
+resource "azure_affinity_group" "terraform-main-group" {
+    name = "terraform-group"
+    location = "North Europe"
+    label = "tf-group-01"
+    description = "Affinity group created by Terraform."
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the affinity group. Must be unique on your
+    Azure subscription.
+
+* `location` - (Required) The location where the affinity group should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `label` - (Required) A label to be used for tracking purposes.
+
+* `description` - (Optional) A description for the affinity group.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The affinity group ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/data_disk.html.markdown b/website/source/docs/providers/azure/r/data_disk.html.markdown
new file mode 100644
index 000000000..5f0aad95b
--- /dev/null
+++ b/website/source/docs/providers/azure/r/data_disk.html.markdown
@@ -0,0 +1,70 @@
+---
+layout: "azure"
+page_title: "Azure: azure_data_disk"
+sidebar_current: "docs-azure-resource-data-disk"
+description: |-
+  Adds a data disk to a virtual machine. If the name of an existing disk is given, it will attach that disk. Otherwise it will create and attach a new empty disk.
+---
+
+# azure\_data\_disk
+
+Adds a data disk to a virtual machine. If the name of an existing disk is given,
+it will attach that disk. Otherwise it will create and attach a new empty disk.
+
+## Example Usage
+
+```
+resource "azure_data_disk" "data" {
+    lun = 0
+    size = 10
+    storage_service_name = "yourstorage"
+    virtual_machine = "server1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Optional) The name of an existing registered disk to attach to the
+    virtual machine. If left empty, a new empty disk will be created and
+    attached instead. Changing this forces a new resource to be created.
+
+* `label` - (Optional) The identifier of the data disk. Changing this forces a
+    new resource to be created (defaults to "virtual_machine-lun")
+
+* `lun` - (Required) The Logical Unit Number (LUN) for the disk. The LUN
+    specifies the slot in which the data drive appears when mounted for usage
+    by the virtual machine. Valid LUN values are 0 through 31.
+
+* `size` - (Optional) The size, in GB, of an empty disk to be attached to the
+    virtual machine. Required when creating a new disk, not used otherwise.
+
+* `caching` - (Optional) The caching behavior of data disk. Valid options are:
+    `None`, `ReadOnly` and `ReadWrite` (defaults `None`)
+
+* `storage_service_name` - (Optional) The name of an existing storage account
+    within the subscription which will be used to store the VHD of this disk.
+    Required if no value is supplied for `media_link`. Changing this forces
+    a new resource to be created.
+
+* `media_link` - (Optional) The location of the blob in storage where the VHD
+    of this disk will be created. The storage account where must be associated
+    with the subscription. Changing this forces a new resource to be created.
+
+* `source_media_link` - (Optional) The location of a blob in storage where a
+    VHD file is located that is imported and registered as a disk. If a value
+    is supplied, `media_link` will not be used.
+
+* `virtual_machine` - (Required) The name of the virtual machine the disk will
+    be attached to.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The security group ID.
+* `name` - The name of the disk.
+* `label` - The identifier for the disk.
+* `media_link` - The location of the blob in storage where the VHD of this disk
+    is created.
diff --git a/website/source/docs/providers/azure/r/dns_server.html.markdown b/website/source/docs/providers/azure/r/dns_server.html.markdown
new file mode 100644
index 000000000..d9f3567c2
--- /dev/null
+++ b/website/source/docs/providers/azure/r/dns_server.html.markdown
@@ -0,0 +1,36 @@
+---
+layout: "azure"
+page_title: "Azure: azure_dns_server"
+sidebar_current: "docs-azure-resource-dns-server"
+description: |-
+    Creates a new DNS server definition to be used internally in Azure.
+---
+
+# azure\_dns\_server
+
+Creates a new DNS server definition to be used internally in Azure.
+
+## Example Usage
+
+```
+resource "azure_dns_server" "google-dns" {
+    name = "google"
+    dns_address = "8.8.8.8"
+}
+`
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the DNS server reference. Changing this
+    forces a new resource to be created.
+
+* `dns_address` - (Required) The IP address of the DNS server.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The DNS server definition ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/hosted_service.html.markdown b/website/source/docs/providers/azure/r/hosted_service.html.markdown
new file mode 100644
index 000000000..56a946315
--- /dev/null
+++ b/website/source/docs/providers/azure/r/hosted_service.html.markdown
@@ -0,0 +1,50 @@
+---
+layout: "azure"
+page_title: "Azure: azure_hosted_service"
+sidebar_current: "docs-azure-hosted-service"
+description: |-
+    Creates a new hosted service on Azure with its own .cloudapp.net domain.
+---
+
+# azure\_hosted\_service
+
+Creates a new hosted service on Azure with its own .cloudapp.net domain.
+
+## Example Usage
+
+```
+resource "azure_hosted_service" "terraform-service" {
+    name = "terraform-service"
+    location = "North Europe"
+    ephemeral_contents = false
+    description = "Hosted service created by Terraform."
+    label = "tf-hs-01"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the hosted service. Must be unique on Azure.
+
+* `location` - (Required) The location where the hosted service should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `ephemeral_contents` - (Required) A boolean value (true|false), specifying
+    whether all the resources present in the hosted hosted service should be
+    destroyed following the hosted service's destruction.
+
+* `reverse_dns_fqdn` - (Optional) The reverse of the fully qualified domain name
+    for the hosted service.
+
+* `label` - (Optional) A label to be used for tracking purposes. Must be
+    non-void. Defaults to `Made by Terraform.`.
+
+* `description` - (Optional) A description for the hosted service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The hosted service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/instance.html.markdown b/website/source/docs/providers/azure/r/instance.html.markdown
new file mode 100644
index 000000000..6b9428762
--- /dev/null
+++ b/website/source/docs/providers/azure/r/instance.html.markdown
@@ -0,0 +1,133 @@
+---
+layout: "azure"
+page_title: "Azure: azure_instance"
+sidebar_current: "docs-azure-resource-instance"
+description: |-
+  Creates a hosted service, role and deployment and then creates a virtual machine in the deployment based on the specified configuration.
+---
+
+# azure\_instance
+
+Creates a hosted service, role and deployment and then creates a virtual
+machine in the deployment based on the specified configuration.
+
+## Example Usage
+
+```
+resource "azure_hosted_service" "terraform-service" {
+    name = "terraform-service"
+    location = "North Europe"
+    ephemeral_contents = false
+    description = "Hosted service created by Terraform."
+    label = "tf-hs-01"
+}
+
+resource "azure_instance" "web" {
+    name = "terraform-test"
+    hosted_service_name = "${azure_hosted_service.terraform-service.name}"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "yourstorage"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the instance. Changing this forces a new
+    resource to be created.
+
+* `hosted_service_name` - (Optional) The name of the hosted service the
+    instance should be deployed under. If not provided; it will default to the
+    value of `name`. Changes to this parameter forces the creation of a new
+    resource.
+
+* `description` - (Optional) The description for the associated hosted service.
+    Changing this forces a new resource to be created (defaults to the instance
+    name).
+
+* `image` - (Required) The name of an existing VM or OS image to use for this
+    instance. Changing this forces a new resource to be created.
+
+* `size` - (Required) The size of the instance.
+
+* `subnet` - (Optional) The name of the subnet to connect this instance to. If
+    a value is supplied `virtual_network` is required. Changing this forces a
+    new resource to be created.
+
+* `virtual_network` - (Optional) The name of the virtual network the `subnet`
+    belongs to. If a value is supplied `subnet` is required. Changing this
+    forces a new resource to be created.
+
+* `storage_service_name` - (Optional) The name of an existing storage account
+    within the subscription which will be used to store the VHDs of this
+    instance. Changing this forces a new resource to be created.
+
+* `reverse_dns` - (Optional) The DNS address to which the IP address of the
+    hosted service resolves when queried using a reverse DNS query. Changing
+    this forces a new resource to be created.
+
+* `location` - (Required) The location/region where the cloud service is
+    created. Changing this forces a new resource to be created.
+
+* `automatic_updates` - (Optional) If true this will enable automatic updates.
+    This attribute is only used when creating a Windows instance. Changing this
+    forces a new resource to be created (defaults false)
+
+* `time_zone` - (Optional) The appropriate time zone for this instance in the
+    format 'America/Los_Angeles'. This attribute is only used when creating a
+    Windows instance. Changing this forces a new resource to be created
+    (defaults false)
+
+* `username` - (Required) The username of a new user that will be created while
+    creating the instance. Changing this forces a new resource to be created.
+
+* `password` - (Optional) The password of the new user that will be created
+    while creating the instance. Required when creating a Windows instance or
+    when not supplying an `ssh_key_thumbprint` while creating a Linux instance.
+    Changing this forces a new resource to be created.
+
+* `ssh_key_thumbprint` - (Optional) The SSH thumbprint of an existing SSH key
+    within the subscription. This attribute is only used when creating a Linux
+    instance. Changing this forces a new resource to be created.
+
+* `security_group` - (Optional) The Network Security Group to associate with
+    this instance.
+
+* `endpoint` - (Optional) Can be specified multiple times to define multiple
+    endpoints. Each `endpoint` block supports fields documented below.
+
+The `endpoint` block supports:
+
+* `name` - (Required) The name of the external endpoint.
+
+* `protocol` - (Optional) The transport protocol for the endpoint. Valid
+    options are: `tcp` and `udp` (defaults `tcp`)
+
+* `public_port` - (Required) The external port to use for the endpoint.
+
+* `private_port` - (Required) The private port on which the instance is
+    listening.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The instance ID.
+* `description` - The description for the associated hosted service.
+* `subnet` - The subnet the instance is connected to.
+* `endpoint` - The complete set of configured endpoints.
+* `security_group` - The associated Network Security Group.
+* `ip_address` - The private IP address assigned to the instance.
+* `vip_address` - The public IP address assigned to the instance.
diff --git a/website/source/docs/providers/azure/r/local_network_connection.html.markdown b/website/source/docs/providers/azure/r/local_network_connection.html.markdown
new file mode 100644
index 000000000..53e758b3a
--- /dev/null
+++ b/website/source/docs/providers/azure/r/local_network_connection.html.markdown
@@ -0,0 +1,39 @@
+---
+layout: "azure"
+page_title: "Azure: azure_local_network_connection"
+sidebar_current: "docs-azure-resource-local-network-connection"
+description: |-
+  Defines a new connection to a remote network throguh a VPN tunnel.
+---
+
+# azure\_local\_network\_connection
+
+Defines a new connection to a remote network throguh a VPN tunnel.
+
+## Example Usage
+
+```
+resource "azure_local_network_connection" "localnet" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "45.12.189.2"
+    address_space_prefixes = ["10.10.10.0/24", "10.10.11.0/24"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name by which this local network connection will
+    be referenced by. Changing this forces a new resource to be created.
+
+* `vpn_gateway_address` - (Required) The public IPv4 of the VPN endpoint.
+
+* `address_space_prefixes` - (Required) List of address spaces accessible
+    through the VPN connection. The elements are in the CIDR format.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The local network connection ID.
diff --git a/website/source/docs/providers/azure/r/security_group.html.markdown b/website/source/docs/providers/azure/r/security_group.html.markdown
new file mode 100644
index 000000000..771923e5b
--- /dev/null
+++ b/website/source/docs/providers/azure/r/security_group.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "azure"
+page_title: "Azure: azure_security_group"
+sidebar_current: "docs-azure-resource-security-group"
+description: |-
+  Creates a new network security group within the context of the specified subscription.
+---
+
+# azure\_security\_group
+
+Creates a new network security group within the context of the specified
+subscription.
+
+## Example Usage
+
+```
+resource "azure_security_group" "web" {
+    name = "webservers"
+    location = "West US"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the security group. Changing this forces a
+    new resource to be created.
+
+* `label` - (Optional) The identifier for the security group. The label can be
+    up to 1024 characters long. Changing this forces a new resource to be
+    created (defaults to the security group name)
+
+* `location` - (Required) The location/region where the security group is
+    created. Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The security group ID.
+* `label` - The identifier for the security group.
diff --git a/website/source/docs/providers/azure/r/security_group_rule.html.markdown b/website/source/docs/providers/azure/r/security_group_rule.html.markdown
new file mode 100644
index 000000000..20a28ce9d
--- /dev/null
+++ b/website/source/docs/providers/azure/r/security_group_rule.html.markdown
@@ -0,0 +1,76 @@
+---
+layout: "azure"
+page_title: "Azure: azure_security_group_rule"
+sidebar_current: "docs-azure-resource-security-group-rule"
+description: |-
+  Creates a new network security rule to be associated with a given security group.
+---
+
+# azure\_security\_group\_rule
+
+Creates a new network security rule to be associated with a given security group.
+
+## Example Usage
+
+```
+resource "azure_security_group" "web" {
+    ...
+}
+
+resource "azure_security_group" "apps" {
+    ...
+}
+
+resource "azure_security_group_rule" "ssh_access" {
+    name = "ssh-access-rule"
+    security_group_names = ["${azure_security_group.web.name}", "${azure_security_group.apps.name}"]
+    type = "Inbound"
+    action = "Allow"
+    priority = 200
+    source_address_prefix = "100.0.0.0/32"
+    source_port_range = "*"
+    destination_address_prefix = "10.0.0.0/32"
+    destination_port_range = "22"
+    protocol = "TCP"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+* `name` - (Required) The name of the security group rule.
+
+* `security_group_names` - (Required) A list of the names of the security groups
+    the rule should be applied to.
+    Changing this list forces the creation of a new resource.
+
+* `type` - (Required) The type of the security rule. Valid options are:
+    `Inbound` and `Outbound`.
+
+* `priority` - (Required) The priority of the network security rule. Rules with
+    lower priority are evaluated first. This value can be between 100 and 4096.
+
+* `action` - (Optional) The action that is performed when the security rule is
+    matched. Valid options are: `Allow` and `Deny`.
+
+* `source_address_prefix` - (Required) The address prefix of packet sources that
+    that should be subjected to the rule. An asterisk (\*) can also be used to
+    match all source IPs.
+
+* `source_port_range` - (Required) The source port or range. This value can be
+    between 0 and 65535. An asterisk (\*) can also be used to match all ports.
+
+* `destination_address_prefix` - (Required) The address prefix of packet
+    destinations that should be subjected to the rule. An asterisk
+    (\*) can also be used to match all destination IPs.
+
+* `destination_port_range` - (Required) The destination port or range. This value
+    can be between 0 and 65535. An asterisk (\*) can also be used to match all
+    ports.
+
+* `protocol` - (Optional) The protocol of the security rule. Valid options are:
+    `TCP`, `UDP` and `*`.
+
+The following attributes are exported:
+
+* `id` - The security group rule ID. Coincides with its given `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_server.html.markdown b/website/source/docs/providers/azure/r/sql_database_server.html.markdown
new file mode 100644
index 000000000..c03873181
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_server.html.markdown
@@ -0,0 +1,50 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_server"
+sidebar_current: "docs-azure-sql-database-server"
+description: |-
+    Allocates a new SQL Database Server on Azure.
+---
+
+# azure\_sql\_database\_server
+
+Allocates a new SQL Database Server on Azure.
+
+## Example Usage
+
+```
+resource "azure_sql_database_server" "sql-serv" {
+    name = "<computed>"
+    location = "West US"
+    username = "SuperUser"
+    password = "SuperSEKR3T"
+    version = "2.0"
+    url = "<computed>"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Computed) The name of the database server. It is determined upon
+    creation as it is randomly-generated per server.
+
+* `location` - (Required) The location where the database server should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `username` - (Required) The username for the administrator of the database server.
+
+* `password` - (Required) The password for the administrator of the database server.
+
+* `version` - (Optional) The version of the database server to be used. Can be any
+    one of `2.0` or `12.0`.
+
+* `url` - (Computed) The fully qualified domain name of the database server.
+    Will be of the form `<name>.database.windows.net`.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database server ID. Coincides with the randomly-generated `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown b/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown
new file mode 100644
index 000000000..5579ed116
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown
@@ -0,0 +1,57 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_server_firewall_rule"
+sidebar_current: "docs-azure-sql-database-server-firewall-rule"
+description: |-
+    Defines a new Firewall Rule to be applied across the given Database Servers.
+---
+
+# azure\_sql\_database\_server
+
+Defines a new Firewall Rule to be applied across the given Database Servers.
+
+## Example Usage
+
+```
+resource "azure_sql_database_server" "sql-serv1" {
+    ...
+}
+
+resource "azure_sql_database_server" "sql-serv2" {
+    ...
+}
+
+resource "azure_sql_database_server_firewall_rule" "constraint" {
+    name = "terraform-testing-rule"
+    start_ip = "154.0.0.0"
+    end_ip   = "154.0.0.255"
+    database_server_names = [
+        "${azure_sql_database_server.sql-serv1.name}",
+        "${azure_sql_database_server.sql-serv2.name}",
+    ]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the rule. Changing forces the creation of a
+    new resource.
+
+* `start_ip` - (Required) The IPv4 which will represent the lower bound of the
+    rule's application IP's. Traffic to/from IP's greater than or equal to this
+    one up to the `end_ip` will be permitted.
+
+* `end_ip` - (Required) The IPv4 which will represent the upper bound of the
+    rule's application IP's. Traffic to/from IP's lesser that or equal to this
+    one all the way down to the `start_ip` will be permitted.
+
+* `database_server_names` - (Required) The set of names of the Azure SQL
+    Database servers the rule should be enforced on.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database server ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_service.html.markdown b/website/source/docs/providers/azure/r/sql_database_service.html.markdown
new file mode 100644
index 000000000..f068d3ff1
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_service.html.markdown
@@ -0,0 +1,52 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_service"
+sidebar_current: "docs-azure-sql-database-service"
+description: |-
+    Creates a new SQL Database Service on an Azure Database Server.
+---
+
+# azure\_sql\_database\_service
+
+Creates a new SQL database service on an Azure database server.
+
+## Example Usage
+
+```
+resource "azure_sql_database_service" "sql-server" {
+    name = "terraform-testing-db-renamed"
+    database_server_name = "flibberflabber"
+    edition = "Standard"
+    collation = "SQL_Latin1_General_CP1_CI_AS"
+    max_size_bytes = "5368709120"
+    service_level_id = "f1173c43-91bd-4aaa-973c-54e79e15235b"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the database service.
+
+* `database_server_name` - (Required) The name of the database server this service
+    should run on. Changes here force the creation of a new resource.
+
+* `edition` - (Optional) The edition of the database service. For more information
+    on each variant, please view [this](https://msdn.microsoft.com/library/azure/dn741340.aspx) link.
+
+* `collation` - (Optional) The collation to be used within the database service.
+    Defaults to the standard Latin charset.
+
+* `max_size_bytes` - (Optional) The maximum size in bytes the database service
+    should be allowed to expand to. Range depends on the database `edition`
+    selected above.
+
+* `service_level_id` - (Optional) The ID corresponding to the service level per
+    edition. Please refer to [this](https://msdn.microsoft.com/en-us/library/azure/dn505701.aspx) link for more details.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_blob.html.markdown b/website/source/docs/providers/azure/r/storage_blob.html.markdown
new file mode 100644
index 000000000..0e02d099a
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_blob.html.markdown
@@ -0,0 +1,49 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_blob"
+sidebar_current: "docs-azure-storage-blob"
+description: |-
+    Creates a new storage blob within a given storage container on Azure.
+---
+
+# azure\_storage\_blob
+
+Creates a new storage blob within a given storage container on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_blob" "foo" {
+    name = "tftesting-blob"
+    storage_service_name = "tfstorserv"
+    storage_container_name = "terraform-storage-container"
+    type = "PageBlob"
+    size = 1024
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage blob. Must be unique within
+    the storage service the blob is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage container in which the blob will be created resides.
+
+* `storage_container_name` - (Required) The name of the storage container
+    in which this blob should be created. Must be located on the storage
+    service given with `storage_service_name`.
+
+* `type` - (Required) The type of the storage blob to be created. One of either
+    `BlockBlob` or `PageBlob`.
+
+* `size` - (Optional) Used only for `PageBlob`'s to specify the size in bytes
+    of the blob to be created. Must be a multiple of 512. Defaults to 0.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage blob ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_container.html.markdown b/website/source/docs/providers/azure/r/storage_container.html.markdown
new file mode 100644
index 000000000..d0484c376
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_container.html.markdown
@@ -0,0 +1,43 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_container"
+sidebar_current: "docs-azure-storage-container"
+description: |-
+    Creates a new storage container within a given storage service on Azure.
+---
+
+# azure\_storage\_container
+
+Creates a new storage container within a given storage service on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_container" "stor-cont" {
+    name = "terraform-storage-container"
+    container_access_type = "blob"
+    storage_service_name = "tfstorserv"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage container. Must be unique within
+    the storage service the container is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage container should be created.
+
+* `container_access_type` - (Required) The 'interface' for access the container
+    provides. Can be either `blob`, `container` or ``.
+
+* `properties` - (Optional) Key-value definition of additional properties
+    associated to the storage service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage container ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_queue.html.markdown b/website/source/docs/providers/azure/r/storage_queue.html.markdown
new file mode 100644
index 000000000..2b9170c47
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_queue.html.markdown
@@ -0,0 +1,36 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_queue"
+sidebar_current: "docs-azure-storage-queue"
+description: |-
+    Creates a new storage queue within a given storage service on Azure.
+---
+
+# azure\_storage\_queue
+
+Creates a new storage queue within a given storage service on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_queue" "stor-queue" {
+    name = "terraform-storage-queue"
+    storage_service_name = "tfstorserv"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage queue. Must be unique within
+    the storage service the queue is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage queue should be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage queue ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_service.html.markdown b/website/source/docs/providers/azure/r/storage_service.html.markdown
new file mode 100644
index 000000000..6000817de
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_service.html.markdown
@@ -0,0 +1,55 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_service"
+sidebar_current: "docs-azure-storage-service"
+description: |-
+    Creates a new storage service on Azure in which storage containers may be created.
+---
+
+# azure\_storage\_service
+
+Creates a new storage service on Azure in which storage containers may be created.
+
+## Example Usage
+
+```
+resource "azure_storage_service" "tfstor" {
+    name = "tfstor"
+    location = "West US"
+    description = "Made by Terraform."
+    account_type = "Standard_LRS"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage service. Must be between 4 and 24
+    lowercase-only characters or digits Must be unique on Azure.
+
+* `location` - (Required) The location where the storage service should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `account_type` - (Required) The type of storage account to be created.
+    Available options include `Standard_LRS`, `Standard_ZRS`, `Standard_GRS`,
+    `Standard_RAGRS` and `Premium_LRS`. To learn more about the differences
+    of each storage account type, please consult [this link](http://blogs.msdn.com/b/windowsazurestorage/archive/2013/12/11/introducing-read-access-geo-replicated-storage-ra-grs-for-windows-azure-storage.aspx).
+
+* `affinity_group` - (Optional) The affinity group the storage service should
+    belong to.
+
+* `properties` - (Optional) Key-value definition of additional properties
+    associated to the storage service. For additional information on what
+    these properties do, please consult [this link](https://msdn.microsoft.com/en-us/library/azure/hh452235.aspx).
+
+* `label` - (Optional) A label to be used for tracking purposes. Must be
+    non-void. Defaults to `Made by Terraform.`.
+
+* `description` - (Optional) A description for the storage service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/virtual_network.html.markdown b/website/source/docs/providers/azure/r/virtual_network.html.markdown
new file mode 100644
index 000000000..50f717714
--- /dev/null
+++ b/website/source/docs/providers/azure/r/virtual_network.html.markdown
@@ -0,0 +1,62 @@
+---
+layout: "azure"
+page_title: "Azure: azure_virtual_network"
+sidebar_current: "docs-azure-resource-virtual-network"
+description: |-
+  Creates a new virtual network including any configured subnets. Each subnet can optionally be configured with a security group to be associated with the subnet.
+---
+
+# azure\_virtual\_network
+
+Creates a new virtual network including any configured subnets. Each subnet can
+optionally be configured with a security group to be associated with the subnet.
+
+## Example Usage
+
+```
+resource "azure_virtual_network" "default" {
+    name = "test-network"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the virtual network. Changing this forces a
+    new resource to be created.
+
+* `address_space` - (Required) The address space that is used the virtual
+    network. You can supply more than one address space. Changing this forces
+    a new resource to be created.
+
+* `location` - (Required) The location/region where the virtual network is
+    created. Changing this forces a new resource to be created.
+
+* `dns_servers` - (Optional) List of names of DNS servers previously registered
+    on Azure.
+
+* `subnet` - (Required) Can be specified multiple times to define multiple
+    subnets. Each `subnet` block supports fields documented below.
+
+The `subnet` block supports:
+
+* `name` - (Required) The name of the subnet.
+
+* `address_prefix` - (Required) The address prefix to use for the subnet.
+
+* `security_group` - (Optional) The Network Security Group to associate with
+    the subnet.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The virtual NetworkConfiguration ID.
diff --git a/website/source/docs/providers/cloudstack/index.html.markdown b/website/source/docs/providers/cloudstack/index.html.markdown
index 3fe42b98a..4d0936e76 100644
--- a/website/source/docs/providers/cloudstack/index.html.markdown
+++ b/website/source/docs/providers/cloudstack/index.html.markdown
@@ -43,3 +43,13 @@ The following arguments are supported:
 
 * `secret_key` - (Required) This is the CloudStack secret key. It must be provided,
   but it can also be sourced from the `CLOUDSTACK_SECRET_KEY` environment variable.
+
+* `http_get_only` - (Optional) Some cloud providers only allow HTTP GET calls to
+  their CloudStack API. If using such a provider, you need to set this to `true`
+  in order for the provider to only make GET calls and no POST calls. It can also
+  be sourced from the `CLOUDSTACK_HTTP_GET_ONLY` environment variable.
+
+* `timeout` - (Optional) A value in seconds. This is the time allowed for Cloudstack
+  to complete each asynchronous job triggered. If unset, this can be sourced from the
+  `CLOUDSTACK_TIMEOUT` environment variable. Otherwise, this will default to 300
+  seconds.
diff --git a/website/source/docs/providers/cloudstack/r/disk.html.markdown b/website/source/docs/providers/cloudstack/r/disk.html.markdown
index 53ae73656..2dbd40ee6 100644
--- a/website/source/docs/providers/cloudstack/r/disk.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/disk.html.markdown
@@ -44,7 +44,7 @@ The following arguments are supported:
 * `shrink_ok` - (Optional) Verifies if the disk volume is allowed to shrink when
     resizing (defaults false).
 
-* `virtual_machine` - (Optional) The name of the virtual machine to which you
+* `virtual_machine` - (Optional) The name or ID of the virtual machine to which you
     want to attach the disk volume.
 
 * `zone` - (Required) The name or ID of the zone where this disk volume will be available.
diff --git a/website/source/docs/providers/cloudstack/r/firewall.html.markdown b/website/source/docs/providers/cloudstack/r/firewall.html.markdown
index 8b8aa0089..455449049 100644
--- a/website/source/docs/providers/cloudstack/r/firewall.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/firewall.html.markdown
@@ -28,8 +28,8 @@ resource "cloudstack_firewall" "default" {
 
 The following arguments are supported:
 
-* `ipaddress` - (Required) The IP address for which to create the firewall rules.
-    Changing this forces a new resource to be created.
+* `ipaddress` - (Required) The IP address or ID for which to create the firewall
+    rules. Changing this forces a new resource to be created.
 
 * `managed` - (Optional) USE WITH CAUTION! If enabled all the firewall rules for
     this IP address will be managed by this resource. This means it will delete
diff --git a/website/source/docs/providers/cloudstack/r/instance.html.markdown b/website/source/docs/providers/cloudstack/r/instance.html.markdown
index e09cd6c6e..9f3ffe67b 100644
--- a/website/source/docs/providers/cloudstack/r/instance.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/instance.html.markdown
@@ -32,21 +32,29 @@ The following arguments are supported:
 
 * `display_name` - (Optional) The display name of the instance.
 
-* `service_offering` - (Required) The name or ID of the service offering used for this instance.
+* `service_offering` - (Required) The name or ID of the service offering used
+    for this instance.
 
-* `network` - (Optional) The name or ID of the network to connect this instance to.
-    Changing this forces a new resource to be created.
+* `network` - (Optional) The name or ID of the network to connect this instance
+    to. Changing this forces a new resource to be created.
 
 * `ipaddress` - (Optional) The IP address to assign to this instance. Changing
     this forces a new resource to be created.
 
-* `template` - (Required) The name or ID of the template used for this instance.
-    Changing this forces a new resource to be created.
+* `template` - (Required) The name or ID of the template used for this
+    instance. Changing this forces a new resource to be created.
 
-* `zone` - (Required) The name of the zone where this instance will be created.
-    Changing this forces a new resource to be created.
+* `project` - (Optional) The name or ID of the project to deploy this
+    instance to. Changing this forces a new resource to be created.
 
-* `user_data` - (Optional) The user data to provide when launching the instance.
+* `zone` - (Required) The name or ID of the zone where this instance will be
+    created. Changing this forces a new resource to be created.
+
+* `user_data` - (Optional) The user data to provide when launching the
+    instance.
+
+* `keypair` - (Optional) The name of the SSH key pair that will be used to
+    access this instance.
 
 * `expunge` - (Optional) This determines if the instance is expunged when it is
     destroyed (defaults false)
diff --git a/website/source/docs/providers/cloudstack/r/ipaddress.html.markdown b/website/source/docs/providers/cloudstack/r/ipaddress.html.markdown
index 3f560d22a..6a1f0517c 100644
--- a/website/source/docs/providers/cloudstack/r/ipaddress.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/ipaddress.html.markdown
@@ -22,10 +22,10 @@ resource "cloudstack_ipaddress" "default" {
 
 The following arguments are supported:
 
-* `network` - (Optional) The name of the network for which an IP address should
+* `network` - (Optional) The name or ID of the network for which an IP address should
     be acquired and associated. Changing this forces a new resource to be created.
 
-* `vpc` - (Optional) The name of the VPC for which an IP address should
+* `vpc` - (Optional) The name or ID of the VPC for which an IP address should
     be acquired and associated. Changing this forces a new resource to be created.
 
 *NOTE: Either `network` or `vpc` should have a value!*
diff --git a/website/source/docs/providers/cloudstack/r/network.html.markdown b/website/source/docs/providers/cloudstack/r/network.html.markdown
index 9819a8ce3..596755434 100644
--- a/website/source/docs/providers/cloudstack/r/network.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/network.html.markdown
@@ -37,7 +37,7 @@ The following arguments are supported:
 * `network_offering` - (Required) The name or ID of the network offering to use
     for this network.
 
-* `vpc` - (Optional) The name of the VPC to create this network for. Changing
+* `vpc` - (Optional) The name or ID of the VPC to create this network for. Changing
     this forces a new resource to be created.
 
 * `aclid` - (Optional) The ID of a network ACL that should be attached to the
diff --git a/website/source/docs/providers/cloudstack/r/port_forward.html.markdown b/website/source/docs/providers/cloudstack/r/port_forward.html.markdown
index 9c870c4a2..ddf42c75d 100644
--- a/website/source/docs/providers/cloudstack/r/port_forward.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/port_forward.html.markdown
@@ -48,7 +48,7 @@ The `forward` block supports:
 
 * `public_port` - (Required) The public port to forward from.
 
-* `virtual_machine` - (Required) The name of the virtual machine to forward to.
+* `virtual_machine` - (Required) The name or ID of the virtual machine to forward to.
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/cloudstack/r/secondary_ipaddress.html.markdown b/website/source/docs/providers/cloudstack/r/secondary_ipaddress.html.markdown
new file mode 100644
index 000000000..757673e6a
--- /dev/null
+++ b/website/source/docs/providers/cloudstack/r/secondary_ipaddress.html.markdown
@@ -0,0 +1,41 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_secondary_ipaddress"
+sidebar_current: "docs-cloudstack-resource-secondary-ipaddress"
+description: |-
+  Assigns a secondary IP to a NIC.
+---
+
+# cloudstack\_secondary\_ipaddress
+
+Assigns a secondary IP to a NIC.
+
+## Example Usage
+
+```
+resource "cloudstack_secondary_ipaddress" "default" {
+	virtual_machine = "server-1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `ipaddress` - (Optional) The IP address to attach the to NIC. If not supplied
+ 		an IP address will be selected randomly. Changing this forces a new resource
+		to be	created.
+
+* `nicid` - (Optional) The ID of the NIC to which you want to attach the
+		secondary IP address. Changing this forces a new resource to be
+    created (defaults to the ID of the primary NIC)
+
+* `virtual_machine` - (Required) The name or ID of the virtual machine to which
+ 		you want to attach the secondary IP address. Changing this forces a new
+		resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The secondary IP address ID.
diff --git a/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown b/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown
new file mode 100644
index 000000000..a7a57bb27
--- /dev/null
+++ b/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown
@@ -0,0 +1,40 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_ssh_keypair"
+sidebar_current: "docs-cloudstack-resource-ssh-keypair"
+description: |-
+  Creates or registers an SSH key pair.
+---
+
+# cloudstack\_ssh\_keypair
+
+Creates or registers an SSH key pair.
+
+## Example Usage
+
+```
+resource "cloudstack_ssh_keypair" "default" {
+  name = "myKey"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the SSH key pair. This is a unique value
+    within a CloudStack account. Changing this forces a new resource to be
+    created.
+
+* `public_key` - (Optional) The path to a public key that will be uploaded
+    the remote machine. If this is omitted, CloudStack will generate a new
+    key pair. Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The key pair ID.
+* `fingerprint` - The fingerprint of the public key specified or created.
+* `private_key` - The private key generated by CloudStack. Only available
+    if CloudStack generated the key pair.
diff --git a/website/source/docs/providers/docker/r/container.html.markdown b/website/source/docs/providers/docker/r/container.html.markdown
index d5a4c823e..5653f139a 100644
--- a/website/source/docs/providers/docker/r/container.html.markdown
+++ b/website/source/docs/providers/docker/r/container.html.markdown
@@ -21,7 +21,7 @@ resource "docker_container" "ubuntu" {
 
 # Find the latest Ubuntu precise image.
 resource "docker_image" "ubuntu" {
-    image = "ubuntu:precise"
+  name = "ubuntu:precise"
 }
 ```
 
@@ -46,6 +46,7 @@ The following arguments are supported:
   kept running. If false, then as long as the container exists, Terraform
   assumes it is successful.
 * `ports` - (Optional) See [Ports](#ports) below for details.
+* `privileged` - (Optional, bool) Run container in privileged mode.
 * `publish_all_ports` - (Optional, bool) Publish all ports of the container.
 * `volumes` - (Optional) See [Volumes](#volumes) below for details.
 
diff --git a/website/source/docs/providers/docker/r/image.html.markdown b/website/source/docs/providers/docker/r/image.html.markdown
index 7a79ad083..f859ef1a9 100644
--- a/website/source/docs/providers/docker/r/image.html.markdown
+++ b/website/source/docs/providers/docker/r/image.html.markdown
@@ -18,7 +18,7 @@ them.
 ```
 # Find the latest Ubuntu precise image.
 resource "docker_image" "ubuntu" {
-    image = "ubuntu:precise"
+    name = "ubuntu:precise"
 }
 
 # Access it somewhere else with ${docker_image.ubuntu.latest}
@@ -28,7 +28,7 @@ resource "docker_image" "ubuntu" {
 
 The following arguments are supported:
 
-* `image` - (Required) The name of the Docker image, including any tags.
+* `name` - (Required) The name of the Docker image, including any tags.
 * `keep_updated` - (Optional) If true, then the Docker image will always
   be updated on the host to the latest. If this is false, as long as an
   image is downloaded with the correct tag, it won't be redownloaded if
diff --git a/website/source/docs/providers/google/r/compute_instance.html.markdown b/website/source/docs/providers/google/r/compute_instance.html.markdown
index ae231a8c4..bf8add9e6 100644
--- a/website/source/docs/providers/google/r/compute_instance.html.markdown
+++ b/website/source/docs/providers/google/r/compute_instance.html.markdown
@@ -44,6 +44,8 @@ resource "google_compute_instance" "default" {
 		foo = "bar"
 	}
 
+    metadata_startup_script = "echo hi > /test.txt"
+
 	service_account {
 		scopes = ["userinfo-email", "compute-ro", "storage-ro"]
 	}
@@ -73,6 +75,12 @@ The following arguments are supported:
 * `metadata` - (Optional) Metadata key/value pairs to make available from
     within the instance.
 
+* `metadata_startup_script` - (Optional) An alternative to using the
+  startup-script metadata key, except this one forces the instance to be
+  recreated (thus re-running the script) if it is changed.  This replaces the
+  startup-script metadata key on the created instance and thus the two mechanisms
+  are not allowed to be used simultaneously.
+
 * `network_interface` - (Required) Networks to attach to the instance. This can be
     specified multiple times for multiple networks. Structure is documented
     below.
diff --git a/website/source/docs/providers/google/r/container_cluster.html.markdown b/website/source/docs/providers/google/r/container_cluster.html.markdown
new file mode 100644
index 000000000..76f0171f9
--- /dev/null
+++ b/website/source/docs/providers/google/r/container_cluster.html.markdown
@@ -0,0 +1,75 @@
+---
+layout: "google"
+page_title: "Google: google_container_cluster"
+sidebar_current: "docs-google-resource-container-cluster"
+description: |-
+  Creates a GKE cluster.
+---
+
+# google\_container\_cluster
+
+-> **Note:** Due to limitations of the API, all arguments except `node_version` are non-updateable (changing any will cause recreation of the whole cluster).
+
+## Example usage
+
+```
+resource "google_container_cluster" "primary" {
+	name = "marcellus-wallace"
+	zone = "us-central1-a"
+	initial_node_count = 3
+
+	master_auth {
+		username = "mr.yoda"
+		password = "adoy.rm"
+	}
+}
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the cluster, unique within the project and zone
+* `zone` - (Required) The zone that all resources should be created in.
+* `master_auth` - (Required) The authentication information for accessing the Kubernetes master
+* `initial_node_count` - (Required) The number of nodes to create in this cluster (not including the Kubernetes master)
+* `description` - (Optional) Description of the cluster
+* `node_version` - (Optional) The Kubernetes version on the nodes. Only valid for upgrading of existing cluster.
+  Defaults to latest version supported by the server.
+* `cluster_ipv4_cidr` - (Optional) The IP address range of the container pods in this cluster.
+  Default is an automatically assigned CIDR.
+* `logging_service` - (Optional) The logging service that the cluster should write logs to.
+  Available options include `logging.googleapis.com` and `none`. Defaults to `logging.googleapis.com`
+* `monitoring_service` - (Optional) The monitoring service that the cluster should write metrics to.
+  Available options include `monitoring.googleapis.com` and `none`. Defaults to `monitoring.googleapis.com`
+* `network` - (Optional) The name of the Google Compute Engine network to which the cluster is connected
+* `node_config` -  (Optional)The machine type and image to use for all nodes in this cluster
+
+**Master Auth** supports the following arguments:
+
+* `password` - The password to use for HTTP basic authentication when accessing the Kubernetes master endpoint
+* `username` - The username to use for HTTP basic authentication when accessing the Kubernetes master endpoint
+
+**Node Config** supports the following arguments:
+
+* `machine_type` - (Optional) The name of a Google Compute Engine machine type.
+  Defaults to `n1-standard-1`.
+* `disk_size_gb` - (Optional) Size of the disk attached to each node, specified in GB.
+  The smallest allowed disk size is 10GB. Defaults to 100GB.
+* `oauth_scopes` - (Optional) The set of Google API scopes to be made available on all
+  of the node VMs under the "default" service account. The following scopes are necessary
+  to ensure the correct functioning of the cluster:
+
+  * `https://www.googleapis.com/auth/compute`
+  * `https://www.googleapis.com/auth/devstorage.read_only`
+  * `https://www.googleapis.com/auth/logging.write` (if `logging_service` points to Google)
+  * `https://www.googleapis.com/auth/monitoring` (if `monitoring_service` points to Google)
+
+## Attributes Reference
+
+* `master_auth.client_certificate` - Base64 encoded public certificate
+  used by clients to authenticate to the cluster endpoint.
+* `master_auth.client_key` - Base64 encoded private key used by clients
+  to authenticate to the cluster endpoint
+* `master_auth.cluster_ca_certificate` - Base64 encoded public certificate
+  that is the root of trust for the cluster
+* `endpoint` - The IP address of this cluster's Kubernetes master
+* `instance_group_urls` - List of instance group URLs which have been assigned to the cluster
diff --git a/website/source/docs/providers/google/r/storage_bucket.html.markdown b/website/source/docs/providers/google/r/storage_bucket.html.markdown
new file mode 100644
index 000000000..b5aa15353
--- /dev/null
+++ b/website/source/docs/providers/google/r/storage_bucket.html.markdown
@@ -0,0 +1,32 @@
+---
+layout: "google"
+page_title: "Google: google_storage_bucket"
+sidebar_current: "docs-google-resource-storage"
+description: |-
+  Creates a new bucket in Google Cloud Storage.
+---
+
+# google\_storage\_bucket
+
+Creates a new bucket in Google cloud storage service(GCS). Currently, it will not change location nor ACL once a bucket has been created with Terraform. For more information see [the official documentation](https://cloud.google.com/storage/docs/overview) and [API](https://cloud.google.com/storage/docs/json_api).
+
+
+## Example Usage
+
+Example creating a private bucket in standard storage, in the EU region. 
+
+```
+resource "google_storage_bucket" "image-store" {
+	name = "image-store-bucket"
+	predefined_acl = "projectPrivate"
+	location = "EU"
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the bucket.
+* `predefined_acl` - (Optional, Default: 'private') The [canned GCS ACL](https://cloud.google.com/storage/docs/access-control#predefined-acl) to apply.
+* `location` - (Optional, Default: 'US') The [GCS location](https://cloud.google.com/storage/docs/bucket-locations) 
+* `force_destroy` - (Optional, Default: false) When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. 
diff --git a/website/source/docs/providers/openstack/index.html.markdown b/website/source/docs/providers/openstack/index.html.markdown
index 808b71d1e..be918a465 100644
--- a/website/source/docs/providers/openstack/index.html.markdown
+++ b/website/source/docs/providers/openstack/index.html.markdown
@@ -60,6 +60,10 @@ The following arguments are supported:
 * `insecure` - (Optional) Explicitly allow the provider to perform
     "insecure" SSL requests. If omitted, default value is `false`
 
+* `endpoint_type` - (Optional) Specify which type of endpoint to use from the
+    service catalog. It can be set using the OS_ENDPOINT_TYPE environment
+    variable. If not set, public endpoints is used.
+
 ## Testing
 
 In order to run the Acceptance Tests for development, the following environment
diff --git a/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown b/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
index 29ea9a29e..27ea7fe64 100644
--- a/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
+++ b/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
@@ -83,6 +83,9 @@ The following arguments are supported:
 * `volume` - (Optional) Attach an existing volume to the instance. The volume
     structure is described below.
 
+* `scheduler_hints` - (Optional) Provider the Nova scheduler with hints on how
+    the instance should be launched. The available hints are described below.
+
 The `network` block supports:
 
 * `uuid` - (Required unless `port`  or `name` is provided) The network UUID to
@@ -119,6 +122,25 @@ The `volume` block supports:
     example:  `/dev/vdc`. Omit this option to allow the volume to be
     auto-assigned a device.
 
+The `scheduler_hints` block supports:
+
+* `group` - (Optional) A UUID of a Server Group. The instance will be placed
+    into that group.
+
+* `different_host` - (Optional) A list of instance UUIDs. The instance will
+    be scheduled on a different host than all other instances.
+
+* `same_host` - (Optional) A list of instance UUIDs. The instance will be
+    scheduled on the same host of those specified.
+
+* `query` - (Optional) A conditional query that a compute node must pass in
+    order to host an instance.
+
+* `target_cell` - (Optional) The name of a cell to host the instance.
+
+* `build_near_host_ip` - (Optional) An IP Address in CIDR form. The instance
+    will be placed on a compute node that is in the same subnet.
+
 ## Attributes Reference
 
 The following attributes are exported:
diff --git a/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown b/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown
new file mode 100644
index 000000000..0e64db81f
--- /dev/null
+++ b/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown
@@ -0,0 +1,53 @@
+---
+layout: "openstack"
+page_title: "OpenStack: openstack_compute_servergroup_v2"
+sidebar_current: "docs-openstack-resource-compute-servergroup-v2"
+description: |-
+  Manages a V2 Server Group resource within OpenStack.
+---
+
+# openstack\_compute\_servergroup_v2
+
+Manages a V2 Server Group resource within OpenStack.
+
+## Example Usage
+
+```
+resource "openstack_compute_servergroup_v2" "test-sg" {
+  name = "my-sg"
+  policies = ["anti-affinity"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `region` - (Required) The region in which to obtain the V2 Compute client.
+    If omitted, the `OS_REGION_NAME` environment variable is used. Changing
+    this creates a new server group.
+
+* `name` - (Required) A unique name for the server group. Changing this creates
+    a new server group.
+
+* `policies` - (Required) The set of policies for the server group. Only two
+    two policies are available right now, and both are mutually exclusive. See
+    the Policies section for more information. Changing this creates a new
+    server group.
+
+## Policies
+
+* `affinity` - All instances/servers launched in this group will be hosted on
+    the same compute node.
+
+* `anti-affinity` - All instances/servers launched in this group will be
+    hosted on different compute nodes.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `region` - See Argument Reference above.
+* `name` - See Argument Reference above.
+* `policies` - See Argument Reference above.
+* `members` - The instances that are part of this server group.
diff --git a/website/source/docs/providers/template/r/file.html.md b/website/source/docs/providers/template/r/file.html.md
index a2e176f38..8fc13823b 100644
--- a/website/source/docs/providers/template/r/file.html.md
+++ b/website/source/docs/providers/template/r/file.html.md
@@ -41,3 +41,6 @@ The following attributes are exported:
 * `vars` - See Argument Reference above.
 * `rendered` - The final rendered template.
 
+## Template files syntax
+
+The syntax of the template files is [documented here](/docs/configuration/interpolation.html), under the "Templates" section.
diff --git a/website/source/docs/provisioners/chef.html.markdown b/website/source/docs/provisioners/chef.html.markdown
new file mode 100644
index 000000000..d1b47db25
--- /dev/null
+++ b/website/source/docs/provisioners/chef.html.markdown
@@ -0,0 +1,108 @@
+---
+layout: "docs"
+page_title: "Provisioner: chef"
+sidebar_current: "docs-provisioners-chef"
+description: |-
+  The `chef` provisioner invokes a Chef Client run on a remote resource after first installing and configuring Chef Client on the remote resource. The `chef` provisioner supports both `ssh` and `winrm` type connections.
+---
+
+# Chef Provisioner
+
+The `chef` provisioner invokes a Chef Client run on a remote resource after first installing
+and configuring Chef Client on the remote resource. The `chef` provisioner supports both `ssh`
+and `winrm` type [connections](/docs/provisioners/connection.html).
+
+## Requirements
+
+In order for the `chef` provisioner to work properly, you need either `cURL` (when using
+a `ssh` type connection) or `PowerShell 2.0` (when using a `winrm` type connection) to be
+available on the target machine.
+
+## Example usage
+
+```
+# Start a initial chef run on a resource
+resource "aws_instance" "web" {
+    ...
+    provisioner "chef"  {
+        attributes {
+            "key" = "value"
+            "app" {
+                "cluster1" {
+                    "nodes" = ["webserver1", "webserver2"]
+                }
+            }
+        }
+        environment = "_default"
+        run_list = ["cookbook::recipe"]
+        node_name = "webserver1"
+        secret_key_path = "../encrypted_data_bag_secret"
+        server_url = "https://chef.company.com/organizations/org1"
+        validation_client_name = "chef-validator"
+        validation_key_path = "../chef-validator.pem"
+        version = "12.4.1"
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `attributes (map)` - (Optional) A map with initial node attributes for the new node.
+  See example.
+
+* `environment (string)` - (Optional) The Chef environment the new node will be joining
+  (defaults `_default`).
+
+* `log_to_file (boolean)` - (Optional) If true, the output of the initial Chef Client run
+  will be logged to a local file instead of the console. The file will be created in a
+  subdirectory called `logfiles` created in your current directory. The filename will be
+  the `node_name` of the new node.
+
+* `http_proxy (string)` - (Optional) The proxy server for Chef Client HTTP connections.
+
+* `https_proxy (string)` - (Optional) The proxy server for Chef Client HTTPS connections.
+
+* `no_proxy (array)` - (Optional) A list of URLs that should bypass the proxy.
+
+* `node_name (string)` - (Required) The name of the node to register with the Chef Server.
+
+* `ohai_hints (array)` - (Optional) A list with
+  [Ohai hints](https://docs.chef.io/ohai.html#hints) to upload to the node.
+
+* `os_type (string)` - (Optional) The OS type of the node. Valid options are: `linux` and
+  `windows`. If not supplied the connection type will be used to determine the OS type (`ssh`
+  will asume `linux` and `winrm` will assume `windows`).
+
+* `prevent_sudo (boolean)` - (Optional) Prevent the use of sudo while installing, configuring
+  and running the initial Chef Client run. This option is only used with `ssh` type
+  [connections](/docs/provisioners/connection.html).
+
+* `run_list (array)` - (Required) A list with recipes that will be invoked during the initial
+  Chef Client run. The run-list will also be saved to the Chef Server after a successful
+  initial run.
+
+* `secret_key_path (string)` - (Optional) The path to the secret key that is used
+  by the client to decrypt data bags on the Chef Server. The key will be uploaded to the remote
+  machine.
+
+* `server_url (string)` - (Required) The URL to the Chef server. This includes the path to
+  the organization. See the example.
+
+* `skip_install (boolean)` - (Optional) Skip the installation of Chef Client on the remote
+  machine. This assumes Chef Client is already installed when you run the `chef`
+  provisioner.
+
+* `ssl_verify_mode (string)` - (Optional) Use to set the verify mode for Chef Client HTTPS
+  requests.
+
+* `validation_client_name (string)` - (Required) The name of the validation client to use
+  for the initial communication with the Chef Server.
+
+* `validation_key_path (string)` - (Required) The path to the validation key that is needed
+  by the node to register itself with the Chef Server. The key will be uploaded to the remote
+  machine.
+
+* `version (string)` - (Optional) The Chef Client version to install on the remote machine.
+  If not set the latest available version will be installed.
diff --git a/website/source/docs/provisioners/connection.html.markdown b/website/source/docs/provisioners/connection.html.markdown
index 8012b2c86..6efd73e83 100644
--- a/website/source/docs/provisioners/connection.html.markdown
+++ b/website/source/docs/provisioners/connection.html.markdown
@@ -71,7 +71,7 @@ provisioner "file" {
 * `key_file` - The SSH key to use for the connection. This takes preference over the
   password if provided.
 
-* `agent` - Set to true to enable using ssh-agent to authenticate.
+* `agent` - Set to false to disable using ssh-agent to authenticate.
 
 **Additional arguments only supported by the "winrm" connection type:**
 
@@ -80,3 +80,24 @@ provisioner "file" {
 * `insecure` - Set to true to not validate the HTTPS certificate chain.
 
 * `cacert` - The CA certificate to validate against.
+
+<a id="bastion"></a>
+## Connecting through a Bastion Host with SSH
+
+The `ssh` connection additionally supports the following fields to facilitate a
+[bastion host](https://en.wikipedia.org/wiki/Bastion_host) connection.
+
+* `bastion_host` - Setting this enables the bastion Host connection. This host
+  will be connected to first, and the `host` connection will be made from there.
+
+* `bastion_port` - The port to use connect to the bastion host. Defaults to the
+  value of `port`.
+
+* `bastion_user` - The user to use to connect to the bastion host. Defaults to
+  the value of `user`.
+
+* `bastion_password` - The password we should use for the bastion host.
+  Defaults to the value of `password`.
+
+* `bastion_key_file` - The SSH key to use for the bastion host. Defaults to the
+  value of `key_file`.
diff --git a/website/source/docs/provisioners/file.html.markdown b/website/source/docs/provisioners/file.html.markdown
index 70a266c3b..be50ed374 100644
--- a/website/source/docs/provisioners/file.html.markdown
+++ b/website/source/docs/provisioners/file.html.markdown
@@ -3,7 +3,7 @@ layout: "docs"
 page_title: "Provisioner: file"
 sidebar_current: "docs-provisioners-file"
 description: |-
-  The `file` provisioner is used to copy files or directories from the machine executing Terraform to the newly created resource. The `file` provisioner only supports `ssh` type connections.
+  The `file` provisioner is used to copy files or directories from the machine executing Terraform to the newly created resource. The `file` provisioner supports both `ssh` and `winrm` type connections.
 ---
 
 # File Provisioner
diff --git a/website/source/docs/provisioners/remote-exec.html.markdown b/website/source/docs/provisioners/remote-exec.html.markdown
index 79b7de9c0..d771e5586 100644
--- a/website/source/docs/provisioners/remote-exec.html.markdown
+++ b/website/source/docs/provisioners/remote-exec.html.markdown
@@ -3,7 +3,7 @@ layout: "docs"
 page_title: "Provisioner: remote-exec"
 sidebar_current: "docs-provisioners-remote"
 description: |-
-  The `remote-exec` provisioner invokes a script on a remote resource after it is created. This can be used to run a configuration management tool, bootstrap into a cluster, etc. To invoke a local process, see the `local-exec` provisioner instead. The `remote-exec` provisioner only supports `ssh` type connections.
+  The `remote-exec` provisioner invokes a script on a remote resource after it is created. This can be used to run a configuration management tool, bootstrap into a cluster, etc. To invoke a local process, see the `local-exec` provisioner instead. The `remote-exec` provisioner supports both `ssh` and `winrm` type connections.
 ---
 
 # remote-exec Provisioner
diff --git a/website/source/docs/state/remote.html.md b/website/source/docs/state/remote.html.md
index c0508ba99..3ab01fa79 100644
--- a/website/source/docs/state/remote.html.md
+++ b/website/source/docs/state/remote.html.md
@@ -47,13 +47,13 @@ An example is shown below:
 resource "terraform_remote_state" "vpc" {
     backend = "atlas"
     config {
-        path = "hashicorp/vpc-prod"
+        name = "hashicorp/vpc-prod"
     }
 }
 
 resource "aws_instance" "foo" {
     # ...
-    subnet_id = "${terraform_state.vpc.output.subnet_id}"
+    subnet_id = "${terraform_remote_state.vpc.output.subnet_id}"
 }
 ```
 
diff --git a/website/source/downloads.html.erb b/website/source/downloads.html.erb
index 834e18af3..1eb63cc22 100644
--- a/website/source/downloads.html.erb
+++ b/website/source/downloads.html.erb
@@ -17,6 +17,12 @@ description: |-
 			operating system and architecture. You can find SHA256 checksums
 			for packages <a href="https://dl.bintray.com/mitchellh/terraform/terraform_<%= latest_version %>_SHA256SUMS?direct">here</a>.
 			</p>
+
+			<p>
+			Each release archive is a <code>zip</code> file containing the Terraform binary
+			executables at the top level. These executables are meant to be extracted
+			to a location where they can be found by your shell.
+			</p>
 		</div>
 	</div>
 	<% product_versions.each do |os, versions| %>
diff --git a/website/source/intro/examples/index.html.markdown b/website/source/intro/examples/index.html.markdown
index 8ac1e0d45..11e2c24dc 100644
--- a/website/source/intro/examples/index.html.markdown
+++ b/website/source/intro/examples/index.html.markdown
@@ -50,6 +50,9 @@ This will put the example files within your working directory. You can then
 use your own editor to read and browse the configurations. This command will
 not _run_ any code.
 
+~> If you want to browse the files before downloading them, you can [view
+them on GitHub](https://github.com/hashicorp/terraform/tree/master/examples/aws-two-tier).
+
 If you want to run the example, just run `terraform apply`:
 
 ```
diff --git a/website/source/intro/getting-started/install.html.markdown b/website/source/intro/getting-started/install.html.markdown
index 629e97a57..2392e3549 100644
--- a/website/source/intro/getting-started/install.html.markdown
+++ b/website/source/intro/getting-started/install.html.markdown
@@ -57,4 +57,10 @@ If you get an error that `terraform` could not be found, then your PATH
 environment variable was not setup properly. Please go back and ensure
 that your PATH variable contains the directory where Terraform was installed.
 
-Otherwise, Terraform is installed and ready to go!
+Otherwise, Terraform is installed and ready to go! Nice!
+
+## Next Step
+
+Time to [build infrastructure](/intro/getting-started/build.html)
+using a minimal Terraform configuration file. You will be able to
+examine Terraform's execution plan before you deploy it to AWS.
diff --git a/website/source/layouts/aws.erb b/website/source/layouts/aws.erb
index c17ee042e..cf1034231 100644
--- a/website/source/layouts/aws.erb
+++ b/website/source/layouts/aws.erb
@@ -13,8 +13,23 @@
 				<li<%= sidebar_current(/^docs-aws-resource/) %>>
 					<a href="#">Resources</a>
 					<ul class="nav nav-visible">
-						<li<%= sidebar_current("docs-aws-resource-autoscale") %>>
-							<a href="/docs/providers/aws/r/autoscale.html">aws_autoscaling_group</a>
+						<li<%= sidebar_current("docs-aws-app-cookie-stickiness-policy") %>>
+							<a href="/docs/providers/aws/r/app_cookie_stickiness_policy.html">aws_app_cookie_stickiness_policy</a>
+						</li>
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-group") %>>
+							<a href="/docs/providers/aws/r/autoscaling_group.html">aws_autoscaling_group</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-notification") %>>
+							<a href="/docs/providers/aws/r/autoscaling_notification.html">aws_autoscaling_notification</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-policy") %>>
+							<a href="/docs/providers/aws/r/autoscaling_policy.html">aws_autoscaling_policy</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-cloudwatch-metric-alarm") %>>
+							<a href="/docs/providers/aws/r/cloudwatch_metric_alarm.html">aws_cloudwatch_metric_alarm</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-customer-gateway") %>>
@@ -25,6 +40,10 @@
 							<a href="/docs/providers/aws/r/db_instance.html">aws_db_instance</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-db-parameter-group") %>>
+							<a href="/docs/providers/aws/r/db_parameter_group.html">aws_db_parameter_group</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-db-security-group") %>>
 							<a href="/docs/providers/aws/r/db_security_group.html">aws_db_security_group</a>
 						</li>
@@ -33,14 +52,26 @@
 							<a href="/docs/providers/aws/r/db_subnet_group.html">aws_db_subnet_group</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-db-parameter-group") %>>
-							<a href="/docs/providers/aws/r/db_parameter_group.html">aws_db_parameter_group</a>
+						<li<%= sidebar_current("docs-aws-resource-dynamodb-table") %>>
+							<a href="/docs/providers/aws/r/dynamodb_table.html">aws_dynamodb_table</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-ebs-volume") %>>
 							<a href="/docs/providers/aws/r/ebs_volume.html">aws_ebs_volume</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-ecs-cluster") %>>
+							<a href="/docs/providers/aws/r/ecs_cluster.html">aws_ecs_cluster</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-ecs-service") %>>
+							<a href="/docs/providers/aws/r/ecs_service.html">aws_ecs_service</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-ecs-task-definition") %>>
+							<a href="/docs/providers/aws/r/ecs_task_definition.html">aws_ecs_task_definition</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-eip") %>>
 							<a href="/docs/providers/aws/r/eip.html">aws_eip</a>
 						</li>
@@ -49,6 +80,10 @@
 							<a href="/docs/providers/aws/r/elasticache_cluster.html">aws_elasticache_cluster</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-elasticache-parameter-group") %>>
+							<a href="/docs/providers/aws/r/elasticache_parameter_group.html">aws_elasticache_parameter_group</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-elasticache-security-group") %>>
 							<a href="/docs/providers/aws/r/elasticache_security_group.html">aws_elasticache_security_group</a>
 						</li>
@@ -61,6 +96,10 @@
 							<a href="/docs/providers/aws/r/elb.html">aws_elb</a>
 						</li>
 
+                                                <li<%= sidebar_current("docs-aws-resource-flow-log") %>>
+                                                        <a href="/docs/providers/aws/r/flow_log.html">aws_flow_log</a>
+                                                </li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-access-key") %>>
 							<a href="/docs/providers/aws/r/iam_access_key.html">aws_iam_access_key</a>
 						</li>
@@ -73,6 +112,10 @@
 							<a href="/docs/providers/aws/r/iam_group_policy.html">aws_iam_group_policy</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-iam-group-membership") %>>
+							<a href="/docs/providers/aws/r/iam_group_membership.html">aws_iam_group_membership</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-instance-profile") %>>
 							<a href="/docs/providers/aws/r/iam_instance_profile.html">aws_iam_instance_profile</a>
 						</li>
@@ -80,11 +123,22 @@
 						<li<%= sidebar_current("docs-aws-resource-iam-policy") %>>
 							<a href="/docs/providers/aws/r/iam_policy.html">aws_iam_policy</a>
 						</li>
+						<li<%= sidebar_current("docs-aws-resource-iam-policy-attachment") %>>
+							<a href="/docs/providers/aws/r/iam_policy_attachment.html">aws_iam_policy_attachment</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-iam-role") %>>
+							<a href="/docs/providers/aws/r/iam_role.html">aws_iam_role</a>
+						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-iam-role-policy") %>>
 							<a href="/docs/providers/aws/r/iam_role_policy.html">aws_iam_role_policy</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-iam-server-certificate") %>>
+							<a href="/docs/providers/aws/r/iam_server_certificate.html">aws_iam_server_certificate</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-user") %>>
 							<a href="/docs/providers/aws/r/iam_user.html">aws_iam_user</a>
 						</li>
@@ -101,8 +155,20 @@
 							<a href="/docs/providers/aws/r/internet_gateway.html">aws_internet_gateway</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-launch-config") %>>
-							<a href="/docs/providers/aws/r/launch_config.html">aws_launch_configuration</a>
+						<li<%= sidebar_current("docs-aws-resource-key-pair") %>>
+							<a href="/docs/providers/aws/r/key_pair.html">aws_key_pair</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-kinesis-stream") %>>
+							<a href="/docs/providers/aws/r/kinesis_stream.html">aws_kinesis_stream</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-lambda-function") %>>
+							<a href="/docs/providers/aws/r/lambda_function.html">aws_lambda_function</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-launch-configuration") %>>
+							<a href="/docs/providers/aws/r/launch_configuration.html">aws_launch_configuration</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-lb-cookie-stickiness-policy") %>>
@@ -116,20 +182,21 @@
 						<li<%= sidebar_current("docs-aws-resource-network-acl") %>>
 							<a href="/docs/providers/aws/r/network_acl.html">aws_network_acl</a>
 						</li>
-						<li<%= sidebar_current("docs-aws-resource-key-pair") %>>
-							<a href="/docs/providers/aws/r/key_pair.html">aws_key_pair</a>
+
+						<li<%= sidebar_current("docs-aws-resource-network-interface") %>>
+							<a href="/docs/providers/aws/r/network_interface.html">aws_network_interface</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-proxy-protocol-policy") %>>
 							<a href="/docs/providers/aws/r/proxy_protocol_policy.html">aws_proxy_protocol_policy</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-route-table|") %>>
-							<a href="/docs/providers/aws/r/route_table.html">aws_route_table</a>
+						<li<%= sidebar_current("docs-aws-resource-route53-delegation-set") %>>
+							<a href="/docs/providers/aws/r/route53_delegation_set.html">aws_route53_delegation_set</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-route-table-assoc") %>>
-							<a href="/docs/providers/aws/r/route_table_assoc.html">aws_route_table_association</a>
+						<li<%= sidebar_current("docs-aws-resource-route53-health-check") %>>
+							<a href="/docs/providers/aws/r/route53_health_check.html">aws_route53_health_check</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-route53-record") %>>
@@ -140,6 +207,18 @@
 							<a href="/docs/providers/aws/r/route53_zone.html">aws_route53_zone</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-route53-zone-association") %>>
+							<a href="/docs/providers/aws/r/route53_zone_association.html">aws_route53_zone_association</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-route-table|") %>>
+							<a href="/docs/providers/aws/r/route_table.html">aws_route_table</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-route-table-association") %>>
+							<a href="/docs/providers/aws/r/route_table_association.html">aws_route_table_association</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-s3-bucket") %>>
 							<a href="/docs/providers/aws/r/s3_bucket.html">aws_s3_bucket</a>
 						</li>
@@ -148,20 +227,36 @@
 							<a href="/docs/providers/aws/r/security_group.html">aws_security_group</a>
 						</li>
 
-                                                <li<%= sidebar_current("docs-aws-resource-security-group-rule") %>>
-                                                        <a href="/docs/providers/aws/r/security_group_rule.html">aws_security_group_rule</a>
-                                                </li>
+						<li<%= sidebar_current("docs-aws-resource-security-group-rule") %>>
+							<a href="/docs/providers/aws/r/security_group_rule.html">aws_security_group_rule</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-sns-topic") %>>
+							<a href="/docs/providers/aws/r/sns_topic.html">aws_sns_topic</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-sns-topic-subscription") %>>
+							<a href="/docs/providers/aws/r/sns_topic_subscription.html">aws_sns_topic_subscription</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-spot-instance-request") %>>
+							<a href="/docs/providers/aws/r/spot_instance_request.html">aws_spot_instance_request</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-sqs-queue") %>>
+							<a href="/docs/providers/aws/r/sqs_queue.html">aws_sqs_queue</a>
+						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-subnet") %>>
 							<a href="/docs/providers/aws/r/subnet.html">aws_subnet</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-vpc") %>>
-							<a href="/docs/providers/aws/r/vpc.html">aws_vpc</a>
+						<li<%= sidebar_current("docs-aws-resource-volume-attachment") %>>
+							<a href="/docs/providers/aws/r/volume_attachment.html">aws_volume_attachment</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-vpc-peering") %>>
-							<a href="/docs/providers/aws/r/vpc_peering.html">aws_vpc_peering</a>
+						<li<%= sidebar_current("docs-aws-resource-vpc") %>>
+							<a href="/docs/providers/aws/r/vpc.html">aws_vpc</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-vpc-dhcp-options") %>>
@@ -170,6 +265,15 @@
 
 						<li<%= sidebar_current("docs-aws-resource-vpc-dhcp-options-association") %>>
 							<a href="/docs/providers/aws/r/vpc_dhcp_options_association.html">aws_vpc_dhcp_options_association</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-vpc-endpoint") %>>
+							<a href="/docs/providers/aws/r/vpc_endpoint.html">aws_vpc_endpoint</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-vpc-peering") %>>
+							<a href="/docs/providers/aws/r/vpc_peering.html">aws_vpc_peering</a>
+						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-vpn-connection") %>>
 							<a href="/docs/providers/aws/r/vpn_connection.html">aws_vpn_connection</a>
diff --git a/website/source/layouts/azure.erb b/website/source/layouts/azure.erb
new file mode 100644
index 000000000..47356cba4
--- /dev/null
+++ b/website/source/layouts/azure.erb
@@ -0,0 +1,86 @@
+<% wrap_layout :inner do %>
+    <% content_for :sidebar do %>
+        <div class="docs-sidebar hidden-print affix-top" role="complementary">
+            <ul class="nav docs-sidenav">
+                <li<%= sidebar_current("docs-home") %>>
+                    <a href="/docs/providers/index.html">&laquo; Documentation Home</a>
+                </li>
+
+                <li<%= sidebar_current("docs-azure-index") %>>
+                    <a href="/docs/providers/azure/index.html">Azure Provider</a>
+                </li>
+
+                <li<%= sidebar_current(/^docs-azure-resource/) %>>
+                    <a href="#">Resources</a>
+                    <ul class="nav nav-visible">
+                        <li<%= sidebar_current("docs-azure-resource-affinity-group") %>>
+                            <a href="/docs/providers/azure/r/affinity_group.html">azure_affinity_group</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-data-disk") %>>
+                            <a href="/docs/providers/azure/r/data_disk.html">azure_data_disk</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-dns-server") %>>
+                            <a href="/docs/providers/azure/r/dns_server.html">azure_dns_server</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-hosted-service") %>>
+                            <a href="/docs/providers/azure/r/hosted_service.html">azure_hosted_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-instance") %>>
+                            <a href="/docs/providers/azure/r/instance.html">azure_instance</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-local-network") %>>
+                            <a href="/docs/providers/azure/r/local_network_connection.html">azure_local_network_connection</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-security-group") %>>
+                            <a href="/docs/providers/azure/r/security_group.html">azure_security_group</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-security-group-rule") %>>
+                            <a href="/docs/providers/azure/r/security_group_rule.html">azure_security_group_rule</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-server") %>>
+                            <a href="/docs/providers/azure/r/sql_database_server.html">azure_sql_database_server</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-server-firewall-rule") %>>
+                            <a href="/docs/providers/azure/r/sql_database_server_firewall_rule.html">azure_sql_database_server_firewall_rule</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-service") %>>
+                            <a href="/docs/providers/azure/r/sql_database_service.html">azure_sql_database_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-blob") %>>
+                            <a href="/docs/providers/azure/r/storage_blob.html">azure_storage_blob</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-container") %>>
+                            <a href="/docs/providers/azure/r/storage_container.html">azure_storage_container</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-queue") %>>
+                            <a href="/docs/providers/azure/r/storage_queue.html">azure_storage_queue</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-service") %>>
+                            <a href="/docs/providers/azure/r/storage_service.html">azure_storage_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-virtual-network") %>>
+                            <a href="/docs/providers/azure/r/virtual_network.html">azure_virtual_network</a>
+                        </li>
+                    </ul>
+                </li>
+            </ul>
+        </div>
+    <% end %>
+
+    <%= yield %>
+<% end %>
diff --git a/website/source/layouts/cloudstack.erb b/website/source/layouts/cloudstack.erb
index d9830586c..1cf60b787 100644
--- a/website/source/layouts/cloudstack.erb
+++ b/website/source/layouts/cloudstack.erb
@@ -53,6 +53,14 @@
                             <a href="/docs/providers/cloudstack/r/port_forward.html">cloudstack_port_forward</a>
                         </li>
 
+                        <li<%= sidebar_current("docs-cloudstack-resource-secondary-ipaddress") %>>
+                            <a href="/docs/providers/cloudstack/r/secondary_ipaddres.html">cloudstack_secondary_ipaddress</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-cloudstack-resource-ssh-keypair") %>>
+                            <a href="/docs/providers/cloudstack/r/ssh_keypair.html">cloudstack_ssh_keypair</a>
+                        </li>
+
                         <li<%= sidebar_current("docs-cloudstack-resource-template") %>>
                             <a href="/docs/providers/cloudstack/r/template.html">cloudstack_template</a>
                         </li>
diff --git a/website/source/layouts/docs.erb b/website/source/layouts/docs.erb
index c7a3d711b..dbbf87b8a 100644
--- a/website/source/layouts/docs.erb
+++ b/website/source/layouts/docs.erb
@@ -119,19 +119,23 @@
                 <ul class="nav">
 					<li<%= sidebar_current("docs-providers-atlas") %>>
 					<a href="/docs/providers/atlas/index.html">Atlas</a>
-                    </li>
+          </li>
 
 					<li<%= sidebar_current("docs-providers-aws") %>>
 					<a href="/docs/providers/aws/index.html">AWS</a>
 					</li>
 
+					<li<%= sidebar_current("docs-providers-azure") %>>
+					<a href="/docs/providers/azure/index.html">Azure</a>
+					</li>
+
 					<li<%= sidebar_current("docs-providers-cloudflare") %>>
 					<a href="/docs/providers/cloudflare/index.html">CloudFlare</a>
-                    </li>
+          </li>
 
           <li<%= sidebar_current("docs-providers-cloudstack") %>>
 					<a href="/docs/providers/cloudstack/index.html">CloudStack</a>
-                    </li>
+          </li>
 
 					<li<%= sidebar_current("docs-providers-consul") %>>
 					<a href="/docs/providers/consul/index.html">Consul</a>
@@ -178,6 +182,10 @@
 				<li<%= sidebar_current(/^docs-provisioners/) %>>
 				<a href="/docs/provisioners/index.html">Provisioners</a>
 				<ul class="nav">
+					<li<%= sidebar_current("docs-provisioners-chef") %>>
+					<a href="/docs/provisioners/chef.html">chef</a>
+					</li>
+
 					<li<%= sidebar_current("docs-provisioners-connection") %>>
 					<a href="/docs/provisioners/connection.html">connection</a>
 					</li>
diff --git a/website/source/layouts/google.erb b/website/source/layouts/google.erb
index 7f0602f5c..6096c144d 100644
--- a/website/source/layouts/google.erb
+++ b/website/source/layouts/google.erb
@@ -53,6 +53,10 @@
 			<a href="/docs/providers/google/r/compute_target_pool.html">google_compute_target_pool</a>
 			</li>
 
+			<li<%= sidebar_current("docs-google-resource-container-cluster") %>>
+			<a href="/docs/providers/google/r/container_cluster.html">google_container_cluster</a>
+			</li>
+
 			<li<%= sidebar_current("docs-google-resource-dns-managed-zone") %>>
 			<a href="/docs/providers/google/r/dns_managed_zone.html">google_dns_managed_zone</a>
 			</li>
@@ -68,6 +72,10 @@
 			<li<%= sidebar_current("docs-google-resource-autoscaler") %>>
 			<a href="/docs/providers/google/r/autoscaler.html">google_autoscaler</a>
 			</li>
+
+			<li<%= sidebar_current("docs-google-resource-storage-bucket") %>>
+			<a href="/docs/providers/google/r/storage_bucket.html">google_storage_bucket</a>
+			</li>
 		</ul>
 		</li>
 	</ul>
diff --git a/website/source/layouts/openstack.erb b/website/source/layouts/openstack.erb
index 318c5875e..9a0df0b6d 100644
--- a/website/source/layouts/openstack.erb
+++ b/website/source/layouts/openstack.erb
@@ -28,8 +28,8 @@
             <li<%= sidebar_current("docs-openstack-resource-compute-secgroup-v2") %>>
               <a href="/docs/providers/openstack/r/compute_secgroup_v2.html">openstack_compute_secgroup_v2</a>
             </li>
-            <li<%= sidebar_current("docs-openstack-resource-fw-firewall-v1") %>>
-              <a href="/docs/providers/openstack/r/fw_firewall_v1.html">openstack_fw_firewall_v1</a>
+            <li<%= sidebar_current("docs-openstack-resource-compute-servergroup-v2") %>>
+              <a href="/docs/providers/openstack/r/compute_servergroup_v2.html">openstack_compute_servergroup_v2</a>
             </li>
             <li<%= sidebar_current("docs-openstack-resource-fw-firewall-v1") %>>
               <a href="/docs/providers/openstack/r/fw_firewall_v1.html">openstack_fw_firewall_v1</a>
@@ -40,9 +40,6 @@
             <li<%= sidebar_current("docs-openstack-resource-fw-rule-v1") %>>
               <a href="/docs/providers/openstack/r/fw_rule_v1.html">openstack_fw_rule_v1</a>
             </li>
-            <li<%= sidebar_current("docs-openstack-resource-lb-pool-v1") %>>
-              <a href="/docs/providers/openstack/r/lb_pool_v1.html">openstack_lb_pool_v1</a>
-            </li>
             <li<%= sidebar_current("docs-openstack-resource-lb-monitor-v1") %>>
               <a href="/docs/providers/openstack/r/lb_monitor_v1.html">openstack_lb_monitor_v1</a>
             </li>