diff --git a/CHANGELOG.md b/CHANGELOG.md
index 390f13504..a734567a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,17 +1,184 @@
-## 0.5.3 (Unreleased)
+## 0.6.0 (Unreleased)
+
+BACKWARDS INCOMPATIBILITIES:
+
+ * command/push: If a variable is already set within Atlas, it won't be
+     updated unless the `-overwrite` flag is present [GH-2373]
+ * connection/ssh: The `agent` field now defaults to `true` if
+     the `SSH_AGENT_SOCK` environment variable is present. In other words,
+     `ssh-agent` support is now opt-out instead of opt-in functionality. [GH-2408]
+ * provider/aws: If you were setting access and secret key to blank ("")
+     to force Terraform to load credentials from another source such as the
+     EC2 role, this will now error. Remove the blank lines and Terraform
+     will load from other sources.
+ * `concat()` has been repurposed to combine lists instead of strings (old behavior
+     of joining strings is maintained in this version but is deprecated, strings
+     should be combined using interpolation syntax, like "${var.foo}{var.bar}")
+     [GH-1790]
+
+FEATURES:
+
+  * **New provider: `azure`** [GH-2052, GH-2053, GH-2372, GH-2380, GH-2394, GH-2515, GH-2530, GH-2562]
+  * **New resource: `aws_autoscaling_notification`** [GH-2197]
+  * **New resource: `aws_autoscaling_policy`** [GH-2201]
+  * **New resource: `aws_cloudwatch_metric_alarm`** [GH-2201]
+  * **New resource: `aws_dynamodb_table`** [GH-2121]
+  * **New resource: `aws_ecs_cluster`** [GH-1803]
+  * **New resource: `aws_ecs_service`** [GH-1803]
+  * **New resource: `aws_ecs_task_definition`** [GH-1803, GH-2402]
+  * **New resource: `aws_elasticache_parameter_group`** [GH-2276]
+  * **New resource: `aws_flow_log`** [GH-2384]
+  * **New resource: `aws_iam_group_association`** [GH-2273]
+  * **New resource: `aws_iam_policy_attachment`** [GH-2395]
+  * **New resource: `aws_lambda_function`** [GH-2170]
+  * **New resource: `aws_route53_delegation_set`** [GH-1999]
+  * **New resource: `aws_route53_health_check`** [GH-2226]
+  * **New resource: `aws_spot_instance_request`** [GH-2263]
+  * **New resource: `cloudstack_ssh_keypair`** [GH-2004]
+  * **New remote state backend: `swift`**: You can now store remote state in
+     a OpenStack Swift. [GH-2254]
+  * command/output: support display of module outputs [GH-2102]
+  * core: `keys()` and `values()` funcs for map variables [GH-2198]
+  * connection/ssh: SSH bastion host support and ssh-agent forwarding [GH-2425]
 
 IMPROVEMENTS:
 
+  * core: HTTP remote state now accepts `skip_cert_verification`
+      option to ignore TLS cert verification. [GH-2214]
+  * core: S3 remote state now accepts the 'encrypt' option for SSE [GH-2405]
+  * core: `plan` now reports sum of resources to be changed/created/destroyed [GH-2458]
+  * core: Change string list representation so we can distinguish empty, single
+      element lists [GH-2504]
+  * core: Properly close provider and provisioner plugin connections [GH-2406, GH-2527]
+  * provider/aws: AutoScaling groups now support updating Load Balancers without
+      recreation [GH-2472]
+  * provider/aws: Allow more in-place updates for ElastiCache cluster without recreating
+      [GH-2469]
+  * provider/aws: ElastiCache Subnet Groups can be updated
+      without destroying first [GH-2191]
+  * provider/aws: Normalize `certificate_chain` in `aws_iam_server_certificate` to
+      prevent unnecessary replacement. [GH-2411]
+  * provider/aws: `aws_instance` supports `monitoring' [GH-2489]
+  * provider/aws: `aws_launch_configuration` now supports `enable_monitoring` [GH-2410]
+  * provider/aws: Show outputs after `terraform refresh` [GH-2347]
+  * provider/aws: Add backoff/throttling during DynamoDB creation [GH-2462]
+  * provider/aws: Add validation for aws_vpc.cidr_block [GH-2514]
+  * provider/aws: Add validation for aws_db_subnet_group.name [GH-2513]
+  * provider/aws: Add validation for aws_db_instance.identifier [GH-2516]
+  * provider/aws: Add validation for aws_elb.name [GH-2517]
+  * provider/aws: Add validation for aws_security_group (name+description) [GH-2518]
+  * provider/aws: Add validation for aws_launch_configuration [GH-2519]
+  * provider/aws: Add validation for aws_autoscaling_group.name [GH-2520]
+  * provider/aws: Add validation for aws_iam_role.name [GH-2521]
+  * provider/aws: Add validation for aws_iam_role_policy.name [GH-2552]
+  * provider/aws: Add validation for aws_iam_instance_profile.name [GH-2553]
+  * provider/aws: aws_auto_scaling_group.default_cooldown no longer requires
+      resource replacement [GH-2510]
+  * provider/aws: add AH and ESP protocol integers [GH-2321]
+  * provider/docker: `docker_container` has the `privileged`
+      option. [GH-2227]
+  * provider/openstack: allow `OS_AUTH_TOKEN` environment variable
+      to set the openstack `api_key` field [GH-2234]
+  * provider/openstack: Can now configure endpoint type (public, admin,
+      internal) [GH-2262]
+  * provider/cloudstack: `cloudstack_instance` now supports projects [GH-2115]
+  * provisioner/chef: Added a `os_type` to specifically specify the target OS [GH-2483]
+  * provisioner/chef: Added a `ohai_hints` option to upload hint files [GH-2487]
+
+BUG FIXES:
+
+  * core: lifecycle `prevent_destroy` can be any value that can be
+      coerced into a bool [GH-2268]
+  * core: matching provider types in sibling modules won't override
+      each other's config. [GH-2464]
+  * core: computed provider configurations now properly validate [GH-2457]
+  * core: orphan (commented out) resource dependencies are destroyed in
+      the correct order [GH-2453]
+  * core: validate object types in plugins are actually objects [GH-2450]
+  * core: fix `-no-color` flag in subcommands [GH-2414]
+  * core: Fix error of 'attribute not found for variable' when a computed
+      resource attribute is used as a parameter to a module [GH-2477]
+  * core: moduled orphans will properly inherit provider configs [GH-2476]
+  * core: modules with provider aliases work properly if the parent
+      doesn't implement those aliases [GH-2475]
+  * core: unknown resource attributes passed in as parameters to modules
+      now error [GH-2478]
+  * core: better error messages for missing variables [GH-2479]
+  * core: removed set items now properly appear in diffs and applies [GH-2507]
+  * core: '*' will not be added as part of the variable name when you
+      attempt multiplication without a space [GH-2505]
+  * core: fix target dependency calculation across module boundaries [GH-2555]
+  * command/*: fixed bug where variable input was not asked for unset
+      vars if terraform.tfvars existed [GH-2502]
+  * command/apply: prevent output duplication when reporting errors [GH-2267]
+  * command/apply: destroyed orphan resources are properly counted [GH-2506]
+  * provider/aws: loading credentials from the environment (vars, EC2 role,
+      etc.) is more robust and will not ask for credentials from stdin [GH-1841]
+  * provider/aws: fix panic when route has no `cidr_block` [GH-2215]
+  * provider/aws: fix issue preventing destruction of IAM Roles [GH-2177]
+  * provider/aws: fix issue where Security Group Rules could collide and fail
+      to save to the state file correctly [GH-2376]
+  * provider/aws: fix issue preventing destruction self referencing Securtity
+     Group Rules [GH-2305]
+  * provider/aws: fix issue causing perpetual diff on ELB listeners
+      when non-lowercase protocol strings were used [GH-2246]
+  * provider/aws: corrected frankfurt S3 website region [GH-2259]
+  * provider/aws: `aws_elasticache_cluster` port is required [GH-2160]
+  * provider/aws: Handle AMIs where RootBlockDevice does not appear in the
+      BlockDeviceMapping, preventing root_block_device from working [GH-2271]
+  * provider/aws: fix `terraform show` with remote state [GH-2371]
+  * provider/aws: detect `instance_type` drift on `aws_instance` [GH-2374]
+  * provider/aws: fix crash when `security_group_rule` referenced non-existent
+      security group [GH-2434]
+  * provider/aws: `aws_launch_configuration` retries if IAM instance
+      profile is not ready yet. [GH-2452]
+  * provider/aws: `fqdn` is populated during creation for `aws_route53_record` [GH-2528]
+  * provider/aws: retry VPC delete on DependencyViolation due to eventual
+      consistency [GH-2532]
+  * provider/aws: VPC peering connections in "failed" state are deleted [GH-2544]
+  * provider/aws: EIP deletion works if it was manually disassociated [GH-2543]
+  * provider/aws: `elasticache_subnet_group.subnet_ids` is now a required argument [GH-2534]
+  * provider/aws: handle nil response from VPN connection describes [GH-2533]
+  * provider/cloudflare: manual record deletion doesn't cause error [GH-2545]
+  * provider/digitalocean: handle case where droplet is deleted outside of
+      terraform [GH-2497]
+  * provider/dme: No longer an error if record deleted manually [GH-2546]
+  * provider/docker: Fix issues when using containers with links [GH-2327]
+  * provider/openstack: fix panic case if API returns nil network [GH-2448]
+  * provider/template: fix issue causing "unknown variable" rendering errors
+      when an existing set of template variables is changed [GH-2386]
+  * provisioner/chef: improve the decoding logic to prevent parameter not found errors [GH-2206]
+
+## 0.5.3 (June 1, 2015)
+
+IMPROVEMENTS:
+
+  * **New resource: `aws_kinesis_stream`** [GH-2110]
+  * **New resource: `aws_iam_server_certificate`** [GH-2086]
   * **New resource: `aws_sqs_queue`** [GH-1939]
+  * **New resource: `aws_sns_topic`** [GH-1974]
+  * **New resource: `aws_sns_topic_subscription`** [GH-1974]
+  * **New resource: `aws_volume_attachment`** [GH-2050]
+  * **New resource: `google_storage_bucket`** [GH-2060]
   * provider/aws: support ec2 termination protection [GH-1988]
   * provider/aws: support for RDS Read Replicas [GH-1946]
   * provider/aws: `aws_s3_bucket` add support for `policy` [GH-1992]
-  * provider/aws: New `force_destroy` parameter for S3 buckets, to destroy 
+  * provider/aws: `aws_ebs_volume` add support for `tags` [GH-2135]
+  * provider/aws: `aws_elasticache_cluster` Confirm node status before reporting
+      available
+  * provider/aws: `aws_network_acl` Add support for ICMP Protocol [GH-2148]
+  * provider/aws: New `force_destroy` parameter for S3 buckets, to destroy
       Buckets that contain objects [GH-2007]
+  * provider/aws: switching `health_check_type` on ASGs no longer requires
+      resource refresh [GH-2147]
+  * provider/aws: ignore empty `vpc_security_group_ids` on `aws_instance` [GH-2311]
 
 BUG FIXES:
 
   * provider/aws: Correctly handle AWS keypairs which no longer exist [GH-2032]
+  * provider/aws: Fix issue with restoring an Instance from snapshot ID [GH-2120]
+  * provider/template: store relative path in the state [GH-2038]
+  * provisioner/chef: fix interpolation in the Chef provisioner [GH-2168]
   * provisioner/remote-exec: Don't prepend shebang on scripts that already
       have one [GH-2041]
 
@@ -122,7 +289,7 @@ IMPROVEMENTS:
   * **New resource: `google_dns_record_set`**
   * **Migrate to upstream AWS SDK:** Migrate the AWS provider to
       [awslabs/aws-sdk-go](https://github.com/awslabs/aws-sdk-go),
-      the offical `awslabs` library. Previously we had forked the library for
+      the official `awslabs` library. Previously we had forked the library for
       stability while `awslabs` refactored. Now that work has completed, and we've
       migrated back to the upstream version.
   * core: Improve error message on diff mismatch [GH-1501]
@@ -150,7 +317,7 @@ IMPROVEMENTS:
   * provider/aws: `aws_network_acl` improved validation for network ACL ports
       and protocols [GH-1798] [GH-1808]
   * provider/aws: `aws_route_table` can target network interfaces [GH-968]
-  * provider/aws: `aws_route_table` can specify propogating VGWs [GH-1516]
+  * provider/aws: `aws_route_table` can specify propagating VGWs [GH-1516]
   * provider/aws: `aws_route53_record` supports weighted sets [GH-1578]
   * provider/aws: `aws_route53_zone` exports nameservers [GH-1525]
   * provider/aws: `aws_s3_bucket` website support [GH-1738]
@@ -307,7 +474,7 @@ FEATURES:
   * **Math operations** in interpolations. You can now do things like
       `${count.index+1}`. [GH-1068]
   * **New AWS SDK:** Move to `aws-sdk-go` (hashicorp/aws-sdk-go),
-      a fork of the offical `awslabs` repo. We forked for stability while
+      a fork of the official `awslabs` repo. We forked for stability while
       `awslabs` refactored the library, and will move back to the officially
       supported version in the next release.
 
@@ -336,7 +503,7 @@ IMPROVEMENTS:
   * providers/aws: Improve dependency violation error handling, when deleting
       Internet Gateways or Auto Scaling groups [GH-1325].
   * provider/aws: Add non-destructive updates to AWS RDS. You can now upgrade
-      `egine_version`, `parameter_group_name`, and `multi_az` without forcing
+      `engine_version`, `parameter_group_name`, and `multi_az` without forcing
       a new database to be created.[GH-1341]
   * providers/aws: Full support for block device mappings on instances and
       launch configurations [GH-1045, GH-1364]
diff --git a/Makefile b/Makefile
index 21a54a8f8..e2725dbd3 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,10 @@ dev: generate
 quickdev: generate
 	@TF_QUICKDEV=1 TF_DEV=1 sh -c "'$(CURDIR)/scripts/build.sh'"
 
+release: updatedeps
+	gox -build-toolchain
+	@$(MAKE) bin
+
 # test runs the unit tests and vets the code
 test: generate
 	TF_ACC= go test $(TEST) $(TESTARGS) -timeout=30s -parallel=4
@@ -23,10 +27,11 @@ test: generate
 # testacc runs acceptance tests
 testacc: generate
 	@if [ "$(TEST)" = "./..." ]; then \
-		echo "ERROR: Set TEST to a specific package"; \
+		echo "ERROR: Set TEST to a specific package. For example,"; \
+		echo "  make testacc TEST=./builtin/providers/aws"; \
 		exit 1; \
 	fi
-	TF_ACC=1 go test $(TEST) -v $(TESTARGS) -timeout 45m
+	TF_ACC=1 go test $(TEST) -v $(TESTARGS) -timeout 90m
 
 # testrace runs the race checker
 testrace: generate
@@ -61,7 +66,8 @@ vet:
 	@go tool vet $(VETARGS) . ; if [ $$? -eq 1 ]; then \
 		echo ""; \
 		echo "Vet found suspicious constructs. Please check the reported constructs"; \
-		echo "and fix them if necessary before submitting the code for reviewal."; \
+		echo "and fix them if necessary before submitting the code for review."; \
+		exit 1; \
 	fi
 
 # generate runs `go generate` to build the dynamically generated
diff --git a/README.md b/README.md
index bda9d7d72..f1f08e737 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ Developing Terraform
 
 If you wish to work on Terraform itself or any of its built-in providers, you'll first need [Go](http://www.golang.org) installed on your machine (version 1.4+ is *required*). Alternatively, you can use the Vagrantfile in the root of this repo to stand up a virtual machine with the appropriate dev tooling already set up for you.
 
-For local dev first make sure Go is properly installed, including setting up a [GOPATH](http://golang.org/doc/code.html#GOPATH). Next, install the following software packages, which are needed for some dependencies:
+For local dev first make sure Go is properly installed, including setting up a [GOPATH](http://golang.org/doc/code.html#GOPATH). You will also need to add `$GOPATH/bin` to your `$PATH`. Next, install the following software packages, which are needed for some dependencies:
 
 -	[Git](http://git-scm.com/)
 -	[Mercurial](http://mercurial.selenic.com/)
@@ -74,7 +74,7 @@ To run the acceptance tests, invoke `make testacc`:
 ```sh
 $ make testacc TEST=./builtin/providers/aws TESTARGS='-run=Vpc'
 go generate ./...
-TF_ACC=1 go test ./builtin/providers/aws -v -run=Vpc -timeout 45m
+TF_ACC=1 go test ./builtin/providers/aws -v -run=Vpc -timeout 90m
 === RUN TestAccVpc_basic
 2015/02/10 14:11:17 [INFO] Test: Using us-west-2 as test region
 [...]
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 000000000..81549cc2f
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,83 @@
+# Releasing Terraform
+
+This document contains details about the Terraform release process.
+
+## Schedule
+
+Terraform currently has no fixed release schedule, the HashiCorp maintainers
+can usually give a feel for roughly when the next release is planned.
+
+## Versioning
+
+As a pre-1.0 project, we use the MINOR and PATCH versions as follows:
+
+ * a `MINOR` version increment indicates a release that may contain backwards
+   incompatible changes
+ * a `PATCH` version increment indicates a release that may contain bugfixes as
+   well as additive (backwards compatible) features and enhancements
+
+## Process
+
+For maintainer documentation purposes, here is the current release process:
+
+```sh
+# Spin up a fresh build VM
+vagrant destroy -f
+vagrant up
+vagrant ssh
+cd /opt/gopath/src/github.com/hashicorp/terraform/
+
+# Fetch dependencies
+make updatedeps
+
+# Verify unit tests pass
+make test
+
+# Prep release commit
+export VERSION="vX.Y.Z"
+# Edit CHANGELOG.md, adding current date to unreleased version header
+# Edit version.go, setting VersionPrelease to empty string
+
+# Snapshot dependency information
+godep save ./...
+cp Godeps/Godeps.json deps/$(echo $VERSION | sed 's/\./-/g').json
+
+# Make and tag release commit (skipping Godeps dir)
+git add CHANGELOG.md terraform/version.go deps/
+git commit -a -m "${VERSION}"
+git tag -m "${VERSION}" "${VERSION}"
+
+# Build the release
+make release
+
+# Make an archive with vendored dependencies
+stashName=$(git stash)
+git archive -o terraform-$VERSION-src.tar.gz $stashName
+
+# Zip and push release to bintray
+export BINTRAY_API_KEY="..."
+./scripts/dist "X.Y.Z" # no `v` prefix here
+
+# -- "Point of no return" --
+# -- Process can be aborted safely at any point before this --
+
+# Push the release commit and tag
+git push origin master
+git push origin vX.Y.Z
+
+# Click "publish" on the release from the Bintray Web UI
+# Upload terraform-$VERSION-src.tar.gz as a file to the GitHub release.
+
+# -- Release is complete! --
+
+# Start release branch (to be used for reproducible builds and docs updates)
+git checkout -b release/$VERSION
+git push origin release/$VERSION
+
+# Clean up master
+git checkout master
+# Set VersionPrerelease to "dev"
+# Add new CHANGELOG section for next release
+git add -A
+git commit -m "release: clean up after ${VERSION}"
+```
diff --git a/Vagrantfile b/Vagrantfile
index 687bc09af..3017ff58c 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -5,34 +5,52 @@
 VAGRANTFILE_API_VERSION = "2"
 
 $script = <<SCRIPT
-# Install Go and prerequisites
-apt-get -qq update
-apt-get -qq install build-essential curl git-core libpcre3-dev mercurial pkg-config zip
-hg clone -u release https://code.google.com/p/go /opt/go
-cd /opt/go/src && ./all.bash
+SRCROOT="/opt/go"
+SRCPATH="/opt/gopath"
 
-# Setup the GOPATH
-mkdir -p /opt/gopath
-cat <<EOF >/etc/profile.d/gopath.sh
-export GOPATH="/opt/gopath"
-export PATH="/opt/go/bin:\$GOPATH/bin:\$PATH"
+# Get the ARCH
+ARCH=`uname -m | sed 's|i686|386|' | sed 's|x86_64|amd64|'`
+
+# Install Prereq Packages
+sudo apt-get update
+sudo apt-get install -y build-essential curl git-core libpcre3-dev mercurial pkg-config zip
+
+# Install Go
+cd /tmp
+wget -q https://storage.googleapis.com/golang/go1.4.2.linux-${ARCH}.tar.gz
+tar -xf go1.4.2.linux-${ARCH}.tar.gz
+sudo mv go $SRCROOT
+sudo chmod 775 $SRCROOT
+sudo chown vagrant:vagrant $SRCROOT
+
+# Setup the GOPATH; even though the shared folder spec gives the working
+# directory the right user/group, we need to set it properly on the
+# parent path to allow subsequent "go get" commands to work.
+sudo mkdir -p $SRCPATH
+sudo chown -R vagrant:vagrant $SRCPATH 2>/dev/null || true
+# ^^ silencing errors here because we expect this to fail for the shared folder
+
+cat <<EOF >/tmp/gopath.sh
+export GOPATH="$SRCPATH"
+export GOROOT="$SRCROOT"
+export PATH="$SRCROOT/bin:$SRCPATH/bin:\$PATH"
 EOF
-
-# Make sure the GOPATH is usable by vagrant
-chown -R vagrant:vagrant /opt/go
-chown -R vagrant:vagrant /opt/gopath
+sudo mv /tmp/gopath.sh /etc/profile.d/gopath.sh
+sudo chmod 0755 /etc/profile.d/gopath.sh
+source /etc/profile.d/gopath.sh
 SCRIPT
 
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
   config.vm.box = "chef/ubuntu-12.04"
 
-  config.vm.provision "shell", inline: $script
+  config.vm.provision "shell", inline: $script, privileged: false
+  config.vm.synced_folder '.', '/opt/gopath/src/github.com/hashicorp/terraform'
 
   ["vmware_fusion", "vmware_workstation"].each do |p|
-    config.vm.provider "p" do |v|
-      v.vmx["memsize"] = "2048"
-      v.vmx["numvcpus"] = "2"
-      v.vmx["cpuid.coresPerSocket"] = "1"
+    config.vm.provider p do |v|
+      v.vmx["memsize"] = "4096"
+      v.vmx["numvcpus"] = "4"
+      v.vmx['cpuid.coresPerSocket'] = '2'
     end
   end
 end
diff --git a/builtin/bins/provider-azure/main.go b/builtin/bins/provider-azure/main.go
new file mode 100644
index 000000000..45af21656
--- /dev/null
+++ b/builtin/bins/provider-azure/main.go
@@ -0,0 +1,12 @@
+package main
+
+import (
+	"github.com/hashicorp/terraform/builtin/providers/azure"
+	"github.com/hashicorp/terraform/plugin"
+)
+
+func main() {
+	plugin.Serve(&plugin.ServeOpts{
+		ProviderFunc: azure.Provider,
+	})
+}
diff --git a/builtin/bins/provider-azure/main_test.go b/builtin/bins/provider-azure/main_test.go
new file mode 100644
index 000000000..06ab7d0f9
--- /dev/null
+++ b/builtin/bins/provider-azure/main_test.go
@@ -0,0 +1 @@
+package main
diff --git a/builtin/providers/aws/autoscaling_tags.go b/builtin/providers/aws/autoscaling_tags.go
index ee4724852..9a41a3291 100644
--- a/builtin/providers/aws/autoscaling_tags.go
+++ b/builtin/providers/aws/autoscaling_tags.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/autoscaling_tags_test.go b/builtin/providers/aws/autoscaling_tags_test.go
index c14e366ce..b401fa2e4 100644
--- a/builtin/providers/aws/autoscaling_tags_test.go
+++ b/builtin/providers/aws/autoscaling_tags_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/config.go b/builtin/providers/aws/config.go
index ff742436b..bc465394c 100644
--- a/builtin/providers/aws/config.go
+++ b/builtin/providers/aws/config.go
@@ -7,17 +7,23 @@ import (
 
 	"github.com/hashicorp/terraform/helper/multierror"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/credentials"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/iam"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
-	"github.com/awslabs/aws-sdk-go/service/s3"
-	"github.com/awslabs/aws-sdk-go/service/sqs"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/aws/aws-sdk-go/service/sqs"
 )
 
 type Config struct {
@@ -32,16 +38,22 @@ type Config struct {
 }
 
 type AWSClient struct {
+	cloudwatchconn  *cloudwatch.CloudWatch
+	dynamodbconn    *dynamodb.DynamoDB
 	ec2conn         *ec2.EC2
+	ecsconn         *ecs.ECS
 	elbconn         *elb.ELB
 	autoscalingconn *autoscaling.AutoScaling
 	s3conn          *s3.S3
 	sqsconn         *sqs.SQS
+	snsconn         *sns.SNS
 	r53conn         *route53.Route53
 	region          string
 	rdsconn         *rds.RDS
 	iamconn         *iam.IAM
+	kinesisconn     *kinesis.Kinesis
 	elasticacheconn *elasticache.ElastiCache
+	lambdaconn      *lambda.Lambda
 }
 
 // Client configures and returns a fully initailized AWSClient
@@ -64,22 +76,18 @@ func (c *Config) Client() (interface{}, error) {
 		client.region = c.Region
 
 		log.Println("[INFO] Building AWS auth structure")
-		creds := credentials.NewChainCredentials([]credentials.Provider{
-			&credentials.StaticProvider{Value: credentials.Value{
-				AccessKeyID:     c.AccessKey,
-				SecretAccessKey: c.SecretKey,
-				SessionToken:    c.Token,
-			}},
-			&credentials.EnvProvider{},
-			&credentials.SharedCredentialsProvider{Filename: "", Profile: ""},
-			&credentials.EC2RoleProvider{},
-		})
+		// We fetched all credential sources in Provider. If they are
+		// available, they'll already be in c. See Provider definition.
+		creds := credentials.NewStaticCredentials(c.AccessKey, c.SecretKey, c.Token)
 		awsConfig := &aws.Config{
 			Credentials: creds,
 			Region:      c.Region,
 			MaxRetries:  c.MaxRetries,
 		}
 
+		log.Println("[INFO] Initializing DynamoDB connection")
+		client.dynamodbconn = dynamodb.New(awsConfig)
+
 		log.Println("[INFO] Initializing ELB connection")
 		client.elbconn = elb.New(awsConfig)
 
@@ -89,12 +97,18 @@ func (c *Config) Client() (interface{}, error) {
 		log.Println("[INFO] Initializing SQS connection")
 		client.sqsconn = sqs.New(awsConfig)
 
+		log.Println("[INFO] Initializing SNS connection")
+		client.snsconn = sns.New(awsConfig)
+
 		log.Println("[INFO] Initializing RDS Connection")
 		client.rdsconn = rds.New(awsConfig)
 
 		log.Println("[INFO] Initializing IAM Connection")
 		client.iamconn = iam.New(awsConfig)
 
+		log.Println("[INFO] Initializing Kinesis Connection")
+		client.kinesisconn = kinesis.New(awsConfig)
+
 		err := c.ValidateAccountId(client.iamconn)
 		if err != nil {
 			errs = append(errs, err)
@@ -106,6 +120,9 @@ func (c *Config) Client() (interface{}, error) {
 		log.Println("[INFO] Initializing EC2 Connection")
 		client.ec2conn = ec2.New(awsConfig)
 
+		log.Println("[INFO] Initializing ECS Connection")
+		client.ecsconn = ecs.New(awsConfig)
+
 		// aws-sdk-go uses v4 for signing requests, which requires all global
 		// endpoints to use 'us-east-1'.
 		// See http://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html
@@ -118,6 +135,12 @@ func (c *Config) Client() (interface{}, error) {
 
 		log.Println("[INFO] Initializing Elasticache Connection")
 		client.elasticacheconn = elasticache.New(awsConfig)
+
+		log.Println("[INFO] Initializing Lambda Connection")
+		client.lambdaconn = lambda.New(awsConfig)
+
+		log.Println("[INFO] Initializing CloudWatch SDK connection")
+		client.cloudwatchconn = cloudwatch.New(awsConfig)
 	}
 
 	if len(errs) > 0 {
diff --git a/builtin/providers/aws/network_acl_entry.go b/builtin/providers/aws/network_acl_entry.go
index 7ba87712c..908bc885a 100644
--- a/builtin/providers/aws/network_acl_entry.go
+++ b/builtin/providers/aws/network_acl_entry.go
@@ -5,8 +5,8 @@ import (
 	"net"
 	"strconv"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func expandNetworkAclEntries(configured []interface{}, entryType string) ([]*ec2.NetworkACLEntry, error) {
@@ -34,6 +34,18 @@ func expandNetworkAclEntries(configured []interface{}, entryType string) ([]*ec2
 			RuleNumber: aws.Long(int64(data["rule_no"].(int))),
 			CIDRBlock:  aws.String(data["cidr_block"].(string)),
 		}
+
+		// Specify additional required fields for ICMP
+		if p == 1 {
+			e.ICMPTypeCode = &ec2.ICMPTypeCode{}
+			if v, ok := data["icmp_code"]; ok {
+				e.ICMPTypeCode.Code = aws.Long(int64(v.(int)))
+			}
+			if v, ok := data["icmp_type"]; ok {
+				e.ICMPTypeCode.Type = aws.Long(int64(v.(int)))
+			}
+		}
+
 		entries = append(entries, e)
 	}
 	return entries, nil
@@ -60,6 +72,9 @@ func flattenNetworkAclEntries(list []*ec2.NetworkACLEntry) []map[string]interfac
 func protocolIntegers() map[string]int {
 	var protocolIntegers = make(map[string]int)
 	protocolIntegers = map[string]int{
+		// defined at https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+		"ah":   51,
+		"esp":  50,
 		"udp":  17,
 		"tcp":  6,
 		"icmp": 1,
diff --git a/builtin/providers/aws/network_acl_entry_test.go b/builtin/providers/aws/network_acl_entry_test.go
index 95fa69dae..c34b7dfc3 100644
--- a/builtin/providers/aws/network_acl_entry_test.go
+++ b/builtin/providers/aws/network_acl_entry_test.go
@@ -4,8 +4,8 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func Test_expandNetworkACLEntry(t *testing.T) {
diff --git a/builtin/providers/aws/provider.go b/builtin/providers/aws/provider.go
index db90549d2..8f1a81417 100644
--- a/builtin/providers/aws/provider.go
+++ b/builtin/providers/aws/provider.go
@@ -1,6 +1,11 @@
 package aws
 
 import (
+	"net"
+	"sync"
+	"time"
+
+	"github.com/awslabs/aws-sdk-go/aws/credentials"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
@@ -11,35 +16,95 @@ func Provider() terraform.ResourceProvider {
 	// TODO: Move the validation to this, requires conditional schemas
 	// TODO: Move the configuration to this, requires validation
 
+	// These variables are closed within the `getCreds` function below.
+	// This function is responsible for reading credentials from the
+	// environment in the case that they're not explicitly specified
+	// in the Terraform configuration.
+	//
+	// By using the getCreds function here instead of making the default
+	// empty, we avoid asking for input on credentials if they're available
+	// in the environment.
+	var credVal credentials.Value
+	var credErr error
+	var once sync.Once
+	getCreds := func() {
+		// Build the list of providers to look for creds in
+		providers := []credentials.Provider{
+			&credentials.EnvProvider{},
+			&credentials.SharedCredentialsProvider{},
+		}
+
+		// We only look in the EC2 metadata API if we can connect
+		// to the metadata service within a reasonable amount of time
+		conn, err := net.DialTimeout("tcp", "169.254.169.254:80", 100*time.Millisecond)
+		if err == nil {
+			conn.Close()
+			providers = append(providers, &credentials.EC2RoleProvider{})
+		}
+
+		credVal, credErr = credentials.NewChainCredentials(providers).Get()
+
+		// If we didn't successfully find any credentials, just
+		// set the error to nil.
+		if credErr == credentials.ErrNoValidProvidersFoundInChain {
+			credErr = nil
+		}
+	}
+
+	// getCredDefault is a function used by DefaultFunc below to
+	// get the default value for various parts of the credentials.
+	// This function properly handles loading the credentials, checking
+	// for errors, etc.
+	getCredDefault := func(def interface{}, f func() string) (interface{}, error) {
+		once.Do(getCreds)
+
+		// If there was an error, that is always first
+		if credErr != nil {
+			return nil, credErr
+		}
+
+		// If the value is empty string, return nil (not set)
+		val := f()
+		if val == "" {
+			return def, nil
+		}
+
+		return val, nil
+	}
+
+	// The actual provider
 	return &schema.Provider{
 		Schema: map[string]*schema.Schema{
 			"access_key": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_ACCESS_KEY",
-					"AWS_ACCESS_KEY_ID",
-				}, nil),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault(nil, func() string {
+						return credVal.AccessKeyID
+					})
+				},
 				Description: descriptions["access_key"],
 			},
 
 			"secret_key": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_SECRET_KEY",
-					"AWS_SECRET_ACCESS_KEY",
-				}, nil),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault(nil, func() string {
+						return credVal.SecretAccessKey
+					})
+				},
 				Description: descriptions["secret_key"],
 			},
 
 			"token": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
-				DefaultFunc: schema.MultiEnvDefaultFunc([]string{
-					"AWS_SESSION_TOKEN",
-					"AWS_SECURITY_TOKEN",
-				}, ""),
+				DefaultFunc: func() (interface{}, error) {
+					return getCredDefault("", func() string {
+						return credVal.SessionToken
+					})
+				},
 				Description: descriptions["token"],
 			},
 
@@ -85,45 +150,65 @@ func Provider() terraform.ResourceProvider {
 		ResourcesMap: map[string]*schema.Resource{
 			"aws_app_cookie_stickiness_policy": resourceAwsAppCookieStickinessPolicy(),
 			"aws_autoscaling_group":            resourceAwsAutoscalingGroup(),
+			"aws_autoscaling_notification":     resourceAwsAutoscalingNotification(),
+			"aws_autoscaling_policy":           resourceAwsAutoscalingPolicy(),
+			"aws_cloudwatch_metric_alarm":      resourceAwsCloudWatchMetricAlarm(),
 			"aws_customer_gateway":             resourceAwsCustomerGateway(),
 			"aws_db_instance":                  resourceAwsDbInstance(),
 			"aws_db_parameter_group":           resourceAwsDbParameterGroup(),
 			"aws_db_security_group":            resourceAwsDbSecurityGroup(),
 			"aws_db_subnet_group":              resourceAwsDbSubnetGroup(),
+			"aws_dynamodb_table":               resourceAwsDynamoDbTable(),
 			"aws_ebs_volume":                   resourceAwsEbsVolume(),
+			"aws_ecs_cluster":                  resourceAwsEcsCluster(),
+			"aws_ecs_service":                  resourceAwsEcsService(),
+			"aws_ecs_task_definition":          resourceAwsEcsTaskDefinition(),
 			"aws_eip":                          resourceAwsEip(),
 			"aws_elasticache_cluster":          resourceAwsElasticacheCluster(),
+			"aws_elasticache_parameter_group":  resourceAwsElasticacheParameterGroup(),
 			"aws_elasticache_security_group":   resourceAwsElasticacheSecurityGroup(),
 			"aws_elasticache_subnet_group":     resourceAwsElasticacheSubnetGroup(),
 			"aws_elb":                          resourceAwsElb(),
+			"aws_flow_log":                     resourceAwsFlowLog(),
 			"aws_iam_access_key":               resourceAwsIamAccessKey(),
 			"aws_iam_group_policy":             resourceAwsIamGroupPolicy(),
 			"aws_iam_group":                    resourceAwsIamGroup(),
+			"aws_iam_group_membership":         resourceAwsIamGroupMembership(),
 			"aws_iam_instance_profile":         resourceAwsIamInstanceProfile(),
 			"aws_iam_policy":                   resourceAwsIamPolicy(),
+			"aws_iam_policy_attachment":        resourceAwsIamPolicyAttachment(),
 			"aws_iam_role_policy":              resourceAwsIamRolePolicy(),
 			"aws_iam_role":                     resourceAwsIamRole(),
+			"aws_iam_server_certificate":       resourceAwsIAMServerCertificate(),
 			"aws_iam_user_policy":              resourceAwsIamUserPolicy(),
 			"aws_iam_user":                     resourceAwsIamUser(),
 			"aws_instance":                     resourceAwsInstance(),
 			"aws_internet_gateway":             resourceAwsInternetGateway(),
 			"aws_key_pair":                     resourceAwsKeyPair(),
+			"aws_kinesis_stream":               resourceAwsKinesisStream(),
+			"aws_lambda_function":              resourceAwsLambdaFunction(),
 			"aws_launch_configuration":         resourceAwsLaunchConfiguration(),
 			"aws_lb_cookie_stickiness_policy":  resourceAwsLBCookieStickinessPolicy(),
 			"aws_main_route_table_association": resourceAwsMainRouteTableAssociation(),
 			"aws_network_acl":                  resourceAwsNetworkAcl(),
 			"aws_network_interface":            resourceAwsNetworkInterface(),
 			"aws_proxy_protocol_policy":        resourceAwsProxyProtocolPolicy(),
+			"aws_route53_delegation_set":       resourceAwsRoute53DelegationSet(),
 			"aws_route53_record":               resourceAwsRoute53Record(),
 			"aws_route53_zone_association":     resourceAwsRoute53ZoneAssociation(),
 			"aws_route53_zone":                 resourceAwsRoute53Zone(),
-			"aws_route_table_association":      resourceAwsRouteTableAssociation(),
+			"aws_route53_health_check":         resourceAwsRoute53HealthCheck(),
 			"aws_route_table":                  resourceAwsRouteTable(),
+			"aws_route_table_association":      resourceAwsRouteTableAssociation(),
 			"aws_s3_bucket":                    resourceAwsS3Bucket(),
 			"aws_security_group":               resourceAwsSecurityGroup(),
 			"aws_security_group_rule":          resourceAwsSecurityGroupRule(),
+			"aws_spot_instance_request":        resourceAwsSpotInstanceRequest(),
 			"aws_sqs_queue":                    resourceAwsSqsQueue(),
+			"aws_sns_topic":                    resourceAwsSnsTopic(),
+			"aws_sns_topic_subscription":       resourceAwsSnsTopicSubscription(),
 			"aws_subnet":                       resourceAwsSubnet(),
+			"aws_volume_attachment":            resourceAwsVolumeAttachment(),
 			"aws_vpc_dhcp_options_association": resourceAwsVpcDhcpOptionsAssociation(),
 			"aws_vpc_dhcp_options":             resourceAwsVpcDhcpOptions(),
 			"aws_vpc_peering_connection":       resourceAwsVpcPeeringConnection(),
diff --git a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
index 66c240826..ca459ead7 100644
--- a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
+++ b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
index 3e99ab71d..ff13da285 100644
--- a/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
+++ b/builtin/providers/aws/resource_aws_app_cookie_stickiness_policy_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSAppCookieStickinessPolicy(t *testing.T) {
+func TestAccAWSAppCookieStickinessPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_autoscaling_group.go b/builtin/providers/aws/resource_aws_autoscaling_group.go
index 19abd3da3..279e76122 100644
--- a/builtin/providers/aws/resource_aws_autoscaling_group.go
+++ b/builtin/providers/aws/resource_aws_autoscaling_group.go
@@ -9,10 +9,10 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/elb"
 )
 
 func resourceAwsAutoscalingGroup() *schema.Resource {
@@ -27,6 +27,15 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/9f322b1/botocore/data/autoscaling/2011-01-01/service-2.json#L1862-L1873
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"launch_configuration": &schema.Schema{
@@ -59,7 +68,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeInt,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 
 			"force_delete": &schema.Schema{
@@ -79,7 +87,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 
 			"availability_zones": &schema.Schema{
@@ -93,7 +100,6 @@ func resourceAwsAutoscalingGroup() *schema.Resource {
 			"load_balancers": &schema.Schema{
 				Type:     schema.TypeSet,
 				Optional: true,
-				ForceNew: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set:      schema.HashString,
 			},
@@ -221,6 +227,10 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		AutoScalingGroupName: aws.String(d.Id()),
 	}
 
+	if d.HasChange("default_cooldown") {
+		opts.DefaultCooldown = aws.Long(int64(d.Get("default_cooldown").(int)))
+	}
+
 	if d.HasChange("desired_capacity") {
 		opts.DesiredCapacity = aws.Long(int64(d.Get("desired_capacity").(int)))
 	}
@@ -241,6 +251,11 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		opts.HealthCheckGracePeriod = aws.Long(int64(d.Get("health_check_grace_period").(int)))
 	}
 
+	if d.HasChange("health_check_type") {
+		opts.HealthCheckGracePeriod = aws.Long(int64(d.Get("health_check_grace_period").(int)))
+		opts.HealthCheckType = aws.String(d.Get("health_check_type").(string))
+	}
+
 	if err := setAutoscalingTags(conn, d); err != nil {
 		return err
 	} else {
@@ -254,6 +269,42 @@ func resourceAwsAutoscalingGroupUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error updating Autoscaling group: %s", err)
 	}
 
+	if d.HasChange("load_balancers") {
+
+		o, n := d.GetChange("load_balancers")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+		remove := expandStringList(os.Difference(ns).List())
+		add := expandStringList(ns.Difference(os).List())
+
+		if len(remove) > 0 {
+			_, err := conn.DetachLoadBalancers(&autoscaling.DetachLoadBalancersInput{
+				AutoScalingGroupName: aws.String(d.Id()),
+				LoadBalancerNames:    remove,
+			})
+			if err != nil {
+				return fmt.Errorf("[WARN] Error updating Load Balancers for AutoScaling Group (%s), error: %s", d.Id(), err)
+			}
+		}
+
+		if len(add) > 0 {
+			_, err := conn.AttachLoadBalancers(&autoscaling.AttachLoadBalancersInput{
+				AutoScalingGroupName: aws.String(d.Id()),
+				LoadBalancerNames:    add,
+			})
+			if err != nil {
+				return fmt.Errorf("[WARN] Error updating Load Balancers for AutoScaling Group (%s), error: %s", d.Id(), err)
+			}
+		}
+	}
+
 	return resourceAwsAutoscalingGroupRead(d, meta)
 }
 
@@ -323,7 +374,7 @@ func resourceAwsAutoscalingGroupDelete(d *schema.ResourceData, meta interface{})
 
 func getAwsAutoscalingGroup(
 	d *schema.ResourceData,
-	meta interface{}) (*autoscaling.AutoScalingGroup, error) {
+	meta interface{}) (*autoscaling.Group, error) {
 	conn := meta.(*AWSClient).autoscalingconn
 
 	describeOpts := autoscaling.DescribeAutoScalingGroupsInput{
@@ -404,7 +455,7 @@ func waitForASGCapacity(d *schema.ResourceData, meta interface{}) error {
 	}
 	wantELB := d.Get("min_elb_capacity").(int)
 
-	log.Printf("[DEBUG] Wanting for capacity: %d ASG, %d ELB", wantASG, wantELB)
+	log.Printf("[DEBUG] Waiting for capacity: %d ASG, %d ELB", wantASG, wantELB)
 
 	return resource.Retry(waitForASGCapacityTimeout, func() error {
 		g, err := getAwsAutoscalingGroup(d, meta)
@@ -458,7 +509,7 @@ func waitForASGCapacity(d *schema.ResourceData, meta interface{}) error {
 			return nil
 		}
 
-		return fmt.Errorf("Still need to wait for more healthy instances.")
+		return fmt.Errorf("Still need to wait for more healthy instances. This could mean instances failed to launch. See Scaling History for more information.")
 	})
 }
 
@@ -466,7 +517,7 @@ func waitForASGCapacity(d *schema.ResourceData, meta interface{}) error {
 // provided ASG.
 //
 // Nested like: lbName -> instanceId -> instanceState
-func getLBInstanceStates(g *autoscaling.AutoScalingGroup, meta interface{}) (map[string]map[string]string, error) {
+func getLBInstanceStates(g *autoscaling.Group, meta interface{}) (map[string]map[string]string, error) {
 	lbInstanceStates := make(map[string]map[string]string)
 	elbconn := meta.(*AWSClient).elbconn
 
diff --git a/builtin/providers/aws/resource_aws_autoscaling_group_test.go b/builtin/providers/aws/resource_aws_autoscaling_group_test.go
index bddf05c3f..cc3cdf6e5 100644
--- a/builtin/providers/aws/resource_aws_autoscaling_group_test.go
+++ b/builtin/providers/aws/resource_aws_autoscaling_group_test.go
@@ -6,15 +6,15 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
 func TestAccAWSAutoScalingGroup_basic(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 	var lc autoscaling.LaunchConfiguration
 
 	resource.Test(t, resource.TestCase{
@@ -68,7 +68,7 @@ func TestAccAWSAutoScalingGroup_basic(t *testing.T) {
 }
 
 func TestAccAWSAutoScalingGroup_tags(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -102,7 +102,7 @@ func TestAccAWSAutoScalingGroup_tags(t *testing.T) {
 }
 
 func TestAccAWSAutoScalingGroup_WithLoadBalancer(t *testing.T) {
-	var group autoscaling.AutoScalingGroup
+	var group autoscaling.Group
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -154,7 +154,7 @@ func testAccCheckAWSAutoScalingGroupDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if *group.AvailabilityZones[0] != "us-west-2a" {
 			return fmt.Errorf("Bad availability_zones: %#v", group.AvailabilityZones[0])
@@ -207,7 +207,7 @@ func testAccCheckAWSAutoScalingGroupAttributes(group *autoscaling.AutoScalingGro
 	}
 }
 
-func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if *group.LoadBalancerNames[0] != "foobar-terraform-test" {
 			return fmt.Errorf("Bad load_balancers: %#v", group.LoadBalancerNames[0])
@@ -217,7 +217,7 @@ func testAccCheckAWSAutoScalingGroupAttributesLoadBalancer(group *autoscaling.Au
 	}
 }
 
-func testAccCheckAWSAutoScalingGroupExists(n string, group *autoscaling.AutoScalingGroup) resource.TestCheckFunc {
+func testAccCheckAWSAutoScalingGroupExists(n string, group *autoscaling.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -266,7 +266,7 @@ func testLaunchConfigurationName(n string, lc *autoscaling.LaunchConfiguration)
 }
 
 func testAccCheckAWSAutoScalingGroupHealthyCapacity(
-	g *autoscaling.AutoScalingGroup, exp int) resource.TestCheckFunc {
+	g *autoscaling.Group, exp int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		healthy := 0
 		for _, i := range g.Instances {
@@ -343,9 +343,42 @@ resource "aws_autoscaling_group" "bar" {
 `
 
 const testAccAWSAutoScalingGroupConfigWithLoadBalancer = `
+resource "aws_vpc" "foo" {
+  cidr_block = "10.1.0.0/16"
+	tags { Name = "tf-asg-test" }
+}
+
+resource "aws_internet_gateway" "gw" {
+  vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_subnet" "foo" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_security_group" "foo" {
+  vpc_id="${aws_vpc.foo.id}"
+
+  ingress {
+    protocol = "-1"
+    from_port = 0
+    to_port = 0
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    protocol = "-1"
+    from_port = 0
+    to_port = 0
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
 resource "aws_elb" "bar" {
   name = "foobar-terraform-test"
-  availability_zones = ["us-west-2a"]
+  subnets = ["${aws_subnet.foo.id}"]
+	security_groups = ["${aws_security_group.foo.id}"]
 
   listener {
     instance_port = 80
@@ -361,6 +394,8 @@ resource "aws_elb" "bar" {
     interval = 5
     timeout = 2
   }
+
+	depends_on = ["aws_internet_gateway.gw"]
 }
 
 resource "aws_launch_configuration" "foobar" {
@@ -368,16 +403,18 @@ resource "aws_launch_configuration" "foobar" {
   // bitnami-nginxstack-1.6.1-0-linux-ubuntu-14.04.1-x86_64-hvm-ebs-ami-99f5b1a9-3
   image_id = "ami-b5b3fc85"
   instance_type = "t2.micro"
+	security_groups = ["${aws_security_group.foo.id}"]
 }
 
 resource "aws_autoscaling_group" "bar" {
-  availability_zones = ["us-west-2a"]
+  availability_zones = ["${aws_subnet.foo.availability_zone}"]
+	vpc_zone_identifier = ["${aws_subnet.foo.id}"]
   name = "foobar3-terraform-test"
   max_size = 2
   min_size = 2
   health_check_grace_period = 300
   health_check_type = "ELB"
-  min_elb_capacity = 1
+  min_elb_capacity = 2
   force_delete = true
 
   launch_configuration = "${aws_launch_configuration.foobar.name}"
diff --git a/builtin/providers/aws/resource_aws_autoscaling_notification.go b/builtin/providers/aws/resource_aws_autoscaling_notification.go
new file mode 100644
index 000000000..07adaa676
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_notification.go
@@ -0,0 +1,200 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsAutoscalingNotification() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsAutoscalingNotificationCreate,
+		Read:   resourceAwsAutoscalingNotificationRead,
+		Update: resourceAwsAutoscalingNotificationUpdate,
+		Delete: resourceAwsAutoscalingNotificationDelete,
+
+		Schema: map[string]*schema.Schema{
+			"topic_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"group_names": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+
+			"notifications": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+		},
+	}
+}
+
+func resourceAwsAutoscalingNotificationCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+	nl := convertSetToList(d.Get("notifications").(*schema.Set))
+
+	topic := d.Get("topic_arn").(string)
+	if err := addNotificationConfigToGroupsWithTopic(conn, gl, nl, topic); err != nil {
+		return err
+	}
+
+	// ARNs are unique, and these notifications are per ARN, so we re-use the ARN
+	// here as the ID
+	d.SetId(topic)
+	return resourceAwsAutoscalingNotificationRead(d, meta)
+}
+
+func resourceAwsAutoscalingNotificationRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+
+	opts := &autoscaling.DescribeNotificationConfigurationsInput{
+		AutoScalingGroupNames: gl,
+	}
+
+	resp, err := conn.DescribeNotificationConfigurations(opts)
+	if err != nil {
+		return fmt.Errorf("Error describing notifications")
+	}
+
+	topic := d.Get("topic_arn").(string)
+	// Grab all applicable notifcation configurations for this Topic.
+	// Each NotificationType will have a record, so 1 Group with 3 Types results
+	// in 3 records, all with the same Group name
+	gRaw := make(map[string]bool)
+	nRaw := make(map[string]bool)
+	for _, n := range resp.NotificationConfigurations {
+		if *n.TopicARN == topic {
+			gRaw[*n.AutoScalingGroupName] = true
+			nRaw[*n.NotificationType] = true
+		}
+	}
+
+	// Grab the keys here as the list of Groups
+	var gList []string
+	for k, _ := range gRaw {
+		gList = append(gList, k)
+	}
+
+	// Grab the keys here as the list of Types
+	var nList []string
+	for k, _ := range nRaw {
+		nList = append(nList, k)
+	}
+
+	if err := d.Set("group_names", gList); err != nil {
+		return err
+	}
+	if err := d.Set("notifications", nList); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceAwsAutoscalingNotificationUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+
+	// Notifications API call is a PUT, so we don't need to diff the list, just
+	// push whatever it is and AWS sorts it out
+	nl := convertSetToList(d.Get("notifications").(*schema.Set))
+
+	o, n := d.GetChange("group_names")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := convertSetToList(os.Difference(ns))
+	add := convertSetToList(ns.Difference(os))
+
+	topic := d.Get("topic_arn").(string)
+
+	if err := removeNotificationConfigToGroupsWithTopic(conn, remove, topic); err != nil {
+		return err
+	}
+
+	var update []*string
+	if d.HasChange("notifications") {
+		update = convertSetToList(d.Get("group_names").(*schema.Set))
+	} else {
+		update = add
+	}
+
+	if err := addNotificationConfigToGroupsWithTopic(conn, update, nl, topic); err != nil {
+		return err
+	}
+
+	return resourceAwsAutoscalingNotificationRead(d, meta)
+}
+
+func addNotificationConfigToGroupsWithTopic(conn *autoscaling.AutoScaling, groups []*string, nl []*string, topic string) error {
+	for _, a := range groups {
+		opts := &autoscaling.PutNotificationConfigurationInput{
+			AutoScalingGroupName: a,
+			NotificationTypes:    nl,
+			TopicARN:             aws.String(topic),
+		}
+
+		_, err := conn.PutNotificationConfiguration(opts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				return fmt.Errorf("[WARN] Error creating Autoscaling Group Notification for Group %s, error: \"%s\", code: \"%s\"", *a, awsErr.Message(), awsErr.Code())
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+func removeNotificationConfigToGroupsWithTopic(conn *autoscaling.AutoScaling, groups []*string, topic string) error {
+	for _, r := range groups {
+		opts := &autoscaling.DeleteNotificationConfigurationInput{
+			AutoScalingGroupName: r,
+			TopicARN:             aws.String(topic),
+		}
+
+		_, err := conn.DeleteNotificationConfiguration(opts)
+		if err != nil {
+			return fmt.Errorf("[WARN] Error deleting notification configuration for ASG \"%s\", Topic ARN \"%s\"", *r, topic)
+		}
+	}
+	return nil
+}
+
+func resourceAwsAutoscalingNotificationDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).autoscalingconn
+	gl := convertSetToList(d.Get("group_names").(*schema.Set))
+
+	topic := d.Get("topic_arn").(string)
+	if err := removeNotificationConfigToGroupsWithTopic(conn, gl, topic); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func convertSetToList(s *schema.Set) (nl []*string) {
+	l := s.List()
+	for _, n := range l {
+		nl = append(nl, aws.String(n.(string)))
+	}
+
+	return nl
+}
diff --git a/builtin/providers/aws/resource_aws_autoscaling_notification_test.go b/builtin/providers/aws/resource_aws_autoscaling_notification_test.go
new file mode 100644
index 000000000..4198d2b07
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_notification_test.go
@@ -0,0 +1,252 @@
+package aws
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSASGNotification_basic(t *testing.T) {
+	var asgn autoscaling.DescribeNotificationConfigurationsOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckASGNDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSASGNotification_update(t *testing.T) {
+	var asgn autoscaling.DescribeNotificationConfigurationsOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckASGNDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccASGNotificationConfig_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckASGNotificationExists("aws_autoscaling_notification.example", []string{"foobar1-terraform-test", "barfoo-terraform-test"}, &asgn),
+					testAccCheckAWSASGNotificationAttributes("aws_autoscaling_notification.example", &asgn),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckASGNotificationExists(n string, groups []string, asgn *autoscaling.DescribeNotificationConfigurationsOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ASG Notification ID is set")
+		}
+
+		var gl []*string
+		for _, g := range groups {
+			gl = append(gl, aws.String(g))
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		opts := &autoscaling.DescribeNotificationConfigurationsInput{
+			AutoScalingGroupNames: gl,
+		}
+
+		resp, err := conn.DescribeNotificationConfigurations(opts)
+		if err != nil {
+			return fmt.Errorf("Error describing notifications")
+		}
+
+		*asgn = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckASGNDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_autoscaling_notification" {
+			continue
+		}
+
+		groups := []*string{aws.String("foobar1-terraform-test")}
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		opts := &autoscaling.DescribeNotificationConfigurationsInput{
+			AutoScalingGroupNames: groups,
+		}
+
+		resp, err := conn.DescribeNotificationConfigurations(opts)
+		if err != nil {
+			return fmt.Errorf("Error describing notifications")
+		}
+
+		if len(resp.NotificationConfigurations) != 0 {
+			fmt.Errorf("Error finding notification descriptions")
+		}
+
+	}
+	return nil
+}
+
+func testAccCheckAWSASGNotificationAttributes(n string, asgn *autoscaling.DescribeNotificationConfigurationsOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ASG Notification ID is set")
+		}
+
+		if len(asgn.NotificationConfigurations) == 0 {
+			return fmt.Errorf("Error: no ASG Notifications found")
+		}
+
+		// build a unique list of groups, notification types
+		gRaw := make(map[string]bool)
+		nRaw := make(map[string]bool)
+		for _, n := range asgn.NotificationConfigurations {
+			if *n.TopicARN == rs.Primary.Attributes["topic_arn"] {
+				gRaw[*n.AutoScalingGroupName] = true
+				nRaw[*n.NotificationType] = true
+			}
+		}
+
+		// Grab the keys here as the list of Groups
+		var gList []string
+		for k, _ := range gRaw {
+			gList = append(gList, k)
+		}
+
+		// Grab the keys here as the list of Types
+		var nList []string
+		for k, _ := range nRaw {
+			nList = append(nList, k)
+		}
+
+		typeCount, _ := strconv.Atoi(rs.Primary.Attributes["notifications.#"])
+
+		if len(nList) != typeCount {
+			return fmt.Errorf("Error: Bad ASG Notification count, expected (%d), got (%d)", typeCount, len(nList))
+		}
+
+		groupCount, _ := strconv.Atoi(rs.Primary.Attributes["group_names.#"])
+
+		if len(gList) != groupCount {
+			return fmt.Errorf("Error: Bad ASG Group count, expected (%d), got (%d)", typeCount, len(gList))
+		}
+
+		return nil
+	}
+}
+
+const testAccASGNotificationConfig_basic = `
+resource "aws_sns_topic" "topic_example" {
+  name = "user-updates-topic"
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "foobarautoscaling-terraform-test"
+  image_id = "ami-21f78e11"
+  instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-west-2a"]
+  name = "foobar1-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 100
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_notification" "example" {
+  group_names     = ["${aws_autoscaling_group.bar.name}"]
+  notifications  = [
+	"autoscaling:EC2_INSTANCE_LAUNCH", 
+	"autoscaling:EC2_INSTANCE_TERMINATE", 
+  ]
+  topic_arn = "${aws_sns_topic.topic_example.arn}"
+}
+`
+
+const testAccASGNotificationConfig_update = `
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+
+resource "aws_launch_configuration" "foobar" {
+  name = "foobarautoscaling-terraform-test"
+  image_id = "ami-21f78e11"
+  instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-west-2a"]
+  name = "foobar1-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 100
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_group" "foo" {
+  availability_zones = ["us-west-2b"]
+  name = "barfoo-terraform-test"
+  max_size = 1
+  min_size = 1
+  health_check_grace_period = 200
+  health_check_type = "ELB"
+  desired_capacity = 1
+  force_delete = true
+  termination_policies = ["OldestInstance"]
+  launch_configuration = "${aws_launch_configuration.foobar.name}"
+}
+
+resource "aws_autoscaling_notification" "example" {
+	group_names     = [
+	"${aws_autoscaling_group.bar.name}",
+	"${aws_autoscaling_group.foo.name}",
+	]
+	notifications  = [
+		"autoscaling:EC2_INSTANCE_LAUNCH", 
+		"autoscaling:EC2_INSTANCE_TERMINATE",
+		"autoscaling:EC2_INSTANCE_LAUNCH_ERROR"
+	]
+	topic_arn = "${aws_sns_topic.user_updates.arn}"
+}`
diff --git a/builtin/providers/aws/resource_aws_autoscaling_policy.go b/builtin/providers/aws/resource_aws_autoscaling_policy.go
new file mode 100644
index 000000000..d2f6d2d47
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_policy.go
@@ -0,0 +1,181 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsAutoscalingPolicy() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsAutoscalingPolicyCreate,
+		Read:   resourceAwsAutoscalingPolicyRead,
+		Update: resourceAwsAutoscalingPolicyUpdate,
+		Delete: resourceAwsAutoscalingPolicyDelete,
+
+		Schema: map[string]*schema.Schema{
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"adjustment_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"autoscaling_group_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"cooldown": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"min_adjustment_step": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"scaling_adjustment": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAwsAutoscalingPolicyCreate(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := getAwsAutoscalingPutScalingPolicyInput(d)
+
+	log.Printf("[DEBUG] AutoScaling PutScalingPolicy: %#v", params)
+	resp, err := autoscalingconn.PutScalingPolicy(&params)
+	if err != nil {
+		return fmt.Errorf("Error putting scaling policy: %s", err)
+	}
+
+	d.Set("arn", resp.PolicyARN)
+	d.SetId(d.Get("name").(string))
+	log.Printf("[INFO] AutoScaling Scaling PolicyARN: %s", d.Get("arn").(string))
+
+	return resourceAwsAutoscalingPolicyRead(d, meta)
+}
+
+func resourceAwsAutoscalingPolicyRead(d *schema.ResourceData, meta interface{}) error {
+	p, err := getAwsAutoscalingPolicy(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		d.SetId("")
+		return nil
+	}
+
+	log.Printf("[DEBUG] Read Scaling Policy: ASG: %s, SP: %s, Obj: %#v", d.Get("autoscaling_group_name"), d.Get("name"), p)
+
+	d.Set("adjustment_type", p.AdjustmentType)
+	d.Set("autoscaling_group_name", p.AutoScalingGroupName)
+	d.Set("cooldown", p.Cooldown)
+	d.Set("min_adjustment_step", p.MinAdjustmentStep)
+	d.Set("arn", p.PolicyARN)
+	d.Set("name", p.PolicyName)
+	d.Set("scaling_adjustment", p.ScalingAdjustment)
+
+	return nil
+}
+
+func resourceAwsAutoscalingPolicyUpdate(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := getAwsAutoscalingPutScalingPolicyInput(d)
+
+	log.Printf("[DEBUG] Autoscaling Update Scaling Policy: %#v", params)
+	_, err := autoscalingconn.PutScalingPolicy(&params)
+	if err != nil {
+		return err
+	}
+
+	return resourceAwsAutoscalingPolicyRead(d, meta)
+}
+
+func resourceAwsAutoscalingPolicyDelete(d *schema.ResourceData, meta interface{}) error {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+	p, err := getAwsAutoscalingPolicy(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		return nil
+	}
+
+	params := autoscaling.DeletePolicyInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyName:           aws.String(d.Get("name").(string)),
+	}
+	if _, err := autoscalingconn.DeletePolicy(&params); err != nil {
+		return fmt.Errorf("Autoscaling Scaling Policy: %s ", err)
+	}
+
+	d.SetId("")
+	return nil
+}
+
+// PutScalingPolicy seems to require all params to be resent, so create and update can share this common function
+func getAwsAutoscalingPutScalingPolicyInput(d *schema.ResourceData) autoscaling.PutScalingPolicyInput {
+	var params = autoscaling.PutScalingPolicyInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyName:           aws.String(d.Get("name").(string)),
+	}
+
+	if v, ok := d.GetOk("adjustment_type"); ok {
+		params.AdjustmentType = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("cooldown"); ok {
+		params.Cooldown = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("scaling_adjustment"); ok {
+		params.ScalingAdjustment = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("min_adjustment_step"); ok {
+		params.MinAdjustmentStep = aws.Long(int64(v.(int)))
+	}
+
+	return params
+}
+
+func getAwsAutoscalingPolicy(d *schema.ResourceData, meta interface{}) (*autoscaling.ScalingPolicy, error) {
+	autoscalingconn := meta.(*AWSClient).autoscalingconn
+
+	params := autoscaling.DescribePoliciesInput{
+		AutoScalingGroupName: aws.String(d.Get("autoscaling_group_name").(string)),
+		PolicyNames:          []*string{aws.String(d.Get("name").(string))},
+	}
+
+	log.Printf("[DEBUG] AutoScaling Scaling Policy Describe Params: %#v", params)
+	resp, err := autoscalingconn.DescribePolicies(&params)
+	if err != nil {
+		return nil, fmt.Errorf("Error retrieving scaling policies: %s", err)
+	}
+
+	// find scaling policy
+	name := d.Get("name")
+	for idx, sp := range resp.ScalingPolicies {
+		if *sp.PolicyName == name {
+			return resp.ScalingPolicies[idx], nil
+		}
+	}
+
+	// policy not found
+	return nil, nil
+}
diff --git a/builtin/providers/aws/resource_aws_autoscaling_policy_test.go b/builtin/providers/aws/resource_aws_autoscaling_policy_test.go
new file mode 100644
index 000000000..0a7aeff91
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_autoscaling_policy_test.go
@@ -0,0 +1,115 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSAutoscalingPolicy_basic(t *testing.T) {
+	var policy autoscaling.ScalingPolicy
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSAutoscalingPolicyDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSAutoscalingPolicyConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScalingPolicyExists("aws_autoscaling_policy.foobar", &policy),
+					resource.TestCheckResourceAttr("aws_autoscaling_policy.foobar", "adjustment_type", "ChangeInCapacity"),
+					resource.TestCheckResourceAttr("aws_autoscaling_policy.foobar", "cooldown", "300"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckScalingPolicyExists(n string, policy *autoscaling.ScalingPolicy) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			rs = rs
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+		params := &autoscaling.DescribePoliciesInput{
+			AutoScalingGroupName: aws.String(rs.Primary.Attributes["autoscaling_group_name"]),
+			PolicyNames:          []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribePolicies(params)
+		if err != nil {
+			return err
+		}
+		if len(resp.ScalingPolicies) == 0 {
+			return fmt.Errorf("ScalingPolicy not found")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAWSAutoscalingPolicyDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).autoscalingconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_autoscaling_group" {
+			continue
+		}
+
+		params := autoscaling.DescribePoliciesInput{
+			AutoScalingGroupName: aws.String(rs.Primary.Attributes["autoscaling_group_name"]),
+			PolicyNames:          []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribePolicies(&params)
+
+		if err == nil {
+			if len(resp.ScalingPolicies) != 0 &&
+				*resp.ScalingPolicies[0].PolicyName == rs.Primary.ID {
+				return fmt.Errorf("Scaling Policy Still Exists: %s", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+var testAccAWSAutoscalingPolicyConfig = fmt.Sprintf(`
+resource "aws_launch_configuration" "foobar" {
+    name = "terraform-test-foobar5"
+    image_id = "ami-21f78e11"
+    instance_type = "t1.micro"
+}
+
+resource "aws_autoscaling_group" "foobar" {
+    availability_zones = ["us-west-2a"]
+    name = "terraform-test-foobar5"
+    max_size = 5
+    min_size = 2
+    health_check_grace_period = 300
+    health_check_type = "ELB"
+    force_delete = true
+    termination_policies = ["OldestInstance"]
+    launch_configuration = "${aws_launch_configuration.foobar.name}"
+    tag {
+        key = "Foo"
+        value = "foo-bar"
+        propagate_at_launch = true
+    }
+}
+
+resource "aws_autoscaling_policy" "foobar" {
+    name = "foobar"
+    scaling_adjustment = 4
+    adjustment_type = "ChangeInCapacity"
+    cooldown = 300
+    autoscaling_group_name = "${aws_autoscaling_group.foobar.name}"
+}
+`)
diff --git a/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go
new file mode 100644
index 000000000..4c8b40140
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm.go
@@ -0,0 +1,288 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+)
+
+func resourceAwsCloudWatchMetricAlarm() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsCloudWatchMetricAlarmCreate,
+		Read:   resourceAwsCloudWatchMetricAlarmRead,
+		Update: resourceAwsCloudWatchMetricAlarmUpdate,
+		Delete: resourceAwsCloudWatchMetricAlarmDelete,
+
+		Schema: map[string]*schema.Schema{
+			"alarm_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"comparison_operator": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"evaluation_periods": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"metric_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"namespace": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"period": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"statistic": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"threshold": &schema.Schema{
+				Type:     schema.TypeFloat,
+				Required: true,
+			},
+			"actions_enabled": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+			},
+			"alarm_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"alarm_description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"dimensions": &schema.Schema{
+				Type:     schema.TypeMap,
+				Optional: true,
+			},
+			"insufficient_data_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"ok_actions": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set: func(v interface{}) int {
+					return hashcode.String(v.(string))
+				},
+			},
+			"unit": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+		},
+	}
+}
+
+func resourceAwsCloudWatchMetricAlarmCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudwatchconn
+
+	params := getAwsCloudWatchPutMetricAlarmInput(d)
+
+	log.Printf("[DEBUG] Creating CloudWatch Metric Alarm: %#v", params)
+	_, err := conn.PutMetricAlarm(&params)
+	if err != nil {
+		return fmt.Errorf("Creating metric alarm failed: %s", err)
+	}
+	d.SetId(d.Get("alarm_name").(string))
+	log.Println("[INFO] CloudWatch Metric Alarm created")
+
+	return resourceAwsCloudWatchMetricAlarmRead(d, meta)
+}
+
+func resourceAwsCloudWatchMetricAlarmRead(d *schema.ResourceData, meta interface{}) error {
+	a, err := getAwsCloudWatchMetricAlarm(d, meta)
+	if err != nil {
+		return err
+	}
+	if a == nil {
+		d.SetId("")
+		return nil
+	}
+
+	log.Printf("[DEBUG] Reading CloudWatch Metric Alarm: %s", d.Get("alarm_name"))
+
+	d.Set("actions_enabled", a.ActionsEnabled)
+
+	if err := d.Set("alarm_actions", _strArrPtrToList(a.AlarmActions)); err != nil {
+		log.Printf("[WARN] Error setting Alarm Actions: %s", err)
+	}
+	d.Set("alarm_description", a.AlarmDescription)
+	d.Set("alarm_name", a.AlarmName)
+	d.Set("comparison_operator", a.ComparisonOperator)
+	d.Set("dimensions", a.Dimensions)
+	d.Set("evaluation_periods", a.EvaluationPeriods)
+
+	if err := d.Set("insufficient_data_actions", _strArrPtrToList(a.InsufficientDataActions)); err != nil {
+		log.Printf("[WARN] Error setting Insufficient Data Actions: %s", err)
+	}
+	d.Set("metric_name", a.MetricName)
+	d.Set("namespace", a.Namespace)
+
+	if err := d.Set("ok_actions", _strArrPtrToList(a.OKActions)); err != nil {
+		log.Printf("[WARN] Error setting OK Actions: %s", err)
+	}
+	d.Set("period", a.Period)
+	d.Set("statistic", a.Statistic)
+	d.Set("threshold", a.Threshold)
+	d.Set("unit", a.Unit)
+
+	return nil
+}
+
+func resourceAwsCloudWatchMetricAlarmUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudwatchconn
+	params := getAwsCloudWatchPutMetricAlarmInput(d)
+
+	log.Printf("[DEBUG] Updating CloudWatch Metric Alarm: %#v", params)
+	_, err := conn.PutMetricAlarm(&params)
+	if err != nil {
+		return fmt.Errorf("Updating metric alarm failed: %s", err)
+	}
+	log.Println("[INFO] CloudWatch Metric Alarm updated")
+
+	return resourceAwsCloudWatchMetricAlarmRead(d, meta)
+}
+
+func resourceAwsCloudWatchMetricAlarmDelete(d *schema.ResourceData, meta interface{}) error {
+	p, err := getAwsCloudWatchMetricAlarm(d, meta)
+	if err != nil {
+		return err
+	}
+	if p == nil {
+		log.Printf("[DEBUG] CloudWatch Metric Alarm %s is already gone", d.Id())
+		return nil
+	}
+
+	log.Printf("[INFO] Deleting CloudWatch Metric Alarm: %s", d.Id())
+
+	conn := meta.(*AWSClient).cloudwatchconn
+	params := cloudwatch.DeleteAlarmsInput{
+		AlarmNames: []*string{aws.String(d.Id())},
+	}
+
+	if _, err := conn.DeleteAlarms(&params); err != nil {
+		return fmt.Errorf("Error deleting CloudWatch Metric Alarm: %s", err)
+	}
+	log.Println("[INFO] CloudWatch Metric Alarm deleted")
+
+	d.SetId("")
+	return nil
+}
+
+func getAwsCloudWatchPutMetricAlarmInput(d *schema.ResourceData) cloudwatch.PutMetricAlarmInput {
+	params := cloudwatch.PutMetricAlarmInput{
+		AlarmName:          aws.String(d.Get("alarm_name").(string)),
+		ComparisonOperator: aws.String(d.Get("comparison_operator").(string)),
+		EvaluationPeriods:  aws.Long(int64(d.Get("evaluation_periods").(int))),
+		MetricName:         aws.String(d.Get("metric_name").(string)),
+		Namespace:          aws.String(d.Get("namespace").(string)),
+		Period:             aws.Long(int64(d.Get("period").(int))),
+		Statistic:          aws.String(d.Get("statistic").(string)),
+		Threshold:          aws.Double(d.Get("threshold").(float64)),
+	}
+
+	if v := d.Get("actions_enabled"); v != nil {
+		params.ActionsEnabled = aws.Boolean(v.(bool))
+	}
+
+	if v, ok := d.GetOk("alarm_description"); ok {
+		params.AlarmDescription = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("unit"); ok {
+		params.Unit = aws.String(v.(string))
+	}
+
+	var alarmActions []*string
+	if v := d.Get("alarm_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			alarmActions = append(alarmActions, aws.String(str))
+		}
+		params.AlarmActions = alarmActions
+	}
+
+	var insufficientDataActions []*string
+	if v := d.Get("insufficient_data_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			insufficientDataActions = append(insufficientDataActions, aws.String(str))
+		}
+		params.InsufficientDataActions = insufficientDataActions
+	}
+
+	var okActions []*string
+	if v := d.Get("ok_actions"); v != nil {
+		for _, v := range v.(*schema.Set).List() {
+			str := v.(string)
+			okActions = append(okActions, aws.String(str))
+		}
+		params.OKActions = okActions
+	}
+
+	a := d.Get("dimensions").(map[string]interface{})
+	dimensions := make([]*cloudwatch.Dimension, 0, len(a))
+	for k, v := range a {
+		dimensions = append(dimensions, &cloudwatch.Dimension{
+			Name:  aws.String(k),
+			Value: aws.String(v.(string)),
+		})
+	}
+	params.Dimensions = dimensions
+
+	return params
+}
+
+func getAwsCloudWatchMetricAlarm(d *schema.ResourceData, meta interface{}) (*cloudwatch.MetricAlarm, error) {
+	conn := meta.(*AWSClient).cloudwatchconn
+
+	params := cloudwatch.DescribeAlarmsInput{
+		AlarmNames: []*string{aws.String(d.Id())},
+	}
+
+	resp, err := conn.DescribeAlarms(&params)
+	if err != nil {
+		return nil, nil
+	}
+
+	// Find it and return it
+	for idx, ma := range resp.MetricAlarms {
+		if *ma.AlarmName == d.Id() {
+			return resp.MetricAlarms[idx], nil
+		}
+	}
+
+	return nil, nil
+}
+
+func _strArrPtrToList(strArrPtr []*string) []string {
+	var result []string
+	for _, elem := range strArrPtr {
+		result = append(result, *elem)
+	}
+	return result
+}
diff --git a/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go
new file mode 100644
index 000000000..8d9a53c36
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_cloudwatch_metric_alarm_test.go
@@ -0,0 +1,95 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudwatch"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSCloudWatchMetricAlarm_basic(t *testing.T) {
+	var alarm cloudwatch.MetricAlarm
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSCloudWatchMetricAlarmDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSCloudWatchMetricAlarmConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudWatchMetricAlarmExists("aws_cloudwatch_metric_alarm.foobar", &alarm),
+					resource.TestCheckResourceAttr("aws_cloudwatch_metric_alarm.foobar", "metric_name", "CPUUtilization"),
+					resource.TestCheckResourceAttr("aws_cloudwatch_metric_alarm.foobar", "statistic", "Average"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudWatchMetricAlarmExists(n string, alarm *cloudwatch.MetricAlarm) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).cloudwatchconn
+		params := cloudwatch.DescribeAlarmsInput{
+			AlarmNames: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeAlarms(&params)
+		if err != nil {
+			return err
+		}
+		if len(resp.MetricAlarms) == 0 {
+			return fmt.Errorf("Alarm not found")
+		}
+		*alarm = *resp.MetricAlarms[0]
+
+		return nil
+	}
+}
+
+func testAccCheckAWSCloudWatchMetricAlarmDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).cloudwatchconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_cloudwatch_metric_alarm" {
+			continue
+		}
+
+		params := cloudwatch.DescribeAlarmsInput{
+			AlarmNames: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribeAlarms(&params)
+
+		if err == nil {
+			if len(resp.MetricAlarms) != 0 &&
+				*resp.MetricAlarms[0].AlarmName == rs.Primary.ID {
+				return fmt.Errorf("Alarm Still Exists: %s", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+var testAccAWSCloudWatchMetricAlarmConfig = fmt.Sprintf(`
+resource "aws_cloudwatch_metric_alarm" "foobar" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    insufficient_data_actions = []
+}
+`)
diff --git a/builtin/providers/aws/resource_aws_customer_gateway.go b/builtin/providers/aws/resource_aws_customer_gateway.go
index 6fa1d39ab..fa4322304 100644
--- a/builtin/providers/aws/resource_aws_customer_gateway.go
+++ b/builtin/providers/aws/resource_aws_customer_gateway.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
diff --git a/builtin/providers/aws/resource_aws_customer_gateway_test.go b/builtin/providers/aws/resource_aws_customer_gateway_test.go
index 2a51eb112..33e370946 100644
--- a/builtin/providers/aws/resource_aws_customer_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_customer_gateway_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccCustomerGateway(t *testing.T) {
+func TestAccCustomerGateway_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_db_instance.go b/builtin/providers/aws/resource_aws_db_instance.go
index 157d7132b..cd394216f 100644
--- a/builtin/providers/aws/resource_aws_db_instance.go
+++ b/builtin/providers/aws/resource_aws_db_instance.go
@@ -3,13 +3,14 @@ package aws
 import (
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/rds"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -73,6 +74,26 @@ func resourceAwsDbInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only lowercase alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"first character of %q must be a letter", k))
+					}
+					if regexp.MustCompile(`--`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot contain two consecutive hyphens", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot end with a hyphen"))
+					}
+					return
+				},
 			},
 
 			"instance_class": &schema.Schema{
@@ -153,6 +174,20 @@ func resourceAwsDbInstance() *schema.Resource {
 			"final_snapshot_identifier": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+						es = append(es, fmt.Errorf(
+							"only alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if regexp.MustCompile(`--`).MatchString(value) {
+						es = append(es, fmt.Errorf("%q cannot contain two consecutive hyphens", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						es = append(es, fmt.Errorf("%q cannot end in a hyphen", k))
+					}
+					return
+				},
 			},
 
 			"db_subnet_group_name": &schema.Schema{
diff --git a/builtin/providers/aws/resource_aws_db_instance_test.go b/builtin/providers/aws/resource_aws_db_instance_test.go
index b6d31f75e..ef1931b03 100644
--- a/builtin/providers/aws/resource_aws_db_instance_test.go
+++ b/builtin/providers/aws/resource_aws_db_instance_test.go
@@ -9,12 +9,12 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
-func TestAccAWSDBInstance(t *testing.T) {
+func TestAccAWSDBInstance_basic(t *testing.T) {
 	var v rds.DBInstance
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_db_parameter_group.go b/builtin/providers/aws/resource_aws_db_parameter_group.go
index 57758ae5b..9489394dc 100644
--- a/builtin/providers/aws/resource_aws_db_parameter_group.go
+++ b/builtin/providers/aws/resource_aws_db_parameter_group.go
@@ -11,9 +11,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
 func resourceAwsDbParameterGroup() *schema.Resource {
diff --git a/builtin/providers/aws/resource_aws_db_parameter_group_test.go b/builtin/providers/aws/resource_aws_db_parameter_group_test.go
index 57400fb0c..93e74bb74 100644
--- a/builtin/providers/aws/resource_aws_db_parameter_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_parameter_group_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDBParameterGroup(t *testing.T) {
+func TestAccAWSDBParameterGroup_basic(t *testing.T) {
 	var v rds.DBParameterGroup
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_db_security_group.go b/builtin/providers/aws/resource_aws_db_security_group.go
index 94d87e370..be535713d 100644
--- a/builtin/providers/aws/resource_aws_db_security_group.go
+++ b/builtin/providers/aws/resource_aws_db_security_group.go
@@ -6,9 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/multierror"
 	"github.com/hashicorp/terraform/helper/resource"
diff --git a/builtin/providers/aws/resource_aws_db_security_group_test.go b/builtin/providers/aws/resource_aws_db_security_group_test.go
index a2065114a..bf1db6e37 100644
--- a/builtin/providers/aws/resource_aws_db_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_security_group_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDBSecurityGroup(t *testing.T) {
+func TestAccAWSDBSecurityGroup_basic(t *testing.T) {
 	var v rds.DBSecurityGroup
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_db_subnet_group.go b/builtin/providers/aws/resource_aws_db_subnet_group.go
index 598d291c4..6da15eb18 100644
--- a/builtin/providers/aws/resource_aws_db_subnet_group.go
+++ b/builtin/providers/aws/resource_aws_db_subnet_group.go
@@ -3,12 +3,13 @@ package aws
 import (
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -24,6 +25,22 @@ func resourceAwsDbSubnetGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				ForceNew: true,
 				Required: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					if regexp.MustCompile(`(?i)^default$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q is not allowed as %q", "Default", k))
+					}
+					return
+				},
 			},
 
 			"description": &schema.Schema{
diff --git a/builtin/providers/aws/resource_aws_db_subnet_group_test.go b/builtin/providers/aws/resource_aws_db_subnet_group_test.go
index 06e9e92c4..5a07652fe 100644
--- a/builtin/providers/aws/resource_aws_db_subnet_group_test.go
+++ b/builtin/providers/aws/resource_aws_db_subnet_group_test.go
@@ -7,12 +7,12 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/rds"
 )
 
-func TestAccAWSDBSubnetGroup(t *testing.T) {
+func TestAccAWSDBSubnetGroup_basic(t *testing.T) {
 	var v rds.DBSubnetGroup
 
 	testCheck := func(*terraform.State) error {
diff --git a/builtin/providers/aws/resource_aws_dynamodb_table.go b/builtin/providers/aws/resource_aws_dynamodb_table.go
new file mode 100644
index 000000000..9a860768e
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_dynamodb_table.go
@@ -0,0 +1,735 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/hashicorp/terraform/helper/hashcode"
+)
+
+// Number of times to retry if a throttling-related exception occurs
+const DYNAMODB_MAX_THROTTLE_RETRIES = 5
+
+// How long to sleep when a throttle-event happens
+const DYNAMODB_THROTTLE_SLEEP = 5 * time.Second
+
+// How long to sleep if a limit-exceeded event happens
+const DYNAMODB_LIMIT_EXCEEDED_SLEEP = 10 * time.Second
+
+// A number of these are marked as computed because if you don't
+// provide a value, DynamoDB will provide you with defaults (which are the
+// default values specified below)
+func resourceAwsDynamoDbTable() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsDynamoDbTableCreate,
+		Read:   resourceAwsDynamoDbTableRead,
+		Update: resourceAwsDynamoDbTableUpdate,
+		Delete: resourceAwsDynamoDbTableDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"hash_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"range_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"write_capacity": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"read_capacity": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"attribute": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					return hashcode.String(buf.String())
+				},
+			},
+			"local_secondary_index": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"range_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"projection_type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"non_key_attributes": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					return hashcode.String(buf.String())
+				},
+			},
+			"global_secondary_index": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"write_capacity": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"read_capacity": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"hash_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"range_key": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"projection_type": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"non_key_attributes": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+				// GSI names are the uniqueness constraint
+				Set: func(v interface{}) int {
+					var buf bytes.Buffer
+					m := v.(map[string]interface{})
+					buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+					buf.WriteString(fmt.Sprintf("%d-", m["write_capacity"].(int)))
+					buf.WriteString(fmt.Sprintf("%d-", m["read_capacity"].(int)))
+					return hashcode.String(buf.String())
+				},
+			},
+		},
+	}
+}
+
+func resourceAwsDynamoDbTableCreate(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	name := d.Get("name").(string)
+
+	log.Printf("[DEBUG] DynamoDB table create: %s", name)
+
+	throughput := &dynamodb.ProvisionedThroughput{
+		ReadCapacityUnits:  aws.Long(int64(d.Get("read_capacity").(int))),
+		WriteCapacityUnits: aws.Long(int64(d.Get("write_capacity").(int))),
+	}
+
+	hash_key_name := d.Get("hash_key").(string)
+	keyschema := []*dynamodb.KeySchemaElement{
+		&dynamodb.KeySchemaElement{
+			AttributeName: aws.String(hash_key_name),
+			KeyType:       aws.String("HASH"),
+		},
+	}
+
+	if range_key, ok := d.GetOk("range_key"); ok {
+		range_schema_element := &dynamodb.KeySchemaElement{
+			AttributeName: aws.String(range_key.(string)),
+			KeyType:       aws.String("RANGE"),
+		}
+		keyschema = append(keyschema, range_schema_element)
+	}
+
+	req := &dynamodb.CreateTableInput{
+		TableName:             aws.String(name),
+		ProvisionedThroughput: throughput,
+		KeySchema:             keyschema,
+	}
+
+	if attributedata, ok := d.GetOk("attribute"); ok {
+		attributes := []*dynamodb.AttributeDefinition{}
+		attributeSet := attributedata.(*schema.Set)
+		for _, attribute := range attributeSet.List() {
+			attr := attribute.(map[string]interface{})
+			attributes = append(attributes, &dynamodb.AttributeDefinition{
+				AttributeName: aws.String(attr["name"].(string)),
+				AttributeType: aws.String(attr["type"].(string)),
+			})
+		}
+
+		req.AttributeDefinitions = attributes
+	}
+
+	if lsidata, ok := d.GetOk("local_secondary_index"); ok {
+		fmt.Printf("[DEBUG] Adding LSI data to the table")
+
+		lsiSet := lsidata.(*schema.Set)
+		localSecondaryIndexes := []*dynamodb.LocalSecondaryIndex{}
+		for _, lsiObject := range lsiSet.List() {
+			lsi := lsiObject.(map[string]interface{})
+
+			projection := &dynamodb.Projection{
+				ProjectionType: aws.String(lsi["projection_type"].(string)),
+			}
+
+			if lsi["projection_type"] == "INCLUDE" {
+				non_key_attributes := []*string{}
+				for _, attr := range lsi["non_key_attributes"].([]interface{}) {
+					non_key_attributes = append(non_key_attributes, aws.String(attr.(string)))
+				}
+				projection.NonKeyAttributes = non_key_attributes
+			}
+
+			localSecondaryIndexes = append(localSecondaryIndexes, &dynamodb.LocalSecondaryIndex{
+				IndexName: aws.String(lsi["name"].(string)),
+				KeySchema: []*dynamodb.KeySchemaElement{
+					&dynamodb.KeySchemaElement{
+						AttributeName: aws.String(hash_key_name),
+						KeyType:       aws.String("HASH"),
+					},
+					&dynamodb.KeySchemaElement{
+						AttributeName: aws.String(lsi["range_key"].(string)),
+						KeyType:       aws.String("RANGE"),
+					},
+				},
+				Projection: projection,
+			})
+		}
+
+		req.LocalSecondaryIndexes = localSecondaryIndexes
+
+		fmt.Printf("[DEBUG] Added %d LSI definitions", len(localSecondaryIndexes))
+	}
+
+	if gsidata, ok := d.GetOk("global_secondary_index"); ok {
+		globalSecondaryIndexes := []*dynamodb.GlobalSecondaryIndex{}
+
+		gsiSet := gsidata.(*schema.Set)
+		for _, gsiObject := range gsiSet.List() {
+			gsi := gsiObject.(map[string]interface{})
+			gsiObject := createGSIFromData(&gsi)
+			globalSecondaryIndexes = append(globalSecondaryIndexes, &gsiObject)
+		}
+		req.GlobalSecondaryIndexes = globalSecondaryIndexes
+	}
+
+	attemptCount := 1
+	for attemptCount <= DYNAMODB_MAX_THROTTLE_RETRIES {
+		output, err := dynamodbconn.CreateTable(req)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Code() == "ThrottlingException" {
+					log.Printf("[DEBUG] Attempt %d/%d: Sleeping for a bit to throttle back create request", attemptCount, DYNAMODB_MAX_THROTTLE_RETRIES)
+					time.Sleep(DYNAMODB_THROTTLE_SLEEP)
+					attemptCount += 1
+				} else if awsErr.Code() == "LimitExceededException" {
+					log.Printf("[DEBUG] Limit on concurrent table creations hit, sleeping for a bit")
+					time.Sleep(DYNAMODB_LIMIT_EXCEEDED_SLEEP)
+					attemptCount += 1
+				} else {
+					// Some other non-retryable exception occurred
+					return fmt.Errorf("AWS Error creating DynamoDB table: %s", err)
+				}
+			} else {
+				// Non-AWS exception occurred, give up
+				return fmt.Errorf("Error creating DynamoDB table: %s", err)
+			}
+		} else {
+			// No error, set ID and return
+			d.SetId(*output.TableDescription.TableName)
+			return nil
+		}
+	}
+
+	// Too many throttling events occurred, give up
+	return fmt.Errorf("Unable to create DynamoDB table '%s' after %d attempts", name, attemptCount)
+}
+
+func resourceAwsDynamoDbTableUpdate(d *schema.ResourceData, meta interface{}) error {
+
+	log.Printf("[DEBUG] Updating DynamoDB table %s", d.Id())
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	// Ensure table is active before trying to update
+	waitForTableToBeActive(d.Id(), meta)
+
+	// LSI can only be done at create-time, abort if it's been changed
+	if d.HasChange("local_secondary_index") {
+		return fmt.Errorf("Local secondary indexes can only be built at creation, you cannot update them!")
+	}
+
+	if d.HasChange("hash_key") {
+		return fmt.Errorf("Hash key can only be specified at creation, you cannot modify it.")
+	}
+
+	if d.HasChange("range_key") {
+		return fmt.Errorf("Range key can only be specified at creation, you cannot modify it.")
+	}
+
+	if d.HasChange("read_capacity") || d.HasChange("write_capacity") {
+		req := &dynamodb.UpdateTableInput{
+			TableName: aws.String(d.Id()),
+		}
+
+		throughput := &dynamodb.ProvisionedThroughput{
+			ReadCapacityUnits:  aws.Long(int64(d.Get("read_capacity").(int))),
+			WriteCapacityUnits: aws.Long(int64(d.Get("write_capacity").(int))),
+		}
+		req.ProvisionedThroughput = throughput
+
+		_, err := dynamodbconn.UpdateTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		waitForTableToBeActive(d.Id(), meta)
+	}
+
+	if d.HasChange("global_secondary_index") {
+		log.Printf("[DEBUG] Changed GSI data")
+		req := &dynamodb.UpdateTableInput{
+			TableName: aws.String(d.Id()),
+		}
+
+		o, n := d.GetChange("global_secondary_index")
+
+		oldSet := o.(*schema.Set)
+		newSet := n.(*schema.Set)
+
+		// Track old names so we can know which ones we need to just update based on
+		// capacity changes, terraform appears to only diff on the set hash, not the
+		// contents so we need to make sure we don't delete any indexes that we
+		// just want to update the capacity for
+		oldGsiNameSet := make(map[string]bool)
+		newGsiNameSet := make(map[string]bool)
+
+		for _, gsidata := range oldSet.List() {
+			gsiName := gsidata.(map[string]interface{})["name"].(string)
+			oldGsiNameSet[gsiName] = true
+		}
+
+		for _, gsidata := range newSet.List() {
+			gsiName := gsidata.(map[string]interface{})["name"].(string)
+			newGsiNameSet[gsiName] = true
+		}
+
+		// First determine what's new
+		for _, newgsidata := range newSet.List() {
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+			newGsiName := newgsidata.(map[string]interface{})["name"].(string)
+			if _, exists := oldGsiNameSet[newGsiName]; !exists {
+				attributes := []*dynamodb.AttributeDefinition{}
+				gsidata := newgsidata.(map[string]interface{})
+				gsi := createGSIFromData(&gsidata)
+				log.Printf("[DEBUG] Adding GSI %s", *gsi.IndexName)
+				update := &dynamodb.GlobalSecondaryIndexUpdate{
+					Create: &dynamodb.CreateGlobalSecondaryIndexAction{
+						IndexName:             gsi.IndexName,
+						KeySchema:             gsi.KeySchema,
+						ProvisionedThroughput: gsi.ProvisionedThroughput,
+						Projection:            gsi.Projection,
+					},
+				}
+				updates = append(updates, update)
+
+				// Hash key is required, range key isn't
+				hashkey_type, err := getAttributeType(d, *(gsi.KeySchema[0].AttributeName))
+				if err != nil {
+					return err
+				}
+
+				attributes = append(attributes, &dynamodb.AttributeDefinition{
+					AttributeName: gsi.KeySchema[0].AttributeName,
+					AttributeType: aws.String(hashkey_type),
+				})
+
+				// If there's a range key, there will be 2 elements in KeySchema
+				if len(gsi.KeySchema) == 2 {
+					rangekey_type, err := getAttributeType(d, *(gsi.KeySchema[1].AttributeName))
+					if err != nil {
+						return err
+					}
+
+					attributes = append(attributes, &dynamodb.AttributeDefinition{
+						AttributeName: gsi.KeySchema[1].AttributeName,
+						AttributeType: aws.String(rangekey_type),
+					})
+				}
+
+				req.AttributeDefinitions = attributes
+				req.GlobalSecondaryIndexUpdates = updates
+				_, err = dynamodbconn.UpdateTable(req)
+
+				if err != nil {
+					return err
+				}
+
+				waitForTableToBeActive(d.Id(), meta)
+				waitForGSIToBeActive(d.Id(), *gsi.IndexName, meta)
+
+			}
+		}
+
+		for _, oldgsidata := range oldSet.List() {
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+			oldGsiName := oldgsidata.(map[string]interface{})["name"].(string)
+			if _, exists := newGsiNameSet[oldGsiName]; !exists {
+				gsidata := oldgsidata.(map[string]interface{})
+				log.Printf("[DEBUG] Deleting GSI %s", gsidata["name"].(string))
+				update := &dynamodb.GlobalSecondaryIndexUpdate{
+					Delete: &dynamodb.DeleteGlobalSecondaryIndexAction{
+						IndexName: aws.String(gsidata["name"].(string)),
+					},
+				}
+				updates = append(updates, update)
+
+				req.GlobalSecondaryIndexUpdates = updates
+				_, err := dynamodbconn.UpdateTable(req)
+
+				if err != nil {
+					return err
+				}
+
+				waitForTableToBeActive(d.Id(), meta)
+			}
+		}
+	}
+
+	// Update any out-of-date read / write capacity
+	if gsiObjects, ok := d.GetOk("global_secondary_index"); ok {
+		gsiSet := gsiObjects.(*schema.Set)
+		if len(gsiSet.List()) > 0 {
+			log.Printf("Updating capacity as needed!")
+
+			// We can only change throughput, but we need to make sure it's actually changed
+			tableDescription, err := dynamodbconn.DescribeTable(&dynamodb.DescribeTableInput{
+				TableName: aws.String(d.Id()),
+			})
+
+			if err != nil {
+				return err
+			}
+
+			table := tableDescription.Table
+
+			updates := []*dynamodb.GlobalSecondaryIndexUpdate{}
+
+			for _, updatedgsidata := range gsiSet.List() {
+				gsidata := updatedgsidata.(map[string]interface{})
+				gsiName := gsidata["name"].(string)
+				gsiWriteCapacity := gsidata["write_capacity"].(int)
+				gsiReadCapacity := gsidata["read_capacity"].(int)
+
+				log.Printf("[DEBUG] Updating GSI %s", gsiName)
+				gsi, err := getGlobalSecondaryIndex(gsiName, table.GlobalSecondaryIndexes)
+
+				if err != nil {
+					return err
+				}
+
+				capacityUpdated := false
+
+				if int64(gsiReadCapacity) != *(gsi.ProvisionedThroughput.ReadCapacityUnits) ||
+					int64(gsiWriteCapacity) != *(gsi.ProvisionedThroughput.WriteCapacityUnits) {
+					capacityUpdated = true
+				}
+
+				if capacityUpdated {
+					update := &dynamodb.GlobalSecondaryIndexUpdate{
+						Update: &dynamodb.UpdateGlobalSecondaryIndexAction{
+							IndexName: aws.String(gsidata["name"].(string)),
+							ProvisionedThroughput: &dynamodb.ProvisionedThroughput{
+								WriteCapacityUnits: aws.Long(int64(gsiWriteCapacity)),
+								ReadCapacityUnits:  aws.Long(int64(gsiReadCapacity)),
+							},
+						},
+					}
+					updates = append(updates, update)
+
+				}
+
+				if len(updates) > 0 {
+
+					req := &dynamodb.UpdateTableInput{
+						TableName: aws.String(d.Id()),
+					}
+
+					req.GlobalSecondaryIndexUpdates = updates
+
+					log.Printf("[DEBUG] Updating GSI read / write capacity on %s", d.Id())
+					_, err := dynamodbconn.UpdateTable(req)
+
+					if err != nil {
+						log.Printf("[DEBUG] Error updating table: %s", err)
+						return err
+					}
+				}
+			}
+		}
+
+	}
+
+	return resourceAwsDynamoDbTableRead(d, meta)
+}
+
+func resourceAwsDynamoDbTableRead(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	log.Printf("[DEBUG] Loading data for DynamoDB table '%s'", d.Id())
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(d.Id()),
+	}
+
+	result, err := dynamodbconn.DescribeTable(req)
+
+	if err != nil {
+		return err
+	}
+
+	table := result.Table
+
+	d.Set("write_capacity", table.ProvisionedThroughput.WriteCapacityUnits)
+	d.Set("read_capacity", table.ProvisionedThroughput.ReadCapacityUnits)
+
+	attributes := []interface{}{}
+	for _, attrdef := range table.AttributeDefinitions {
+		attribute := map[string]string{
+			"name": *(attrdef.AttributeName),
+			"type": *(attrdef.AttributeType),
+		}
+		attributes = append(attributes, attribute)
+		log.Printf("[DEBUG] Added Attribute: %s", attribute["name"])
+	}
+
+	d.Set("attribute", attributes)
+
+	gsiList := make([]map[string]interface{}, 0, len(table.GlobalSecondaryIndexes))
+	for _, gsiObject := range table.GlobalSecondaryIndexes {
+		gsi := map[string]interface{}{
+			"write_capacity": *(gsiObject.ProvisionedThroughput.WriteCapacityUnits),
+			"read_capacity":  *(gsiObject.ProvisionedThroughput.ReadCapacityUnits),
+			"name":           *(gsiObject.IndexName),
+		}
+
+		for _, attribute := range gsiObject.KeySchema {
+			if *attribute.KeyType == "HASH" {
+				gsi["hash_key"] = *attribute.AttributeName
+			}
+
+			if *attribute.KeyType == "RANGE" {
+				gsi["range_key"] = *attribute.AttributeName
+			}
+		}
+
+		gsi["projection_type"] = *(gsiObject.Projection.ProjectionType)
+		gsi["non_key_attributes"] = gsiObject.Projection.NonKeyAttributes
+
+		gsiList = append(gsiList, gsi)
+		log.Printf("[DEBUG] Added GSI: %s - Read: %d / Write: %d", gsi["name"], gsi["read_capacity"], gsi["write_capacity"])
+	}
+
+	d.Set("global_secondary_index", gsiList)
+
+	return nil
+}
+
+func resourceAwsDynamoDbTableDelete(d *schema.ResourceData, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+
+	waitForTableToBeActive(d.Id(), meta)
+
+	log.Printf("[DEBUG] DynamoDB delete table: %s", d.Id())
+
+	_, err := dynamodbconn.DeleteTable(&dynamodb.DeleteTableInput{
+		TableName: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func createGSIFromData(data *map[string]interface{}) dynamodb.GlobalSecondaryIndex {
+
+	projection := &dynamodb.Projection{
+		ProjectionType: aws.String((*data)["projection_type"].(string)),
+	}
+
+	if (*data)["projection_type"] == "INCLUDE" {
+		non_key_attributes := []*string{}
+		for _, attr := range (*data)["non_key_attributes"].([]interface{}) {
+			non_key_attributes = append(non_key_attributes, aws.String(attr.(string)))
+		}
+		projection.NonKeyAttributes = non_key_attributes
+	}
+
+	writeCapacity := (*data)["write_capacity"].(int)
+	readCapacity := (*data)["read_capacity"].(int)
+
+	key_schema := []*dynamodb.KeySchemaElement{
+		&dynamodb.KeySchemaElement{
+			AttributeName: aws.String((*data)["hash_key"].(string)),
+			KeyType:       aws.String("HASH"),
+		},
+	}
+
+	range_key_name := (*data)["range_key"]
+	if range_key_name != "" {
+		range_key_element := &dynamodb.KeySchemaElement{
+			AttributeName: aws.String(range_key_name.(string)),
+			KeyType:       aws.String("RANGE"),
+		}
+
+		key_schema = append(key_schema, range_key_element)
+	}
+
+	return dynamodb.GlobalSecondaryIndex{
+		IndexName:  aws.String((*data)["name"].(string)),
+		KeySchema:  key_schema,
+		Projection: projection,
+		ProvisionedThroughput: &dynamodb.ProvisionedThroughput{
+			WriteCapacityUnits: aws.Long(int64(writeCapacity)),
+			ReadCapacityUnits:  aws.Long(int64(readCapacity)),
+		},
+	}
+}
+
+func getGlobalSecondaryIndex(indexName string, indexList []*dynamodb.GlobalSecondaryIndexDescription) (*dynamodb.GlobalSecondaryIndexDescription, error) {
+	for _, gsi := range indexList {
+		if *(gsi.IndexName) == indexName {
+			return gsi, nil
+		}
+	}
+
+	return &dynamodb.GlobalSecondaryIndexDescription{}, fmt.Errorf("Can't find a GSI by that name...")
+}
+
+func getAttributeType(d *schema.ResourceData, attributeName string) (string, error) {
+	if attributedata, ok := d.GetOk("attribute"); ok {
+		attributeSet := attributedata.(*schema.Set)
+		for _, attribute := range attributeSet.List() {
+			attr := attribute.(map[string]interface{})
+			if attr["name"] == attributeName {
+				return attr["type"].(string), nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf("Unable to find an attribute named %s", attributeName)
+}
+
+func waitForGSIToBeActive(tableName string, gsiName string, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(tableName),
+	}
+
+	activeIndex := false
+
+	for activeIndex == false {
+
+		result, err := dynamodbconn.DescribeTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		table := result.Table
+		var targetGSI *dynamodb.GlobalSecondaryIndexDescription = nil
+
+		for _, gsi := range table.GlobalSecondaryIndexes {
+			if *gsi.IndexName == gsiName {
+				targetGSI = gsi
+			}
+		}
+
+		if targetGSI != nil {
+			activeIndex = *targetGSI.IndexStatus == "ACTIVE"
+
+			if !activeIndex {
+				log.Printf("[DEBUG] Sleeping for 5 seconds for %s GSI to become active", gsiName)
+				time.Sleep(5 * time.Second)
+			}
+		} else {
+			log.Printf("[DEBUG] GSI %s did not exist, giving up", gsiName)
+			break
+		}
+	}
+
+	return nil
+
+}
+
+func waitForTableToBeActive(tableName string, meta interface{}) error {
+	dynamodbconn := meta.(*AWSClient).dynamodbconn
+	req := &dynamodb.DescribeTableInput{
+		TableName: aws.String(tableName),
+	}
+
+	activeState := false
+
+	for activeState == false {
+		result, err := dynamodbconn.DescribeTable(req)
+
+		if err != nil {
+			return err
+		}
+
+		activeState = *(result.Table.TableStatus) == "ACTIVE"
+
+		// Wait for a few seconds
+		if !activeState {
+			log.Printf("[DEBUG] Sleeping for 5 seconds for table to become active")
+			time.Sleep(5 * time.Second)
+		}
+	}
+
+	return nil
+
+}
diff --git a/builtin/providers/aws/resource_aws_dynamodb_table_test.go b/builtin/providers/aws/resource_aws_dynamodb_table_test.go
new file mode 100644
index 000000000..6c26efc73
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_dynamodb_table_test.go
@@ -0,0 +1,297 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSDynamoDbTable(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSDynamoDbTableDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSDynamoDbConfigInitialState,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInitialAWSDynamoDbTableExists("aws_dynamodb_table.basic-dynamodb-table"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSDynamoDbConfigAddSecondaryGSI,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDynamoDbTableWasUpdated("aws_dynamodb_table.basic-dynamodb-table"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSDynamoDbTableDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_dynamodb_table" {
+			continue
+		}
+
+		fmt.Printf("[DEBUG] Checking if DynamoDB table %s exists", rs.Primary.ID)
+		// Check if queue exists by checking for its attributes
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.DescribeTable(params)
+		if err == nil {
+			return fmt.Errorf("DynamoDB table %s still exists. Failing!", rs.Primary.ID)
+		}
+
+		// Verify the error is what we want
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckInitialAWSDynamoDbTableExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		fmt.Printf("[DEBUG] Trying to create initial table state!")
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No DynamoDB table name specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+
+		resp, err := conn.DescribeTable(params)
+
+		if err != nil {
+			fmt.Printf("[ERROR] Problem describing table '%s': %s", rs.Primary.ID, err)
+			return err
+		}
+
+		table := resp.Table
+
+		fmt.Printf("[DEBUG] Checking on table %s", rs.Primary.ID)
+
+		if *table.ProvisionedThroughput.WriteCapacityUnits != 20 {
+			return fmt.Errorf("Provisioned write capacity was %d, not 20!", table.ProvisionedThroughput.WriteCapacityUnits)
+		}
+
+		if *table.ProvisionedThroughput.ReadCapacityUnits != 10 {
+			return fmt.Errorf("Provisioned read capacity was %d, not 10!", table.ProvisionedThroughput.ReadCapacityUnits)
+		}
+
+		attrCount := len(table.AttributeDefinitions)
+		gsiCount := len(table.GlobalSecondaryIndexes)
+		lsiCount := len(table.LocalSecondaryIndexes)
+
+		if attrCount != 4 {
+			return fmt.Errorf("There were %d attributes, not 4 like there should have been!", attrCount)
+		}
+
+		if gsiCount != 1 {
+			return fmt.Errorf("There were %d GSIs, not 1 like there should have been!", gsiCount)
+		}
+
+		if lsiCount != 1 {
+			return fmt.Errorf("There were %d LSIs, not 1 like there should have been!", lsiCount)
+		}
+
+		attrmap := dynamoDbAttributesToMap(&table.AttributeDefinitions)
+		if attrmap["TestTableHashKey"] != "S" {
+			return fmt.Errorf("Test table hash key was of type %s instead of S!", attrmap["TestTableHashKey"])
+		}
+		if attrmap["TestTableRangeKey"] != "S" {
+			return fmt.Errorf("Test table range key was of type %s instead of S!", attrmap["TestTableRangeKey"])
+		}
+		if attrmap["TestLSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table LSI range key was of type %s instead of N!", attrmap["TestLSIRangeKey"])
+		}
+		if attrmap["TestGSIRangeKey"] != "S" {
+			return fmt.Errorf("Test table GSI range key was of type %s instead of S!", attrmap["TestGSIRangeKey"])
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckDynamoDbTableWasUpdated(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No DynamoDB table name specified!")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).dynamodbconn
+
+		params := &dynamodb.DescribeTableInput{
+			TableName: aws.String(rs.Primary.ID),
+		}
+		resp, err := conn.DescribeTable(params)
+		table := resp.Table
+
+		if err != nil {
+			return err
+		}
+
+		attrCount := len(table.AttributeDefinitions)
+		gsiCount := len(table.GlobalSecondaryIndexes)
+		lsiCount := len(table.LocalSecondaryIndexes)
+
+		if attrCount != 4 {
+			return fmt.Errorf("There were %d attributes, not 4 like there should have been!", attrCount)
+		}
+
+		if gsiCount != 1 {
+			return fmt.Errorf("There were %d GSIs, not 1 like there should have been!", gsiCount)
+		}
+
+		if lsiCount != 1 {
+			return fmt.Errorf("There were %d LSIs, not 1 like there should have been!", lsiCount)
+		}
+
+		if dynamoDbGetGSIIndex(&table.GlobalSecondaryIndexes, "ReplacementTestTableGSI") == -1 {
+			return fmt.Errorf("Could not find GSI named 'ReplacementTestTableGSI' in the table!")
+		}
+
+		if dynamoDbGetGSIIndex(&table.GlobalSecondaryIndexes, "InitialTestTableGSI") != -1 {
+			return fmt.Errorf("Should have removed 'InitialTestTableGSI' but it still exists!")
+		}
+
+		attrmap := dynamoDbAttributesToMap(&table.AttributeDefinitions)
+		if attrmap["TestTableHashKey"] != "S" {
+			return fmt.Errorf("Test table hash key was of type %s instead of S!", attrmap["TestTableHashKey"])
+		}
+		if attrmap["TestTableRangeKey"] != "S" {
+			return fmt.Errorf("Test table range key was of type %s instead of S!", attrmap["TestTableRangeKey"])
+		}
+		if attrmap["TestLSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table LSI range key was of type %s instead of N!", attrmap["TestLSIRangeKey"])
+		}
+		if attrmap["ReplacementGSIRangeKey"] != "N" {
+			return fmt.Errorf("Test table replacement GSI range key was of type %s instead of N!", attrmap["ReplacementGSIRangeKey"])
+		}
+
+		return nil
+	}
+}
+
+func dynamoDbGetGSIIndex(gsiList *[]*dynamodb.GlobalSecondaryIndexDescription, target string) int {
+	for idx, gsiObject := range *gsiList {
+		if *gsiObject.IndexName == target {
+			return idx
+		}
+	}
+
+	return -1
+}
+
+func dynamoDbAttributesToMap(attributes *[]*dynamodb.AttributeDefinition) map[string]string {
+	attrmap := make(map[string]string)
+
+	for _, attrdef := range *attributes {
+		attrmap[*(attrdef.AttributeName)] = *(attrdef.AttributeType)
+	}
+
+	return attrmap
+}
+
+const testAccAWSDynamoDbConfigInitialState = `
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "TerraformTestTable"
+		read_capacity = 10
+		write_capacity = 20
+		hash_key = "TestTableHashKey"
+		range_key = "TestTableRangeKey"
+		attribute {
+			name = "TestTableHashKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestTableRangeKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestLSIRangeKey"
+			type = "N"
+		}
+		attribute {
+			name = "TestGSIRangeKey"
+			type = "S"
+		}
+		local_secondary_index {
+			name = "TestTableLSI"
+			range_key = "TestLSIRangeKey"
+			projection_type = "ALL"
+		}
+		global_secondary_index {
+			name = "InitialTestTableGSI"
+			hash_key = "TestTableHashKey"
+			range_key = "TestGSIRangeKey"
+			write_capacity = 10
+			read_capacity = 10
+			projection_type = "KEYS_ONLY"
+		}
+}
+`
+
+const testAccAWSDynamoDbConfigAddSecondaryGSI = `
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "TerraformTestTable"
+		read_capacity = 20
+		write_capacity = 20
+		hash_key = "TestTableHashKey"
+		range_key = "TestTableRangeKey"
+		attribute {
+			name = "TestTableHashKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestTableRangeKey"
+			type = "S"
+		}
+		attribute {
+			name = "TestLSIRangeKey"
+			type = "N"
+		}
+		attribute {
+			name = "ReplacementGSIRangeKey"
+			type = "N"
+		}
+		local_secondary_index {
+			name = "TestTableLSI"
+			range_key = "TestLSIRangeKey"
+			projection_type = "ALL"
+		}
+		global_secondary_index {
+			name = "ReplacementTestTableGSI"
+			hash_key = "TestTableHashKey"
+			range_key = "ReplacementGSIRangeKey"
+			write_capacity = 5
+			read_capacity = 5
+			projection_type = "INCLUDE"
+			non_key_attributes = ["TestNonKeyAttribute"]
+		}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ebs_volume.go b/builtin/providers/aws/resource_aws_ebs_volume.go
index 815ec59a0..d225f26ce 100644
--- a/builtin/providers/aws/resource_aws_ebs_volume.go
+++ b/builtin/providers/aws/resource_aws_ebs_volume.go
@@ -2,11 +2,14 @@ package aws
 
 import (
 	"fmt"
+	"log"
+	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
+	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -14,6 +17,7 @@ func resourceAwsEbsVolume() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceAwsEbsVolumeCreate,
 		Read:   resourceAwsEbsVolumeRead,
+		Update: resourceAWSEbsVolumeUpdate,
 		Delete: resourceAwsEbsVolumeDelete,
 
 		Schema: map[string]*schema.Schema{
@@ -58,6 +62,7 @@ func resourceAwsEbsVolume() *schema.Resource {
 				Computed: true,
 				ForceNew: true,
 			},
+			"tags": tagsSchema(),
 		},
 	}
 }
@@ -91,9 +96,69 @@ func resourceAwsEbsVolumeCreate(d *schema.ResourceData, meta interface{}) error
 	if err != nil {
 		return fmt.Errorf("Error creating EC2 volume: %s", err)
 	}
+
+	log.Printf(
+		"[DEBUG] Waiting for Volume (%s) to become available",
+		d.Id())
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"creating"},
+		Target:     "available",
+		Refresh:    volumeStateRefreshFunc(conn, *result.VolumeID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to become available: %s",
+			*result.VolumeID, err)
+	}
+
+	d.SetId(*result.VolumeID)
+
+	if _, ok := d.GetOk("tags"); ok {
+		setTags(conn, d)
+	}
+
 	return readVolume(d, result)
 }
 
+func resourceAWSEbsVolumeUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	if _, ok := d.GetOk("tags"); ok {
+		setTags(conn, d)
+	}
+	return resourceAwsEbsVolumeRead(d, meta)
+}
+
+// volumeStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
+// a the state of a Volume. Returns successfully when volume is available
+func volumeStateRefreshFunc(conn *ec2.EC2, volumeID string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		resp, err := conn.DescribeVolumes(&ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(volumeID)},
+		})
+
+		if err != nil {
+			if ec2err, ok := err.(awserr.Error); ok {
+				// Set this to nil as if we didn't find anything.
+				log.Printf("Error on Volume State Refresh: message: \"%s\", code:\"%s\"", ec2err.Message(), ec2err.Code())
+				resp = nil
+				return nil, "", err
+			} else {
+				log.Printf("Error on Volume State Refresh: %s", err)
+				return nil, "", err
+			}
+		}
+
+		v := resp.Volumes[0]
+		return v, *v.State, nil
+	}
+}
+
 func resourceAwsEbsVolumeRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
@@ -149,6 +214,9 @@ func readVolume(d *schema.ResourceData, volume *ec2.Volume) error {
 	if volume.VolumeType != nil {
 		d.Set("type", *volume.VolumeType)
 	}
+	if volume.Tags != nil {
+		d.Set("tags", tagsToMap(volume.Tags))
+	}
 
 	return nil
 }
diff --git a/builtin/providers/aws/resource_aws_ebs_volume_test.go b/builtin/providers/aws/resource_aws_ebs_volume_test.go
index 8a555183f..729fbc151 100644
--- a/builtin/providers/aws/resource_aws_ebs_volume_test.go
+++ b/builtin/providers/aws/resource_aws_ebs_volume_test.go
@@ -1,26 +1,88 @@
 package aws
 
 import (
+	"fmt"
 	"testing"
 
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSEBSVolume(t *testing.T) {
+func TestAccAWSEBSVolume_basic(t *testing.T) {
+	var v ec2.Volume
 	resource.Test(t, resource.TestCase{
 		PreCheck:  func() { testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccAwsEbsVolumeConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVolumeExists("aws_ebs_volume.test", &v),
+				),
 			},
 		},
 	})
 }
 
+func TestAccAWSEBSVolume_withTags(t *testing.T) {
+	var v ec2.Volume
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAwsEbsVolumeConfigWithTags,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVolumeExists("aws_ebs_volume.tags_test", &v),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVolumeExists(n string, v *ec2.Volume) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+		request := &ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		response, err := conn.DescribeVolumes(request)
+		if err == nil {
+			if response.Volumes != nil && len(response.Volumes) > 0 {
+				*v = *response.Volumes[0]
+				return nil
+			}
+		}
+		return fmt.Errorf("Error finding EC2 volume %s", rs.Primary.ID)
+	}
+}
+
 const testAccAwsEbsVolumeConfig = `
 resource "aws_ebs_volume" "test" {
 	availability_zone = "us-west-2a"
 	size = 1
 }
 `
+
+const testAccAwsEbsVolumeConfigWithTags = `
+resource "aws_ebs_volume" "tags_test" {
+	availability_zone = "us-west-2a"
+	size = 1
+	tags {
+		Name = "TerraformTest"
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_cluster.go b/builtin/providers/aws/resource_aws_ecs_cluster.go
new file mode 100644
index 000000000..30871f3dc
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_cluster.go
@@ -0,0 +1,80 @@
+package aws
+
+import (
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsEcsCluster() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsClusterCreate,
+		Read:   resourceAwsEcsClusterRead,
+		Delete: resourceAwsEcsClusterDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsClusterCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	clusterName := d.Get("name").(string)
+	log.Printf("[DEBUG] Creating ECS cluster %s", clusterName)
+
+	out, err := conn.CreateCluster(&ecs.CreateClusterInput{
+		ClusterName: aws.String(clusterName),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] ECS cluster %s created", *out.Cluster.ClusterARN)
+
+	d.SetId(*out.Cluster.ClusterARN)
+	d.Set("name", *out.Cluster.ClusterName)
+	return nil
+}
+
+func resourceAwsEcsClusterRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	clusterName := d.Get("name").(string)
+	log.Printf("[DEBUG] Reading ECS cluster %s", clusterName)
+	out, err := conn.DescribeClusters(&ecs.DescribeClustersInput{
+		Clusters: []*string{aws.String(clusterName)},
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Received ECS clusters: %#v", out.Clusters)
+
+	d.SetId(*out.Clusters[0].ClusterARN)
+	d.Set("name", *out.Clusters[0].ClusterName)
+
+	return nil
+}
+
+func resourceAwsEcsClusterDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Deleting ECS cluster %s", d.Id())
+
+	// TODO: Handle ClientException: The Cluster cannot be deleted while Container Instances are active.
+	// TODO: Handle ClientException: The Cluster cannot be deleted while Services are active.
+
+	out, err := conn.DeleteCluster(&ecs.DeleteClusterInput{
+		Cluster: aws.String(d.Id()),
+	})
+
+	log.Printf("[DEBUG] ECS cluster %s deleted: %#v", d.Id(), out)
+
+	return err
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_cluster_test.go b/builtin/providers/aws/resource_aws_ecs_cluster_test.go
new file mode 100644
index 000000000..308085d1d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_cluster_test.go
@@ -0,0 +1,68 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSEcsCluster_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsClusterDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsCluster,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsClusterExists("aws_ecs_cluster.foo"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsClusterDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_cluster" {
+			continue
+		}
+
+		out, err := conn.DescribeClusters(&ecs.DescribeClustersInput{
+			Clusters: []*string{aws.String(rs.Primary.ID)},
+		})
+
+		if err == nil {
+			if len(out.Clusters) != 0 {
+				return fmt.Errorf("ECS cluster still exists:\n%#v", out.Clusters)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsClusterExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsCluster = `
+resource "aws_ecs_cluster" "foo" {
+	name = "red-grapes"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_service.go b/builtin/providers/aws/resource_aws_ecs_service.go
new file mode 100644
index 000000000..c93296f41
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_service.go
@@ -0,0 +1,316 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+var taskDefinitionRE = regexp.MustCompile("^([a-zA-Z0-9_-]+):([0-9]+)$")
+
+func resourceAwsEcsService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsServiceCreate,
+		Read:   resourceAwsEcsServiceRead,
+		Update: resourceAwsEcsServiceUpdate,
+		Delete: resourceAwsEcsServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"cluster": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
+			"task_definition": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"desired_count": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"iam_role": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"load_balancer": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"elb_name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"container_name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"container_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsEcsLoadBalancerHash,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	input := ecs.CreateServiceInput{
+		ServiceName:    aws.String(d.Get("name").(string)),
+		TaskDefinition: aws.String(d.Get("task_definition").(string)),
+		DesiredCount:   aws.Long(int64(d.Get("desired_count").(int))),
+	}
+
+	if v, ok := d.GetOk("cluster"); ok {
+		input.Cluster = aws.String(v.(string))
+	}
+
+	loadBalancers := expandEcsLoadBalancers(d.Get("load_balancer").(*schema.Set).List())
+	if len(loadBalancers) > 0 {
+		log.Printf("[DEBUG] Adding ECS load balancers: %#v", loadBalancers)
+		input.LoadBalancers = loadBalancers
+	}
+	if v, ok := d.GetOk("iam_role"); ok {
+		input.Role = aws.String(v.(string))
+	}
+
+	log.Printf("[DEBUG] Creating ECS service: %#v", input)
+	out, err := conn.CreateService(&input)
+	if err != nil {
+		return err
+	}
+
+	service := *out.Service
+
+	log.Printf("[DEBUG] ECS service created: %s", *service.ServiceARN)
+	d.SetId(*service.ServiceARN)
+	d.Set("cluster", *service.ClusterARN)
+
+	return resourceAwsEcsServiceUpdate(d, meta)
+}
+
+func resourceAwsEcsServiceRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Reading ECS service %s", d.Id())
+	input := ecs.DescribeServicesInput{
+		Services: []*string{aws.String(d.Id())},
+		Cluster:  aws.String(d.Get("cluster").(string)),
+	}
+
+	out, err := conn.DescribeServices(&input)
+	if err != nil {
+		return err
+	}
+
+	service := out.Services[0]
+	log.Printf("[DEBUG] Received ECS service %#v", service)
+
+	d.SetId(*service.ServiceARN)
+	d.Set("name", *service.ServiceName)
+
+	// Save task definition in the same format
+	if strings.HasPrefix(d.Get("task_definition").(string), "arn:aws:ecs:") {
+		d.Set("task_definition", *service.TaskDefinition)
+	} else {
+		taskDefinition := buildFamilyAndRevisionFromARN(*service.TaskDefinition)
+		d.Set("task_definition", taskDefinition)
+	}
+
+	d.Set("desired_count", *service.DesiredCount)
+	d.Set("cluster", *service.ClusterARN)
+
+	if service.RoleARN != nil {
+		d.Set("iam_role", *service.RoleARN)
+	}
+
+	if service.LoadBalancers != nil {
+		d.Set("load_balancers", flattenEcsLoadBalancers(service.LoadBalancers))
+	}
+
+	return nil
+}
+
+func resourceAwsEcsServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Updating ECS service %s", d.Id())
+	input := ecs.UpdateServiceInput{
+		Service: aws.String(d.Id()),
+		Cluster: aws.String(d.Get("cluster").(string)),
+	}
+
+	if d.HasChange("desired_count") {
+		_, n := d.GetChange("desired_count")
+		input.DesiredCount = aws.Long(int64(n.(int)))
+	}
+	if d.HasChange("task_definition") {
+		_, n := d.GetChange("task_definition")
+		input.TaskDefinition = aws.String(n.(string))
+	}
+
+	out, err := conn.UpdateService(&input)
+	if err != nil {
+		return err
+	}
+	service := out.Service
+	log.Printf("[DEBUG] Updated ECS service %#v", service)
+
+	return resourceAwsEcsServiceRead(d, meta)
+}
+
+func resourceAwsEcsServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	// Check if it's not already gone
+	resp, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+		Services: []*string{aws.String(d.Id())},
+		Cluster:  aws.String(d.Get("cluster").(string)),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] ECS service %s is currently %s", d.Id(), *resp.Services[0].Status)
+
+	if *resp.Services[0].Status == "INACTIVE" {
+		return nil
+	}
+
+	// Drain the ECS service
+	if *resp.Services[0].Status != "DRAINING" {
+		log.Printf("[DEBUG] Draining ECS service %s", d.Id())
+		_, err = conn.UpdateService(&ecs.UpdateServiceInput{
+			Service:      aws.String(d.Id()),
+			Cluster:      aws.String(d.Get("cluster").(string)),
+			DesiredCount: aws.Long(int64(0)),
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	input := ecs.DeleteServiceInput{
+		Service: aws.String(d.Id()),
+		Cluster: aws.String(d.Get("cluster").(string)),
+	}
+
+	log.Printf("[DEBUG] Deleting ECS service %#v", input)
+	out, err := conn.DeleteService(&input)
+	if err != nil {
+		return err
+	}
+
+	// Wait until it's deleted
+	wait := resource.StateChangeConf{
+		Pending:    []string{"DRAINING"},
+		Target:     "INACTIVE",
+		Timeout:    5 * time.Minute,
+		MinTimeout: 1 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			log.Printf("[DEBUG] Checking if ECS service %s is INACTIVE", d.Id())
+			resp, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+				Services: []*string{aws.String(d.Id())},
+				Cluster:  aws.String(d.Get("cluster").(string)),
+			})
+			if err != nil {
+				return resp, "FAILED", err
+			}
+
+			return resp, *resp.Services[0].Status, nil
+		},
+	}
+
+	_, err = wait.WaitForState()
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[DEBUG] ECS service %s deleted.", *out.Service.ServiceARN)
+	return nil
+}
+
+func resourceAwsEcsLoadBalancerHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["elb_name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["container_name"].(string)))
+	buf.WriteString(fmt.Sprintf("%d-", m["container_port"].(int)))
+
+	return hashcode.String(buf.String())
+}
+
+func buildFamilyAndRevisionFromARN(arn string) string {
+	return strings.Split(arn, "/")[1]
+}
+
+func buildTaskDefinitionARN(taskDefinition string, meta interface{}) (string, error) {
+	// If it's already an ARN, just return it
+	if strings.HasPrefix(taskDefinition, "arn:aws:ecs:") {
+		return taskDefinition, nil
+	}
+
+	// Parse out family & revision
+	family, revision, err := parseTaskDefinition(taskDefinition)
+	if err != nil {
+		return "", err
+	}
+
+	iamconn := meta.(*AWSClient).iamconn
+	region := meta.(*AWSClient).region
+
+	// An zero value GetUserInput{} defers to the currently logged in user
+	resp, err := iamconn.GetUser(&iam.GetUserInput{})
+	if err != nil {
+		return "", fmt.Errorf("GetUser ERROR: %#v", err)
+	}
+
+	// arn:aws:iam::0123456789:user/username
+	userARN := *resp.User.ARN
+	accountID := strings.Split(userARN, ":")[4]
+
+	// arn:aws:ecs:us-west-2:01234567890:task-definition/mongodb:3
+	arn := fmt.Sprintf("arn:aws:ecs:%s:%s:task-definition/%s:%s",
+		region, accountID, family, revision)
+	log.Printf("[DEBUG] Built task definition ARN: %s", arn)
+	return arn, nil
+}
+
+func parseTaskDefinition(taskDefinition string) (string, string, error) {
+	matches := taskDefinitionRE.FindAllStringSubmatch(taskDefinition, 2)
+
+	if len(matches) == 0 || len(matches[0]) != 3 {
+		return "", "", fmt.Errorf(
+			"Invalid task definition format, family:rev or ARN expected (%#v)",
+			taskDefinition)
+	}
+
+	return matches[0][1], matches[0][2], nil
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_service_test.go b/builtin/providers/aws/resource_aws_ecs_service_test.go
new file mode 100644
index 000000000..4257fd365
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_service_test.go
@@ -0,0 +1,276 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestParseTaskDefinition(t *testing.T) {
+	cases := map[string]map[string]interface{}{
+		"invalid": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalidWithColon:": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"1234": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid:aaa": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid=family:1": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"invalid:name:1": map[string]interface{}{
+			"family":   "",
+			"revision": "",
+			"isValid":  false,
+		},
+		"valid:1": map[string]interface{}{
+			"family":   "valid",
+			"revision": "1",
+			"isValid":  true,
+		},
+		"abc12-def:54": map[string]interface{}{
+			"family":   "abc12-def",
+			"revision": "54",
+			"isValid":  true,
+		},
+		"lorem_ip-sum:123": map[string]interface{}{
+			"family":   "lorem_ip-sum",
+			"revision": "123",
+			"isValid":  true,
+		},
+		"lorem-ipsum:1": map[string]interface{}{
+			"family":   "lorem-ipsum",
+			"revision": "1",
+			"isValid":  true,
+		},
+	}
+
+	for input, expectedOutput := range cases {
+		family, revision, err := parseTaskDefinition(input)
+		isValid := expectedOutput["isValid"].(bool)
+		if !isValid && err == nil {
+			t.Fatalf("Task definition %s should fail", input)
+		}
+
+		expectedFamily := expectedOutput["family"].(string)
+		if family != expectedFamily {
+			t.Fatalf("Unexpected family (%#v) for task definition %s\n%#v", family, input, err)
+		}
+		expectedRevision := expectedOutput["revision"].(string)
+		if revision != expectedRevision {
+			t.Fatalf("Unexpected revision (%#v) for task definition %s\n%#v", revision, input, err)
+		}
+	}
+}
+
+func TestAccAWSEcsServiceWithARN(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsService,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.mongo"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSEcsServiceModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.mongo"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSEcsServiceWithFamilyAndRevision(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithFamilyAndRevision,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.jenkins"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSEcsServiceWithFamilyAndRevisionModified,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.jenkins"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsServiceDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_service" {
+			continue
+		}
+
+		out, err := conn.DescribeServices(&ecs.DescribeServicesInput{
+			Services: []*string{aws.String(rs.Primary.ID)},
+		})
+
+		if err == nil {
+			if len(out.Services) > 0 {
+				return fmt.Errorf("ECS service still exists:\n%#v", out.Services)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsService = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest1"
+}
+
+resource "aws_ecs_task_definition" "mongo" {
+  family = "mongodb"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "mongo:latest",
+    "memory": 128,
+    "name": "mongodb"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceModified = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest1"
+}
+
+resource "aws_ecs_task_definition" "mongo" {
+  family = "mongodb"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "mongo:latest",
+    "memory": 128,
+    "name": "mongodb"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 2
+}
+`
+
+var testAccAWSEcsServiceWithFamilyAndRevision = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest2"
+}
+
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "jenkins:latest",
+    "memory": 128,
+    "name": "jenkins"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "jenkins" {
+  name = "jenkins"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.jenkins.family}:${aws_ecs_task_definition.jenkins.revision}"
+  desired_count = 1
+}
+`
+
+var testAccAWSEcsServiceWithFamilyAndRevisionModified = `
+resource "aws_ecs_cluster" "default" {
+	name = "terraformecstest2"
+}
+
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "jenkins:latest",
+    "memory": 128,
+    "name": "jenkins"
+  }
+]
+DEFINITION
+}
+
+resource "aws_ecs_service" "jenkins" {
+  name = "jenkins"
+  cluster = "${aws_ecs_cluster.default.id}"
+  task_definition = "${aws_ecs_task_definition.jenkins.family}:${aws_ecs_task_definition.jenkins.revision}"
+  desired_count = 1
+}
+`
diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition.go b/builtin/providers/aws/resource_aws_ecs_task_definition.go
new file mode 100644
index 000000000..fe28252f2
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition.go
@@ -0,0 +1,179 @@
+package aws
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsEcsTaskDefinition() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsEcsTaskDefinitionCreate,
+		Read:   resourceAwsEcsTaskDefinitionRead,
+		Update: resourceAwsEcsTaskDefinitionUpdate,
+		Delete: resourceAwsEcsTaskDefinitionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"family": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"revision": &schema.Schema{
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+
+			"container_definitions": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				StateFunc: func(v interface{}) string {
+					hash := sha1.Sum([]byte(v.(string)))
+					return hex.EncodeToString(hash[:])
+				},
+			},
+
+			"volume": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"host_path": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsEcsTaskDefinitionVolumeHash,
+			},
+		},
+	}
+}
+
+func resourceAwsEcsTaskDefinitionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	rawDefinitions := d.Get("container_definitions").(string)
+	definitions, err := expandEcsContainerDefinitions(rawDefinitions)
+	if err != nil {
+		return err
+	}
+
+	input := ecs.RegisterTaskDefinitionInput{
+		ContainerDefinitions: definitions,
+		Family:               aws.String(d.Get("family").(string)),
+	}
+
+	if v, ok := d.GetOk("volume"); ok {
+		volumes, err := expandEcsVolumes(v.(*schema.Set).List())
+		if err != nil {
+			return err
+		}
+		input.Volumes = volumes
+	}
+
+	log.Printf("[DEBUG] Registering ECS task definition: %#v", input)
+	out, err := conn.RegisterTaskDefinition(&input)
+	if err != nil {
+		return err
+	}
+
+	taskDefinition := *out.TaskDefinition
+
+	log.Printf("[DEBUG] ECS task definition registered: %#v (rev. %d)",
+		*taskDefinition.TaskDefinitionARN, *taskDefinition.Revision)
+
+	d.SetId(*taskDefinition.Family)
+	d.Set("arn", *taskDefinition.TaskDefinitionARN)
+
+	return resourceAwsEcsTaskDefinitionRead(d, meta)
+}
+
+func resourceAwsEcsTaskDefinitionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	log.Printf("[DEBUG] Reading task definition %s", d.Id())
+	out, err := conn.DescribeTaskDefinition(&ecs.DescribeTaskDefinitionInput{
+		TaskDefinition: aws.String(d.Get("arn").(string)),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Received task definition %#v", out)
+
+	taskDefinition := out.TaskDefinition
+
+	d.SetId(*taskDefinition.Family)
+	d.Set("arn", *taskDefinition.TaskDefinitionARN)
+	d.Set("family", *taskDefinition.Family)
+	d.Set("revision", *taskDefinition.Revision)
+	d.Set("container_definitions", taskDefinition.ContainerDefinitions)
+	d.Set("volumes", flattenEcsVolumes(taskDefinition.Volumes))
+
+	return nil
+}
+
+func resourceAwsEcsTaskDefinitionUpdate(d *schema.ResourceData, meta interface{}) error {
+	oldArn := d.Get("arn").(string)
+
+	log.Printf("[DEBUG] Creating new revision of task definition %q", d.Id())
+	err := resourceAwsEcsTaskDefinitionCreate(d, meta)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] New revision of %q created: %q", d.Id(), d.Get("arn").(string))
+
+	log.Printf("[DEBUG] Deregistering old revision of task definition %q: %q", d.Id(), oldArn)
+	conn := meta.(*AWSClient).ecsconn
+	_, err = conn.DeregisterTaskDefinition(&ecs.DeregisterTaskDefinitionInput{
+		TaskDefinition: aws.String(oldArn),
+	})
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Old revision of task definition deregistered: %q", oldArn)
+
+	return resourceAwsEcsTaskDefinitionRead(d, meta)
+}
+
+func resourceAwsEcsTaskDefinitionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ecsconn
+
+	_, err := conn.DeregisterTaskDefinition(&ecs.DeregisterTaskDefinitionInput{
+		TaskDefinition: aws.String(d.Get("arn").(string)),
+	})
+	if err != nil {
+		return err
+	}
+
+	log.Printf("[DEBUG] Task definition %q deregistered.", d.Get("arn").(string))
+
+	return nil
+}
+
+func resourceAwsEcsTaskDefinitionVolumeHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["host_path"].(string)))
+
+	return hashcode.String(buf.String())
+}
diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition_test.go b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
new file mode 100644
index 000000000..2cff051c5
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
@@ -0,0 +1,166 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSEcsTaskDefinition_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsTaskDefinitionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsTaskDefinition,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsTaskDefinitionExists("aws_ecs_task_definition.jenkins"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSEcsTaskDefinitionModifier,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsTaskDefinitionExists("aws_ecs_task_definition.jenkins"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSEcsTaskDefinitionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ecsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_ecs_task_definition" {
+			continue
+		}
+
+		out, err := conn.DescribeTaskDefinition(&ecs.DescribeTaskDefinitionInput{
+			TaskDefinition: aws.String(rs.Primary.ID),
+		})
+
+		if err == nil {
+			if out.TaskDefinition != nil {
+				return fmt.Errorf("ECS task definition still exists:\n%#v", *out.TaskDefinition)
+			}
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func testAccCheckAWSEcsTaskDefinitionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSEcsTaskDefinition = `
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "terraform-acc-test"
+  container_definitions = <<TASK_DEFINITION
+[
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"environment": [
+			{"name": "VARNAME", "value": "VARVAL"}
+		],
+		"essential": true,
+		"image": "jenkins",
+		"links": ["mongodb"],
+		"memory": 128,
+		"name": "jenkins",
+		"portMappings": [
+			{
+				"containerPort": 80,
+				"hostPort": 8080
+			}
+		]
+	},
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"essential": true,
+		"image": "mongodb",
+		"memory": 128,
+		"name": "mongodb",
+		"portMappings": [
+			{
+				"containerPort": 28017,
+				"hostPort": 28017
+			}
+		]
+	}
+]
+TASK_DEFINITION
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+`
+
+var testAccAWSEcsTaskDefinitionModifier = `
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "terraform-acc-test"
+  container_definitions = <<TASK_DEFINITION
+[
+	{
+		"cpu": 10,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"environment": [
+			{"name": "VARNAME", "value": "VARVAL"}
+		],
+		"essential": true,
+		"image": "jenkins",
+		"links": ["mongodb"],
+		"memory": 128,
+		"name": "jenkins",
+		"portMappings": [
+			{
+				"containerPort": 80,
+				"hostPort": 8080
+			}
+		]
+	},
+	{
+		"cpu": 20,
+		"command": ["sleep", "10"],
+		"entryPoint": ["/"],
+		"essential": true,
+		"image": "mongodb",
+		"memory": 128,
+		"name": "mongodb",
+		"portMappings": [
+			{
+				"containerPort": 28017,
+				"hostPort": 28017
+			}
+		]
+	}
+]
+TASK_DEFINITION
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+`
diff --git a/builtin/providers/aws/resource_aws_eip.go b/builtin/providers/aws/resource_aws_eip.go
index f184cad78..f4b335a1e 100644
--- a/builtin/providers/aws/resource_aws_eip.go
+++ b/builtin/providers/aws/resource_aws_eip.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -222,6 +222,17 @@ func resourceAwsEipDelete(d *schema.ResourceData, meta interface{}) error {
 				PublicIP: aws.String(d.Get("public_ip").(string)),
 			})
 		}
+
+		if err != nil {
+			// First check if the association ID is not found. If this
+			// is the case, then it was already disassociated somehow,
+			// and that is okay. The most commmon reason for this is that
+			// the instance or ENI it was attached it was destroyed.
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidAssociationID.NotFound" {
+				err = nil
+			}
+		}
+
 		if err != nil {
 			return err
 		}
diff --git a/builtin/providers/aws/resource_aws_eip_test.go b/builtin/providers/aws/resource_aws_eip_test.go
index 7509d71cc..0fe42667a 100644
--- a/builtin/providers/aws/resource_aws_eip_test.go
+++ b/builtin/providers/aws/resource_aws_eip_test.go
@@ -5,14 +5,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSEIP_normal(t *testing.T) {
+func TestAccAWSEIP_basic(t *testing.T) {
 	var conf ec2.Address
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_elasticache_cluster.go b/builtin/providers/aws/resource_aws_elasticache_cluster.go
index b62df2dec..d47b275c7 100644
--- a/builtin/providers/aws/resource_aws_elasticache_cluster.go
+++ b/builtin/providers/aws/resource_aws_elasticache_cluster.go
@@ -7,10 +7,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -32,7 +33,6 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 			"engine": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"node_type": &schema.Schema{
 				Type:     schema.TypeString,
@@ -42,25 +42,21 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 			"num_cache_nodes": &schema.Schema{
 				Type:     schema.TypeInt,
 				Required: true,
-				ForceNew: true,
 			},
 			"parameter_group_name": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 			"port": &schema.Schema{
 				Type:     schema.TypeInt,
-				Default:  11211,
-				Optional: true,
+				Required: true,
 				ForceNew: true,
 			},
 			"engine_version": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 			"subnet_group_name": &schema.Schema{
 				Type:     schema.TypeString,
@@ -82,7 +78,6 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set: func(v interface{}) int {
 					return hashcode.String(v.(string))
@@ -111,6 +106,15 @@ func resourceAwsElasticacheCluster() *schema.Resource {
 			},
 
 			"tags": tagsSchema(),
+
+			// apply_immediately is used to determine when the update modifications
+			// take place.
+			// See http://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html
+			"apply_immediately": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -123,7 +127,7 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 	numNodes := int64(d.Get("num_cache_nodes").(int)) // 2
 	engine := d.Get("engine").(string)                // memcached
 	engineVersion := d.Get("engine_version").(string) // 1.4.14
-	port := int64(d.Get("port").(int))                // 11211
+	port := int64(d.Get("port").(int))                // e.g) 11211
 	subnetGroupName := d.Get("subnet_group_name").(string)
 	securityNameSet := d.Get("security_group_names").(*schema.Set)
 	securityIdSet := d.Get("security_group_ids").(*schema.Set)
@@ -159,7 +163,7 @@ func resourceAwsElasticacheClusterCreate(d *schema.ResourceData, meta interface{
 	stateConf := &resource.StateChangeConf{
 		Pending:    pending,
 		Target:     "available",
-		Refresh:    CacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
+		Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
 		Timeout:    10 * time.Minute,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
@@ -241,6 +245,59 @@ func resourceAwsElasticacheClusterUpdate(d *schema.ResourceData, meta interface{
 			return err
 		}
 	}
+
+	req := &elasticache.ModifyCacheClusterInput{
+		CacheClusterID:   aws.String(d.Id()),
+		ApplyImmediately: aws.Boolean(d.Get("apply_immediately").(bool)),
+	}
+
+	requestUpdate := false
+	if d.HasChange("security_group_ids") {
+		if attr := d.Get("security_group_ids").(*schema.Set); attr.Len() > 0 {
+			req.SecurityGroupIDs = expandStringList(attr.List())
+			requestUpdate = true
+		}
+	}
+
+	if d.HasChange("parameter_group_name") {
+		req.CacheParameterGroupName = aws.String(d.Get("parameter_group_name").(string))
+		requestUpdate = true
+	}
+
+	if d.HasChange("engine_version") {
+		req.EngineVersion = aws.String(d.Get("engine_version").(string))
+		requestUpdate = true
+	}
+
+	if d.HasChange("num_cache_nodes") {
+		req.NumCacheNodes = aws.Long(int64(d.Get("num_cache_nodes").(int)))
+		requestUpdate = true
+	}
+
+	if requestUpdate {
+		log.Printf("[DEBUG] Modifying ElastiCache Cluster (%s), opts:\n%s", d.Id(), awsutil.StringValue(req))
+		_, err := conn.ModifyCacheCluster(req)
+		if err != nil {
+			return fmt.Errorf("[WARN] Error updating ElastiCache cluster (%s), error: %s", d.Id(), err)
+		}
+
+		log.Printf("[DEBUG] Waiting for update: %s", d.Id())
+		pending := []string{"modifying", "rebooting cache cluster nodes", "snapshotting"}
+		stateConf := &resource.StateChangeConf{
+			Pending:    pending,
+			Target:     "available",
+			Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "available", pending),
+			Timeout:    5 * time.Minute,
+			Delay:      5 * time.Second,
+			MinTimeout: 3 * time.Second,
+		}
+
+		_, sterr := stateConf.WaitForState()
+		if sterr != nil {
+			return fmt.Errorf("Error waiting for elasticache (%s) to update: %s", d.Id(), sterr)
+		}
+	}
+
 	return resourceAwsElasticacheClusterRead(d, meta)
 }
 
@@ -253,7 +310,7 @@ func setCacheNodeData(d *schema.ResourceData, c *elasticache.CacheCluster) error
 
 	for _, node := range sortedCacheNodes {
 		if node.CacheNodeID == nil || node.Endpoint == nil || node.Endpoint.Address == nil || node.Endpoint.Port == nil {
-			return fmt.Errorf("Unexpected nil pointer in: %#v", node)
+			return fmt.Errorf("Unexpected nil pointer in: %s", awsutil.StringValue(node))
 		}
 		cacheNodeData = append(cacheNodeData, map[string]interface{}{
 			"id":      *node.CacheNodeID,
@@ -289,7 +346,7 @@ func resourceAwsElasticacheClusterDelete(d *schema.ResourceData, meta interface{
 	stateConf := &resource.StateChangeConf{
 		Pending:    []string{"creating", "available", "deleting", "incompatible-parameters", "incompatible-network", "restore-failed"},
 		Target:     "",
-		Refresh:    CacheClusterStateRefreshFunc(conn, d.Id(), "", []string{}),
+		Refresh:    cacheClusterStateRefreshFunc(conn, d.Id(), "", []string{}),
 		Timeout:    10 * time.Minute,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
@@ -305,10 +362,11 @@ func resourceAwsElasticacheClusterDelete(d *schema.ResourceData, meta interface{
 	return nil
 }
 
-func CacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, givenState string, pending []string) resource.StateRefreshFunc {
+func cacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, givenState string, pending []string) resource.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		resp, err := conn.DescribeCacheClusters(&elasticache.DescribeCacheClustersInput{
-			CacheClusterID: aws.String(clusterID),
+			CacheClusterID:    aws.String(clusterID),
+			ShowCacheNodeInfo: aws.Boolean(true),
 		})
 		if err != nil {
 			apierr := err.(awserr.Error)
@@ -336,6 +394,18 @@ func CacheClusterStateRefreshFunc(conn *elasticache.ElastiCache, clusterID, give
 
 		// return given state if it's not in pending
 		if givenState != "" {
+			// check to make sure we have the node count we're expecting
+			if int64(len(c.CacheNodes)) != *c.NumCacheNodes {
+				log.Printf("[DEBUG] Node count is not what is expected: %d found, %d expected", len(c.CacheNodes), *c.NumCacheNodes)
+				return nil, "creating", nil
+			}
+			// loop the nodes and check their status as well
+			for _, n := range c.CacheNodes {
+				if n.CacheNodeStatus != nil && *n.CacheNodeStatus != "available" {
+					log.Printf("[DEBUG] Node (%s) is not yet available, status: %s", *n.CacheNodeID, *n.CacheNodeStatus)
+					return nil, "creating", nil
+				}
+			}
 			return c, givenState, nil
 		}
 		log.Printf("[DEBUG] current status: %v", *c.CacheClusterStatus)
diff --git a/builtin/providers/aws/resource_aws_elasticache_cluster_test.go b/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
index 1fb478b26..c5e12ebd8 100644
--- a/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_cluster_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -32,6 +32,7 @@ func TestAccAWSElasticacheCluster_basic(t *testing.T) {
 }
 
 func TestAccAWSElasticacheCluster_vpc(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
@@ -40,7 +41,7 @@ func TestAccAWSElasticacheCluster_vpc(t *testing.T) {
 			resource.TestStep{
 				Config: testAccAWSElasticacheClusterInVPCConfig,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar"),
+					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar", &csg),
 					testAccCheckAWSElasticacheClusterExists("aws_elasticache_cluster.bar"),
 				),
 			},
@@ -95,7 +96,7 @@ func genRandInt() int {
 }
 
 var testAccAWSElasticacheClusterConfig = fmt.Sprintf(`
-provider "aws" { 
+provider "aws" {
 	region = "us-east-1"
 }
 resource "aws_security_group" "bar" {
@@ -120,6 +121,7 @@ resource "aws_elasticache_cluster" "bar" {
     engine = "memcached"
     node_type = "cache.m1.small"
     num_cache_nodes = 1
+    port = 11211
     parameter_group_name = "default.memcached1.4"
     security_group_names = ["${aws_elasticache_security_group.bar.name}"]
 }
diff --git a/builtin/providers/aws/resource_aws_elasticache_parameter_group.go b/builtin/providers/aws/resource_aws_elasticache_parameter_group.go
new file mode 100644
index 000000000..3574d5dcf
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_elasticache_parameter_group.go
@@ -0,0 +1,211 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+)
+
+func resourceAwsElasticacheParameterGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsElasticacheParameterGroupCreate,
+		Read:   resourceAwsElasticacheParameterGroupRead,
+		Update: resourceAwsElasticacheParameterGroupUpdate,
+		Delete: resourceAwsElasticacheParameterGroupDelete,
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"family": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"parameter": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: false,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"value": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAwsElasticacheParameterHash,
+			},
+		},
+	}
+}
+
+func resourceAwsElasticacheParameterGroupCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	createOpts := elasticache.CreateCacheParameterGroupInput{
+		CacheParameterGroupName:   aws.String(d.Get("name").(string)),
+		CacheParameterGroupFamily: aws.String(d.Get("family").(string)),
+		Description:            aws.String(d.Get("description").(string)),
+	}
+
+	log.Printf("[DEBUG] Create Cache Parameter Group: %#v", createOpts)
+	_, err := conn.CreateCacheParameterGroup(&createOpts)
+	if err != nil {
+		return fmt.Errorf("Error creating DB Parameter Group: %s", err)
+	}
+
+	d.Partial(true)
+	d.SetPartial("name")
+	d.SetPartial("family")
+	d.SetPartial("description")
+	d.Partial(false)
+
+	d.SetId(*createOpts.CacheParameterGroupName)
+	log.Printf("[INFO] Cache Parameter Group ID: %s", d.Id())
+
+	return resourceAwsElasticacheParameterGroupUpdate(d, meta)
+}
+
+func resourceAwsElasticacheParameterGroupRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	describeOpts := elasticache.DescribeCacheParameterGroupsInput{
+		CacheParameterGroupName: aws.String(d.Id()),
+	}
+
+	describeResp, err := conn.DescribeCacheParameterGroups(&describeOpts)
+	if err != nil {
+		return err
+	}
+
+	if len(describeResp.CacheParameterGroups) != 1 ||
+		*describeResp.CacheParameterGroups[0].CacheParameterGroupName != d.Id() {
+		return fmt.Errorf("Unable to find Parameter Group: %#v", describeResp.CacheParameterGroups)
+	}
+
+	d.Set("name", describeResp.CacheParameterGroups[0].CacheParameterGroupName)
+	d.Set("family", describeResp.CacheParameterGroups[0].CacheParameterGroupFamily)
+	d.Set("description", describeResp.CacheParameterGroups[0].Description)
+
+	// Only include user customized parameters as there's hundreds of system/default ones
+	describeParametersOpts := elasticache.DescribeCacheParametersInput{
+		CacheParameterGroupName: aws.String(d.Id()),
+		Source:               aws.String("user"),
+	}
+
+	describeParametersResp, err := conn.DescribeCacheParameters(&describeParametersOpts)
+	if err != nil {
+		return err
+	}
+
+	d.Set("parameter", flattenElastiCacheParameters(describeParametersResp.Parameters))
+
+	return nil
+}
+
+func resourceAwsElasticacheParameterGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	d.Partial(true)
+
+	if d.HasChange("parameter") {
+		o, n := d.GetChange("parameter")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+
+		// Expand the "parameter" set to aws-sdk-go compat []elasticacheconn.Parameter
+		parameters, err := expandElastiCacheParameters(ns.Difference(os).List())
+		if err != nil {
+			return err
+		}
+
+		if len(parameters) > 0 {
+			modifyOpts := elasticache.ModifyCacheParameterGroupInput{
+				CacheParameterGroupName: aws.String(d.Get("name").(string)),
+				ParameterNameValues:     parameters,
+			}
+
+			log.Printf("[DEBUG] Modify Cache Parameter Group: %#v", modifyOpts)
+			_, err = conn.ModifyCacheParameterGroup(&modifyOpts)
+			if err != nil {
+				return fmt.Errorf("Error modifying Cache Parameter Group: %s", err)
+			}
+		}
+		d.SetPartial("parameter")
+	}
+
+	d.Partial(false)
+
+	return resourceAwsElasticacheParameterGroupRead(d, meta)
+}
+
+func resourceAwsElasticacheParameterGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"pending"},
+		Target:     "destroyed",
+		Refresh:    resourceAwsElasticacheParameterGroupDeleteRefreshFunc(d, meta),
+		Timeout:    3 * time.Minute,
+		MinTimeout: 1 * time.Second,
+	}
+	_, err := stateConf.WaitForState()
+	return err
+}
+
+func resourceAwsElasticacheParameterGroupDeleteRefreshFunc(
+	d *schema.ResourceData,
+	meta interface{}) resource.StateRefreshFunc {
+	conn := meta.(*AWSClient).elasticacheconn
+
+	return func() (interface{}, string, error) {
+
+		deleteOpts := elasticache.DeleteCacheParameterGroupInput{
+			CacheParameterGroupName: aws.String(d.Id()),
+		}
+
+		if _, err := conn.DeleteCacheParameterGroup(&deleteOpts); err != nil {
+			elasticahceerr, ok := err.(awserr.Error)
+			if ok && elasticahceerr.Code() == "CacheParameterGroupNotFoundFault" {
+				d.SetId("")
+				return d, "error", err
+			}
+			return d, "error", err
+		}
+		return d, "destroyed", nil
+	}
+}
+
+func resourceAwsElasticacheParameterHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["value"].(string)))
+
+	return hashcode.String(buf.String())
+}
diff --git a/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go b/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go
new file mode 100644
index 000000000..e61e64b3c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_elasticache_parameter_group_test.go
@@ -0,0 +1,210 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSElasticacheParameterGroup_basic(t *testing.T) {
+	var v elasticache.CacheParameterGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheParameterGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.name", "appendonly"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.value", "yes"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupAddParametersConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.name", "appendonly"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.283487565.value", "yes"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.2196914567.name", "appendfsync"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "parameter.2196914567.value", "always"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSElasticacheParameterGroupOnly(t *testing.T) {
+	var v elasticache.CacheParameterGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheParameterGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSElasticacheParameterGroupOnlyConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheParameterGroupExists("aws_elasticache_parameter_group.bar", &v),
+					testAccCheckAWSElasticacheParameterGroupAttributes(&v),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "name", "parameter-group-test-terraform"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "family", "redis2.8"),
+					resource.TestCheckResourceAttr(
+						"aws_elasticache_parameter_group.bar", "description", "Test parameter group for terraform"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSElasticacheParameterGroupDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_elasticache_parameter_group" {
+			continue
+		}
+
+		// Try to find the Group
+		resp, err := conn.DescribeCacheParameterGroups(
+			&elasticache.DescribeCacheParameterGroupsInput{
+				CacheParameterGroupName: aws.String(rs.Primary.ID),
+			})
+
+		if err == nil {
+			if len(resp.CacheParameterGroups) != 0 &&
+				*resp.CacheParameterGroups[0].CacheParameterGroupName == rs.Primary.ID {
+				return fmt.Errorf("Cache Parameter Group still exists")
+			}
+		}
+
+		// Verify the error
+		newerr, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if newerr.Code() != "InvalidCacheParameterGroup.NotFound" {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSElasticacheParameterGroupAttributes(v *elasticache.CacheParameterGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if *v.CacheParameterGroupName != "parameter-group-test-terraform" {
+			return fmt.Errorf("bad name: %#v", v.CacheParameterGroupName)
+		}
+
+		if *v.CacheParameterGroupFamily != "redis2.8" {
+			return fmt.Errorf("bad family: %#v", v.CacheParameterGroupFamily)
+		}
+
+		if *v.Description != "Test parameter group for terraform" {
+			return fmt.Errorf("bad description: %#v", v.Description)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAWSElasticacheParameterGroupExists(n string, v *elasticache.CacheParameterGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Cache Parameter Group ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
+
+		opts := elasticache.DescribeCacheParameterGroupsInput{
+			CacheParameterGroupName: aws.String(rs.Primary.ID),
+		}
+
+		resp, err := conn.DescribeCacheParameterGroups(&opts)
+
+		if err != nil {
+			return err
+		}
+
+		if len(resp.CacheParameterGroups) != 1 ||
+			*resp.CacheParameterGroups[0].CacheParameterGroupName != rs.Primary.ID {
+			return fmt.Errorf("Cache Parameter Group not found")
+		}
+
+		*v = *resp.CacheParameterGroups[0]
+
+		return nil
+	}
+}
+
+const testAccAWSElasticacheParameterGroupConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+	parameter {
+	  name = "appendonly"
+	  value = "yes"
+	}
+}
+`
+
+const testAccAWSElasticacheParameterGroupAddParametersConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+	parameter {
+	  name = "appendonly"
+	  value = "yes"
+	}
+	parameter {
+	  name = "appendfsync"
+	  value = "always"
+	}
+}
+`
+
+const testAccAWSElasticacheParameterGroupOnlyConfig = `
+resource "aws_elasticache_parameter_group" "bar" {
+	name = "parameter-group-test-terraform"
+	family = "redis2.8"
+	description = "Test parameter group for terraform"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_elasticache_security_group.go b/builtin/providers/aws/resource_aws_elasticache_security_group.go
index 4fb47f85b..293747031 100644
--- a/builtin/providers/aws/resource_aws_elasticache_security_group.go
+++ b/builtin/providers/aws/resource_aws_elasticache_security_group.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
diff --git a/builtin/providers/aws/resource_aws_elasticache_security_group_test.go b/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
index 61464936a..87644242f 100644
--- a/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_security_group_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSElasticacheSecurityGroup(t *testing.T) {
+func TestAccAWSElasticacheSecurityGroup_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_elasticache_subnet_group.go b/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
index 0c1605016..3a8533164 100644
--- a/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
+++ b/builtin/providers/aws/resource_aws_elasticache_subnet_group.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
-	"github.com/hashicorp/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -17,13 +17,13 @@ func resourceAwsElasticacheSubnetGroup() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceAwsElasticacheSubnetGroupCreate,
 		Read:   resourceAwsElasticacheSubnetGroupRead,
+		Update: resourceAwsElasticacheSubnetGroupUpdate,
 		Delete: resourceAwsElasticacheSubnetGroupDelete,
 
 		Schema: map[string]*schema.Schema{
 			"description": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"name": &schema.Schema{
 				Type:     schema.TypeString,
@@ -32,9 +32,7 @@ func resourceAwsElasticacheSubnetGroup() *schema.Resource {
 			},
 			"subnet_ids": &schema.Schema{
 				Type:     schema.TypeSet,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
+				Required: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set: func(v interface{}) int {
 					return hashcode.String(v.(string))
@@ -110,6 +108,29 @@ func resourceAwsElasticacheSubnetGroupRead(d *schema.ResourceData, meta interfac
 	return nil
 }
 
+func resourceAwsElasticacheSubnetGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).elasticacheconn
+	if d.HasChange("subnet_ids") || d.HasChange("description") {
+		var subnets []*string
+		if v := d.Get("subnet_ids"); v != nil {
+			for _, v := range v.(*schema.Set).List() {
+				subnets = append(subnets, aws.String(v.(string)))
+			}
+		}
+		log.Printf("[DEBUG] Updating ElastiCache Subnet Group")
+
+		_, err := conn.ModifyCacheSubnetGroup(&elasticache.ModifyCacheSubnetGroupInput{
+			CacheSubnetGroupName:        aws.String(d.Get("name").(string)),
+			CacheSubnetGroupDescription: aws.String(d.Get("description").(string)),
+			SubnetIDs:                   subnets,
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	return resourceAwsElasticacheSubnetGroupRead(d, meta)
+}
 func resourceAwsElasticacheSubnetGroupDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).elasticacheconn
 
diff --git a/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go b/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
index 0a16ebf84..d54a4d610 100644
--- a/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
+++ b/builtin/providers/aws/resource_aws_elasticache_subnet_group_test.go
@@ -4,22 +4,56 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSElasticacheSubnetGroup(t *testing.T) {
+func TestAccAWSElasticacheSubnetGroup_basic(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
+	config := fmt.Sprintf(testAccAWSElasticacheSubnetGroupConfig, genRandInt())
+
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
 		CheckDestroy: testAccCheckAWSElasticacheSubnetGroupDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccAWSElasticacheSubnetGroupConfig,
+				Config: config,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar"),
+					testAccCheckAWSElasticacheSubnetGroupExists("aws_elasticache_subnet_group.bar", &csg),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSElasticacheSubnetGroup_update(t *testing.T) {
+	var csg elasticache.CacheSubnetGroup
+	rn := "aws_elasticache_subnet_group.bar"
+	ri := genRandInt()
+	preConfig := fmt.Sprintf(testAccAWSElasticacheSubnetGroupUpdateConfigPre, ri)
+	postConfig := fmt.Sprintf(testAccAWSElasticacheSubnetGroupUpdateConfigPost, ri)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSElasticacheSubnetGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: preConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheSubnetGroupExists(rn, &csg),
+					testAccCheckAWSElastiCacheSubnetGroupAttrs(&csg, rn, 1),
+				),
+			},
+
+			resource.TestStep{
+				Config: postConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSElasticacheSubnetGroupExists(rn, &csg),
+					testAccCheckAWSElastiCacheSubnetGroupAttrs(&csg, rn, 2),
 				),
 			},
 		},
@@ -46,7 +80,7 @@ func testAccCheckAWSElasticacheSubnetGroupDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccCheckAWSElasticacheSubnetGroupExists(n string) resource.TestCheckFunc {
+func testAccCheckAWSElasticacheSubnetGroupExists(n string, csg *elasticache.CacheSubnetGroup) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -58,17 +92,47 @@ func testAccCheckAWSElasticacheSubnetGroupExists(n string) resource.TestCheckFun
 		}
 
 		conn := testAccProvider.Meta().(*AWSClient).elasticacheconn
-		_, err := conn.DescribeCacheSubnetGroups(&elasticache.DescribeCacheSubnetGroupsInput{
+		resp, err := conn.DescribeCacheSubnetGroups(&elasticache.DescribeCacheSubnetGroupsInput{
 			CacheSubnetGroupName: aws.String(rs.Primary.ID),
 		})
 		if err != nil {
 			return fmt.Errorf("CacheSubnetGroup error: %v", err)
 		}
+
+		for _, c := range resp.CacheSubnetGroups {
+			if rs.Primary.ID == *c.CacheSubnetGroupName {
+				*csg = *c
+			}
+		}
+
+		if csg == nil {
+			return fmt.Errorf("cache subnet group not found")
+		}
 		return nil
 	}
 }
 
-var testAccAWSElasticacheSubnetGroupConfig = fmt.Sprintf(`
+func testAccCheckAWSElastiCacheSubnetGroupAttrs(csg *elasticache.CacheSubnetGroup, n string, count int) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if len(csg.Subnets) != count {
+			return fmt.Errorf("Bad cache subnet count, expected: %d, got: %d", count, len(csg.Subnets))
+		}
+
+		if rs.Primary.Attributes["description"] != *csg.CacheSubnetGroupDescription {
+			return fmt.Errorf("Bad cache subnet description, expected: %s, got: %s", rs.Primary.Attributes["description"], *csg.CacheSubnetGroupDescription)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSElasticacheSubnetGroupConfig = `
 resource "aws_vpc" "foo" {
     cidr_block = "192.168.0.0/16"
     tags {
@@ -90,4 +154,63 @@ resource "aws_elasticache_subnet_group" "bar" {
     description = "tf-test-cache-subnet-group-descr"
     subnet_ids = ["${aws_subnet.foo.id}"]
 }
-`, genRandInt())
+`
+var testAccAWSElasticacheSubnetGroupUpdateConfigPre = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+    tags {
+            Name = "tf-elc-sub-test"
+    }
+}
+
+resource "aws_subnet" "foo" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test"
+    }
+}
+
+resource "aws_elasticache_subnet_group" "bar" {
+    name = "tf-test-cache-subnet-%03d"
+    description = "tf-test-cache-subnet-group-descr"
+    subnet_ids = ["${aws_subnet.foo.id}"]
+}
+`
+
+var testAccAWSElasticacheSubnetGroupUpdateConfigPost = `
+resource "aws_vpc" "foo" {
+    cidr_block = "10.0.0.0/16"
+    tags {
+            Name = "tf-elc-sub-test"
+    }
+}
+
+resource "aws_subnet" "foo" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.1.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test"
+    }
+}
+
+resource "aws_subnet" "bar" {
+    vpc_id = "${aws_vpc.foo.id}"
+    cidr_block = "10.0.2.0/24"
+    availability_zone = "us-west-2a"
+    tags {
+            Name = "tf-test-foo-update"
+    }
+}
+
+resource "aws_elasticache_subnet_group" "bar" {
+    name = "tf-test-cache-subnet-%03d"
+    description = "tf-test-cache-subnet-group-descr-edited"
+    subnet_ids = [
+			"${aws_subnet.foo.id}",
+			"${aws_subnet.bar.id}",
+		]
+}
+`
diff --git a/builtin/providers/aws/resource_aws_elb.go b/builtin/providers/aws/resource_aws_elb.go
index 0afcba888..b76cc7131 100644
--- a/builtin/providers/aws/resource_aws_elb.go
+++ b/builtin/providers/aws/resource_aws_elb.go
@@ -4,10 +4,12 @@ import (
 	"bytes"
 	"fmt"
 	"log"
+	"regexp"
+	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -24,6 +26,26 @@ func resourceAwsElb() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"only lowercase alphanumeric characters and hyphens allowed in %q", k))
+					}
+					if len(value) > 32 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 32 characters", k))
+					}
+					if regexp.MustCompile(`^-`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot begin with a hyphen", k))
+					}
+					if regexp.MustCompile(`-$`).MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot end with a hyphen", k))
+					}
+					return
+				},
 			},
 
 			"internal": &schema.Schema{
@@ -541,9 +563,11 @@ func resourceAwsElbListenerHash(v interface{}) int {
 	var buf bytes.Buffer
 	m := v.(map[string]interface{})
 	buf.WriteString(fmt.Sprintf("%d-", m["instance_port"].(int)))
-	buf.WriteString(fmt.Sprintf("%s-", m["instance_protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-",
+		strings.ToLower(m["instance_protocol"].(string))))
 	buf.WriteString(fmt.Sprintf("%d-", m["lb_port"].(int)))
-	buf.WriteString(fmt.Sprintf("%s-", m["lb_protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-",
+		strings.ToLower(m["lb_protocol"].(string))))
 
 	if v, ok := m["ssl_certificate_id"]; ok {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
diff --git a/builtin/providers/aws/resource_aws_elb_test.go b/builtin/providers/aws/resource_aws_elb_test.go
index 6c5b685ac..f4cdc3a96 100644
--- a/builtin/providers/aws/resource_aws_elb_test.go
+++ b/builtin/providers/aws/resource_aws_elb_test.go
@@ -7,9 +7,9 @@ import (
 	"sort"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -362,6 +362,39 @@ func TestAccAWSELB_SecurityGroups(t *testing.T) {
 	})
 }
 
+// Unit test for listeners hash
+func TestResourceAwsElbListenerHash(t *testing.T) {
+	cases := map[string]struct {
+		Left  map[string]interface{}
+		Right map[string]interface{}
+		Match bool
+	}{
+		"protocols are case insensitive": {
+			map[string]interface{}{
+				"instance_port":     80,
+				"instance_protocol": "TCP",
+				"lb_port":           80,
+				"lb_protocol":       "TCP",
+			},
+			map[string]interface{}{
+				"instance_port":     80,
+				"instance_protocol": "Tcp",
+				"lb_port":           80,
+				"lb_protocol":       "tcP",
+			},
+			true,
+		},
+	}
+
+	for tn, tc := range cases {
+		leftHash := resourceAwsElbListenerHash(tc.Left)
+		rightHash := resourceAwsElbListenerHash(tc.Right)
+		if (leftHash == rightHash) != tc.Match {
+			t.Fatalf("%s: expected match: %t, but did not get it", tn, tc.Match)
+		}
+	}
+}
+
 func testAccCheckAWSELBDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).elbconn
 
@@ -513,7 +546,8 @@ resource "aws_elb" "bar" {
     instance_port = 8000
     instance_protocol = "http"
     lb_port = 80
-    lb_protocol = "http"
+    // Protocol should be case insensitive
+    lb_protocol = "HttP"
   }
 
 	tags {
diff --git a/builtin/providers/aws/resource_aws_flow_log.go b/builtin/providers/aws/resource_aws_flow_log.go
new file mode 100644
index 000000000..39b3c7566
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_flow_log.go
@@ -0,0 +1,155 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsFlowLog() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsLogFlowCreate,
+		Read:   resourceAwsLogFlowRead,
+		Delete: resourceAwsLogFlowDelete,
+
+		Schema: map[string]*schema.Schema{
+			"iam_role_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"log_group_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"vpc_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"subnet_id", "eni_id"},
+			},
+
+			"subnet_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"eni_id", "vpc_id"},
+			},
+
+			"eni_id": &schema.Schema{
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"subnet_id", "vpc_id"},
+			},
+
+			"traffic_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsLogFlowCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	types := []struct {
+		ID   string
+		Type string
+	}{
+		{ID: d.Get("vpc_id").(string), Type: "VPC"},
+		{ID: d.Get("subnet_id").(string), Type: "Subnet"},
+		{ID: d.Get("eni_id").(string), Type: "NetworkInterface"},
+	}
+
+	var resourceId string
+	var resourceType string
+	for _, t := range types {
+		if t.ID != "" {
+			resourceId = t.ID
+			resourceType = t.Type
+			break
+		}
+	}
+
+	if resourceId == "" || resourceType == "" {
+		return fmt.Errorf("Error: Flow Logs require either a VPC, Subnet, or ENI ID")
+	}
+
+	opts := &ec2.CreateFlowLogsInput{
+		DeliverLogsPermissionARN: aws.String(d.Get("iam_role_arn").(string)),
+		LogGroupName:             aws.String(d.Get("log_group_name").(string)),
+		ResourceIDs:              []*string{aws.String(resourceId)},
+		ResourceType:             aws.String(resourceType),
+		TrafficType:              aws.String(d.Get("traffic_type").(string)),
+	}
+
+	log.Printf(
+		"[DEBUG] Flow Log Create configuration: %s", awsutil.StringValue(opts))
+	resp, err := conn.CreateFlowLogs(opts)
+	if err != nil {
+		return fmt.Errorf("Error creating Flow Log for (%s), error: %s", resourceId, err)
+	}
+
+	if len(resp.FlowLogIDs) > 1 {
+		return fmt.Errorf("Error: multiple Flow Logs created for (%s)", resourceId)
+	}
+
+	d.SetId(*resp.FlowLogIDs[0])
+
+	return resourceAwsLogFlowRead(d, meta)
+}
+
+func resourceAwsLogFlowRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	opts := &ec2.DescribeFlowLogsInput{
+		FlowLogIDs: []*string{aws.String(d.Id())},
+	}
+
+	resp, err := conn.DescribeFlowLogs(opts)
+	if err != nil {
+		log.Printf("[WARN] Error describing Flow Logs for id (%s)", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if len(resp.FlowLogs) == 0 {
+		log.Printf("[WARN] No Flow Logs found for id (%s)", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	fl := resp.FlowLogs[0]
+
+	d.Set("traffic_type", fl.TrafficType)
+	d.Set("log_group_name", fl.LogGroupName)
+	d.Set("iam_role_arn", fl.DeliverLogsPermissionARN)
+
+	return nil
+}
+
+func resourceAwsLogFlowDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	log.Printf(
+		"[DEBUG] Flow Log Destroy: %s", d.Id())
+	_, err := conn.DeleteFlowLogs(&ec2.DeleteFlowLogsInput{
+		FlowLogIDs: []*string{aws.String(d.Id())},
+	})
+
+	if err != nil {
+		return fmt.Errorf("[WARN] Error deleting Flow Log with ID (%s), error: %s", d.Id(), err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_flow_log_test.go b/builtin/providers/aws/resource_aws_flow_log_test.go
new file mode 100644
index 000000000..b938a6fea
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_flow_log_test.go
@@ -0,0 +1,212 @@
+package aws
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccFlowLog_basic(t *testing.T) {
+	var flowLog ec2.FlowLog
+	lgn := os.Getenv("LOG_GROUP_NAME")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckFlowLogDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: fmt.Sprintf(testAccFlowLogConfig_basic, lgn),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFlowLogExists("aws_flow_log.test_flow_log", &flowLog),
+					testAccCheckAWSFlowLogAttributes(&flowLog),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFlowLog_subnet(t *testing.T) {
+	var flowLog ec2.FlowLog
+	lgn := os.Getenv("LOG_GROUP_NAME")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckFlowLogDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: fmt.Sprintf(testAccFlowLogConfig_subnet, lgn),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFlowLogExists("aws_flow_log.test_flow_log_subnet", &flowLog),
+					testAccCheckAWSFlowLogAttributes(&flowLog),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckFlowLogExists(n string, flowLog *ec2.FlowLog) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Flow Log ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+		describeOpts := &ec2.DescribeFlowLogsInput{
+			FlowLogIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+		resp, err := conn.DescribeFlowLogs(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		if len(resp.FlowLogs) > 0 {
+			*flowLog = *resp.FlowLogs[0]
+			return nil
+		}
+		return fmt.Errorf("No Flow Logs found for id (%s)", rs.Primary.ID)
+	}
+}
+
+func testAccCheckAWSFlowLogAttributes(flowLog *ec2.FlowLog) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if flowLog.FlowLogStatus != nil && *flowLog.FlowLogStatus == "ACTIVE" {
+			return nil
+		}
+		if flowLog.FlowLogStatus == nil {
+			return fmt.Errorf("Flow Log status is not ACTIVE, is nil")
+		} else {
+			return fmt.Errorf("Flow Log status is not ACTIVE, got: %s", *flowLog.FlowLogStatus)
+		}
+	}
+}
+
+func testAccCheckFlowLogDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_flow_log" {
+			continue
+		}
+
+		return nil
+	}
+
+	return nil
+}
+
+var testAccFlowLogConfig_basic = `
+resource "aws_vpc" "default" {
+        cidr_block = "10.0.0.0/16"
+        tags {
+                Name = "tf-flow-log-test"
+        }
+}
+
+resource "aws_subnet" "test_subnet" {
+        vpc_id = "${aws_vpc.default.id}"
+        cidr_block = "10.0.1.0/24"
+
+        tags {
+                Name = "tf-flow-test"
+        }
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "ec2.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_flow_log" "test_flow_log" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "tf-test-log-group"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        vpc_id = "${aws_vpc.default.id}"
+        traffic_type = "ALL"
+}
+
+resource "aws_flow_log" "test_flow_log_subnet" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "%s"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        subnet_id = "${aws_subnet.test_subnet.id}"
+        traffic_type = "ALL"
+}
+`
+
+var testAccFlowLogConfig_subnet = `
+resource "aws_vpc" "default" {
+        cidr_block = "10.0.0.0/16"
+        tags {
+                Name = "tf-flow-log-test"
+        }
+}
+
+resource "aws_subnet" "test_subnet" {
+        vpc_id = "${aws_vpc.default.id}"
+        cidr_block = "10.0.1.0/24"
+
+        tags {
+                Name = "tf-flow-test"
+        }
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "ec2.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_flow_log" "test_flow_log_subnet" {
+        # log_group_name needs to exist before hand
+        # until we have a CloudWatch Log Group Resource
+        log_group_name = "%s"
+        iam_role_arn = "${aws_iam_role.test_role.arn}"
+        subnet_id = "${aws_subnet.test_subnet.id}"
+        traffic_type = "ALL"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_access_key.go b/builtin/providers/aws/resource_aws_iam_access_key.go
index 491e547fc..943a22edb 100644
--- a/builtin/providers/aws/resource_aws_iam_access_key.go
+++ b/builtin/providers/aws/resource_aws_iam_access_key.go
@@ -3,9 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_iam_access_key_test.go b/builtin/providers/aws/resource_aws_iam_access_key_test.go
index ef6e49de1..1d62b93b9 100644
--- a/builtin/providers/aws/resource_aws_iam_access_key_test.go
+++ b/builtin/providers/aws/resource_aws_iam_access_key_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSAccessKey_normal(t *testing.T) {
+func TestAccAWSAccessKey_basic(t *testing.T) {
 	var conf iam.AccessKeyMetadata
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_iam_group.go b/builtin/providers/aws/resource_aws_iam_group.go
index 98a5354fe..6909ee259 100644
--- a/builtin/providers/aws/resource_aws_iam_group.go
+++ b/builtin/providers/aws/resource_aws_iam_group.go
@@ -3,9 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_iam_group_membership.go b/builtin/providers/aws/resource_aws_iam_group_membership.go
new file mode 100644
index 000000000..c90511cd6
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_group_membership.go
@@ -0,0 +1,156 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamGroupMembership() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIamGroupMembershipCreate,
+		Read:   resourceAwsIamGroupMembershipRead,
+		Update: resourceAwsIamGroupMembershipUpdate,
+		Delete: resourceAwsIamGroupMembershipDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"users": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+
+			"group": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIamGroupMembershipCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	group := d.Get("group").(string)
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
+
+	if err := addUsersToGroup(conn, userList, group); err != nil {
+		return err
+	}
+
+	d.SetId(d.Get("name").(string))
+	return resourceAwsIamGroupMembershipRead(d, meta)
+}
+
+func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	group := d.Get("group").(string)
+	resp, err := conn.GetGroup(&iam.GetGroupInput{
+		GroupName: aws.String(group),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			// aws specific error
+			if awsErr.Code() == "NoSuchEntity" {
+				// group not found
+				d.SetId("")
+				return nil
+			}
+		}
+		return err
+	}
+
+	ul := make([]string, 0, len(resp.Users))
+	for _, u := range resp.Users {
+		ul = append(ul, *u.UserName)
+	}
+
+	if err := d.Set("users", ul); err != nil {
+		return fmt.Errorf("[WARN] Error setting user list from IAM Group Membership (%s), error: %s", group, err)
+	}
+
+	return nil
+}
+
+func resourceAwsIamGroupMembershipUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	if d.HasChange("users") {
+		group := d.Get("group").(string)
+
+		o, n := d.GetChange("users")
+		if o == nil {
+			o = new(schema.Set)
+		}
+		if n == nil {
+			n = new(schema.Set)
+		}
+
+		os := o.(*schema.Set)
+		ns := n.(*schema.Set)
+		remove := expandStringList(os.Difference(ns).List())
+		add := expandStringList(ns.Difference(os).List())
+
+		if err := removeUsersFromGroup(conn, remove, group); err != nil {
+			return err
+		}
+
+		if err := addUsersToGroup(conn, add, group); err != nil {
+			return err
+		}
+	}
+
+	return resourceAwsIamGroupMembershipRead(d, meta)
+}
+
+func resourceAwsIamGroupMembershipDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
+	group := d.Get("group").(string)
+
+	if err := removeUsersFromGroup(conn, userList, group); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func removeUsersFromGroup(conn *iam.IAM, users []*string, group string) error {
+	for _, u := range users {
+		_, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func addUsersToGroup(conn *iam.IAM, users []*string, group string) error {
+	for _, u := range users {
+		_, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_iam_group_membership_test.go b/builtin/providers/aws/resource_aws_iam_group_membership_test.go
new file mode 100644
index 000000000..fc868cb7c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_group_membership_test.go
@@ -0,0 +1,169 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSGroupMembership_basic(t *testing.T) {
+	var group iam.GetGroupOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSGroupMembershipDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSGroupMemberConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSGroupMembershipExists("aws_iam_group_membership.team", &group),
+					testAccCheckAWSGroupMembershipAttributes(&group, []string{"test-user"}),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSGroupMemberConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSGroupMembershipExists("aws_iam_group_membership.team", &group),
+					testAccCheckAWSGroupMembershipAttributes(&group, []string{"test-user-two", "test-user-three"}),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iamconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iam_group_membership" {
+			continue
+		}
+
+		group := rs.Primary.Attributes["group"]
+
+		resp, err := conn.GetGroup(&iam.GetGroupInput{
+			GroupName: aws.String(group),
+		})
+		if err != nil {
+			// might error here
+			return err
+		}
+
+		users := []string{"test-user", "test-user-two", "test-user-three"}
+		for _, u := range resp.Users {
+			for _, i := range users {
+				if i == *u.UserName {
+					return fmt.Errorf("Error: User (%s) still a member of Group (%s)", i, *resp.Group.GroupName)
+				}
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func testAccCheckAWSGroupMembershipExists(n string, g *iam.GetGroupOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No User name is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		gn := rs.Primary.Attributes["group"]
+
+		resp, err := conn.GetGroup(&iam.GetGroupInput{
+			GroupName: aws.String(gn),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error: Group (%s) not found", gn)
+		}
+
+		*g = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckAWSGroupMembershipAttributes(group *iam.GetGroupOutput, users []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if *group.Group.GroupName != "test-group" {
+			return fmt.Errorf("Bad group membership: expected %s, got %s", "test-group", *group.Group.GroupName)
+		}
+
+		uc := len(users)
+		for _, u := range users {
+			for _, gu := range group.Users {
+				if u == *gu.UserName {
+					uc--
+				}
+			}
+		}
+
+		if uc > 0 {
+			return fmt.Errorf("Bad group membership count, expected (%d), but only (%d) found", len(users), uc)
+		}
+		return nil
+	}
+}
+
+const testAccAWSGroupMemberConfig = `
+resource "aws_iam_group" "group" {
+	name = "test-group"
+	path = "/"
+}
+
+resource "aws_iam_user" "user" {
+	name = "test-user"
+	path = "/"
+}
+
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = ["${aws_iam_user.user.name}"]
+	group = "${aws_iam_group.group.name}"
+}
+`
+
+const testAccAWSGroupMemberConfigUpdate = `
+resource "aws_iam_group" "group" {
+	name = "test-group"
+	path = "/"
+}
+
+resource "aws_iam_user" "user" {
+	name = "test-user"
+	path = "/"
+}
+
+resource "aws_iam_user" "user_two" {
+	name = "test-user-two"
+	path = "/"
+}
+
+resource "aws_iam_user" "user_three" {
+	name = "test-user-three"
+	path = "/"
+}
+
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = [
+		"${aws_iam_user.user_two.name}",
+		"${aws_iam_user.user_three.name}",
+	]
+	group = "${aws_iam_group.group.name}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_group_policy.go b/builtin/providers/aws/resource_aws_iam_group_policy.go
index cf34faaa1..2c16fe1c6 100644
--- a/builtin/providers/aws/resource_aws_iam_group_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_group_policy.go
@@ -5,9 +5,9 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_iam_group_policy_test.go b/builtin/providers/aws/resource_aws_iam_group_policy_test.go
index 1778d5216..ac7a3baaa 100644
--- a/builtin/providers/aws/resource_aws_iam_group_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_group_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMGroupPolicy(t *testing.T) {
+func TestAccAWSIAMGroupPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_group_test.go b/builtin/providers/aws/resource_aws_iam_group_test.go
index 4200cdbe0..67a72733a 100644
--- a/builtin/providers/aws/resource_aws_iam_group_test.go
+++ b/builtin/providers/aws/resource_aws_iam_group_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMGroup_normal(t *testing.T) {
+func TestAccAWSIAMGroup_basic(t *testing.T) {
 	var conf iam.GetGroupOutput
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_iam_instance_profile.go b/builtin/providers/aws/resource_aws_iam_instance_profile.go
index 4d3e10ae6..04e9c6dcc 100644
--- a/builtin/providers/aws/resource_aws_iam_instance_profile.go
+++ b/builtin/providers/aws/resource_aws_iam_instance_profile.go
@@ -2,10 +2,11 @@ package aws
 
 import (
 	"fmt"
+	"regexp"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -34,6 +35,19 @@ func resourceAwsIamInstanceProfile() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8196-L8201
+					value := v.(string)
+					if len(value) > 128 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 128 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"path": &schema.Schema{
 				Type:     schema.TypeString,
diff --git a/builtin/providers/aws/resource_aws_iam_instance_profile_test.go b/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
index ae1d66c90..985729aad 100644
--- a/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
+++ b/builtin/providers/aws/resource_aws_iam_instance_profile_test.go
@@ -6,7 +6,7 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 )
 
-func TestAccAWSIAMInstanceProfile(t *testing.T) {
+func TestAccAWSIAMInstanceProfile_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:  func() { testAccPreCheck(t) },
 		Providers: testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_policy.go b/builtin/providers/aws/resource_aws_iam_policy.go
index c0a435fdb..9ace92b21 100644
--- a/builtin/providers/aws/resource_aws_iam_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_policy.go
@@ -3,9 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -59,7 +59,7 @@ func resourceAwsIamPolicyCreate(d *schema.ResourceData, meta interface{}) error
 
 	response, err := iamconn.CreatePolicy(request)
 	if err != nil {
-		return fmt.Errorf("Error creating IAM policy %s: %#v", name, err)
+		return fmt.Errorf("Error creating IAM policy %s: %s", name, err)
 	}
 
 	return readIamPolicy(d, response.Policy)
@@ -78,7 +78,7 @@ func resourceAwsIamPolicyRead(d *schema.ResourceData, meta interface{}) error {
 			d.SetId("")
 			return nil
 		}
-		return fmt.Errorf("Error reading IAM policy %s: %#v", d.Id(), err)
+		return fmt.Errorf("Error reading IAM policy %s: %s", d.Id(), err)
 	}
 
 	return readIamPolicy(d, response.Policy)
@@ -101,7 +101,7 @@ func resourceAwsIamPolicyUpdate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	if _, err := iamconn.CreatePolicyVersion(request); err != nil {
-		return fmt.Errorf("Error updating IAM policy %s: %#v", d.Id(), err)
+		return fmt.Errorf("Error updating IAM policy %s: %s", d.Id(), err)
 	}
 	return nil
 }
@@ -187,7 +187,7 @@ func iamPolicyDeleteVersion(arn, versionID string, iamconn *iam.IAM) error {
 
 	_, err := iamconn.DeletePolicyVersion(request)
 	if err != nil {
-		return fmt.Errorf("Error deleting version %s from IAM policy %s: %#v", versionID, arn, err)
+		return fmt.Errorf("Error deleting version %s from IAM policy %s: %s", versionID, arn, err)
 	}
 	return nil
 }
@@ -199,7 +199,7 @@ func iamPolicyListVersions(arn string, iamconn *iam.IAM) ([]*iam.PolicyVersion,
 
 	response, err := iamconn.ListPolicyVersions(request)
 	if err != nil {
-		return nil, fmt.Errorf("Error listing versions for IAM policy %s: %#v", arn, err)
+		return nil, fmt.Errorf("Error listing versions for IAM policy %s: %s", arn, err)
 	}
 	return response.Versions, nil
 }
diff --git a/builtin/providers/aws/resource_aws_iam_policy_attachment.go b/builtin/providers/aws/resource_aws_iam_policy_attachment.go
new file mode 100644
index 000000000..a9028c57c
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_policy_attachment.go
@@ -0,0 +1,328 @@
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamPolicyAttachment() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIamPolicyAttachmentCreate,
+		Read:   resourceAwsIamPolicyAttachmentRead,
+		Update: resourceAwsIamPolicyAttachmentUpdate,
+		Delete: resourceAwsIamPolicyAttachmentDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"users": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"roles": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"groups": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+			"policy_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIamPolicyAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	name := d.Get("name").(string)
+	arn := d.Get("policy_arn").(string)
+	users := expandStringList(d.Get("users").(*schema.Set).List())
+	roles := expandStringList(d.Get("roles").(*schema.Set).List())
+	groups := expandStringList(d.Get("groups").(*schema.Set).List())
+
+	if len(users) > 0 && len(roles) > 0 && len(groups) > 0 {
+		return fmt.Errorf("[WARN] No Users, Roles, or Groups specified for IAM Policy Attachment %s", name)
+	} else {
+		var userErr, roleErr, groupErr error
+		if users != nil {
+			userErr = attachPolicyToUsers(conn, users, arn)
+		}
+		if roles != nil {
+			roleErr = attachPolicyToRoles(conn, roles, arn)
+		}
+		if groups != nil {
+			groupErr = attachPolicyToGroups(conn, groups, arn)
+		}
+		if userErr != nil || roleErr != nil || groupErr != nil {
+			return composeErrors(fmt.Sprint("[WARN] Error attaching policy with IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+		}
+	}
+	d.SetId(d.Get("name").(string))
+	return resourceAwsIamPolicyAttachmentRead(d, meta)
+}
+
+func resourceAwsIamPolicyAttachmentRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	arn := d.Get("policy_arn").(string)
+	name := d.Get("name").(string)
+
+	_, err := conn.GetPolicy(&iam.GetPolicyInput{
+		PolicyARN: aws.String(arn),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			if awsErr.Code() == "NoSuchIdentity" {
+				d.SetId("")
+				return nil
+			}
+		}
+		return err
+	}
+
+	policyEntities, err := conn.ListEntitiesForPolicy(&iam.ListEntitiesForPolicyInput{
+		PolicyARN: aws.String(arn),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	ul := make([]string, 0, len(policyEntities.PolicyUsers))
+	rl := make([]string, 0, len(policyEntities.PolicyRoles))
+	gl := make([]string, 0, len(policyEntities.PolicyGroups))
+
+	for _, u := range policyEntities.PolicyUsers {
+		ul = append(ul, *u.UserName)
+	}
+
+	for _, r := range policyEntities.PolicyRoles {
+		rl = append(rl, *r.RoleName)
+	}
+
+	for _, g := range policyEntities.PolicyGroups {
+		gl = append(gl, *g.GroupName)
+	}
+
+	userErr := d.Set("users", ul)
+	roleErr := d.Set("roles", rl)
+	groupErr := d.Set("groups", gl)
+
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN} Error setting user, role, or group list from IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+	}
+
+	return nil
+}
+func resourceAwsIamPolicyAttachmentUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	name := d.Get("name").(string)
+	var userErr, roleErr, groupErr error
+
+	if d.HasChange("users") {
+		userErr = updateUsers(conn, d, meta)
+	}
+	if d.HasChange("roles") {
+		roleErr = updateRoles(conn, d, meta)
+	}
+	if d.HasChange("groups") {
+		groupErr = updateGroups(conn, d, meta)
+	}
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN] Error updating user, role, or group list from IAM Policy Attachment ", name, ":"), userErr, roleErr, groupErr)
+	}
+	return resourceAwsIamPolicyAttachmentRead(d, meta)
+}
+
+func resourceAwsIamPolicyAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	name := d.Get("name").(string)
+	arn := d.Get("policy_arn").(string)
+	users := expandStringList(d.Get("users").(*schema.Set).List())
+	roles := expandStringList(d.Get("roles").(*schema.Set).List())
+	groups := expandStringList(d.Get("groups").(*schema.Set).List())
+
+	var userErr, roleErr, groupErr error
+	if len(users) != 0 {
+		userErr = detachPolicyFromUsers(conn, users, arn)
+	}
+	if len(roles) != 0 {
+		roleErr = detachPolicyFromRoles(conn, roles, arn)
+	}
+	if len(groups) != 0 {
+		groupErr = detachPolicyFromGroups(conn, groups, arn)
+	}
+	if userErr != nil || roleErr != nil || groupErr != nil {
+		return composeErrors(fmt.Sprint("[WARN] Error removing user, role, or group list from IAM Policy Detach ", name, ":"), userErr, roleErr, groupErr)
+	}
+	return nil
+}
+
+func composeErrors(desc string, uErr error, rErr error, gErr error) error {
+	errMsg := fmt.Sprintf(desc)
+	errs := []error{uErr, rErr, gErr}
+	for _, e := range errs {
+		if e != nil {
+			errMsg = errMsg + "\n– " + e.Error()
+		}
+	}
+	return fmt.Errorf(errMsg)
+}
+
+func attachPolicyToUsers(conn *iam.IAM, users []*string, arn string) error {
+	for _, u := range users {
+		_, err := conn.AttachUserPolicy(&iam.AttachUserPolicyInput{
+			UserName:  u,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func attachPolicyToRoles(conn *iam.IAM, roles []*string, arn string) error {
+	for _, r := range roles {
+		_, err := conn.AttachRolePolicy(&iam.AttachRolePolicyInput{
+			RoleName:  r,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func attachPolicyToGroups(conn *iam.IAM, groups []*string, arn string) error {
+	for _, g := range groups {
+		_, err := conn.AttachGroupPolicy(&iam.AttachGroupPolicyInput{
+			GroupName: g,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func updateUsers(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("users")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromUsers(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToUsers(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+}
+func updateRoles(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("roles")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromRoles(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToRoles(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+}
+func updateGroups(conn *iam.IAM, d *schema.ResourceData, meta interface{}) error {
+	arn := d.Get("policy_arn").(string)
+	o, n := d.GetChange("groups")
+	if o == nil {
+		o = new(schema.Set)
+	}
+	if n == nil {
+		n = new(schema.Set)
+	}
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	remove := expandStringList(os.Difference(ns).List())
+	add := expandStringList(ns.Difference(os).List())
+
+	if rErr := detachPolicyFromGroups(conn, remove, arn); rErr != nil {
+		return rErr
+	}
+	if aErr := attachPolicyToGroups(conn, add, arn); aErr != nil {
+		return aErr
+	}
+	return nil
+
+}
+func detachPolicyFromUsers(conn *iam.IAM, users []*string, arn string) error {
+	for _, u := range users {
+		_, err := conn.DetachUserPolicy(&iam.DetachUserPolicyInput{
+			UserName:  u,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func detachPolicyFromRoles(conn *iam.IAM, roles []*string, arn string) error {
+	for _, r := range roles {
+		_, err := conn.DetachRolePolicy(&iam.DetachRolePolicyInput{
+			RoleName:  r,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func detachPolicyFromGroups(conn *iam.IAM, groups []*string, arn string) error {
+	for _, g := range groups {
+		_, err := conn.DetachGroupPolicy(&iam.DetachGroupPolicyInput{
+			GroupName: g,
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go b/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go
new file mode 100644
index 000000000..3e6ef445d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_policy_attachment_test.go
@@ -0,0 +1,213 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"testing"
+)
+
+func TestAccAWSPolicyAttachment_basic(t *testing.T) {
+	var out iam.ListEntitiesForPolicyOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSPolicyAttachmentDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSPolicyAttachConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSPolicyAttachmentExists("aws_iam_policy_attachment.test-attachment", 3, &out),
+					testAccCheckAWSPolicyAttachmentAttributes([]string{"test-user"}, []string{"test-role"}, []string{"test-group"}, &out),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAWSPolicyAttachConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSPolicyAttachmentExists("aws_iam_policy_attachment.test-attachment", 6, &out),
+					testAccCheckAWSPolicyAttachmentAttributes([]string{"test-user3", "test-user3"}, []string{"test-role2", "test-role3"}, []string{"test-group2", "test-group3"}, &out),
+				),
+			},
+		},
+	})
+}
+func testAccCheckAWSPolicyAttachmentDestroy(s *terraform.State) error {
+
+	return nil
+}
+
+func testAccCheckAWSPolicyAttachmentExists(n string, c int64, out *iam.ListEntitiesForPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No policy name is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		arn := rs.Primary.Attributes["policy_arn"]
+
+		resp, err := conn.GetPolicy(&iam.GetPolicyInput{
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return fmt.Errorf("Error: Policy (%s) not found", n)
+		}
+		if c != *resp.Policy.AttachmentCount {
+			return fmt.Errorf("Error: Policy (%s) has wrong number of entities attached on initial creation", n)
+		}
+		resp2, err := conn.ListEntitiesForPolicy(&iam.ListEntitiesForPolicyInput{
+			PolicyARN: aws.String(arn),
+		})
+		if err != nil {
+			return fmt.Errorf("Error: Failed to get entities for Policy (%s)", arn)
+		}
+
+		*out = *resp2
+		return nil
+	}
+}
+func testAccCheckAWSPolicyAttachmentAttributes(users []string, roles []string, groups []string, out *iam.ListEntitiesForPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		uc := len(users)
+		rc := len(roles)
+		gc := len(groups)
+
+		for _, u := range users {
+			for _, pu := range out.PolicyUsers {
+				if u == *pu.UserName {
+					uc--
+				}
+			}
+		}
+		for _, r := range roles {
+			for _, pr := range out.PolicyRoles {
+				if r == *pr.RoleName {
+					rc--
+				}
+			}
+		}
+		for _, g := range users {
+			for _, pg := range out.PolicyGroups {
+				if g == *pg.GroupName {
+					gc--
+				}
+			}
+		}
+		if uc != 0 || rc != 0 || gc != 0 {
+			return fmt.Errorf("Error: Number of attached users, roles, or groups was incorrect:\n expected %d users and found %d\nexpected %d roles and found %d\nexpected %d groups and found %d", len(users), (len(users) - uc), len(roles), (len(roles) - rc), len(groups), (len(groups) - gc))
+		}
+		return nil
+	}
+}
+
+const testAccAWSPolicyAttachConfig = `
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:ChangePassword"
+      ],
+      "Resource": "*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = ["${aws_iam_user.user.name}"]
+    roles = ["${aws_iam_role.role.name}"]
+    groups = ["${aws_iam_group.group.name}"]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+`
+
+const testAccAWSPolicyAttachConfigUpdate = `
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_user" "user2" {
+    name = "test-user2"
+}
+resource "aws_iam_user" "user3" {
+    name = "test-user3"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_role" "role2" {
+    name = "test-role2"
+}
+resource "aws_iam_role" "role3" {
+    name = "test-role3"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+resource "aws_iam_group" "group2" {
+    name = "test-group2"
+}
+resource "aws_iam_group" "group3" {
+    name = "test-group3"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:ChangePassword"
+      ],
+      "Resource": "*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = [
+        "${aws_iam_user.user2.name}",
+        "${aws_iam_user.user3.name}"
+    ]
+    roles = [
+        "${aws_iam_role.role2.name}",
+        "${aws_iam_role.role3.name}"
+    ]
+    groups = [
+        "${aws_iam_group.group2.name}",
+        "${aws_iam_group.group3.name}"
+    ]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_iam_role.go b/builtin/providers/aws/resource_aws_iam_role.go
index f8ec7b358..d8cd00cdc 100644
--- a/builtin/providers/aws/resource_aws_iam_role.go
+++ b/builtin/providers/aws/resource_aws_iam_role.go
@@ -2,10 +2,11 @@ package aws
 
 import (
 	"fmt"
+	"regexp"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -31,6 +32,19 @@ func resourceAwsIamRole() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8329-L8334
+					value := v.(string)
+					if len(value) > 64 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 64 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]*$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"path": &schema.Schema{
 				Type:     schema.TypeString,
@@ -102,6 +116,27 @@ func resourceAwsIamRoleReadResult(d *schema.ResourceData, role *iam.Role) error
 func resourceAwsIamRoleDelete(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
+	// Roles cannot be destroyed when attached to an existing Instance Profile
+	resp, err := iamconn.ListInstanceProfilesForRole(&iam.ListInstanceProfilesForRoleInput{
+		RoleName: aws.String(d.Id()),
+	})
+	if err != nil {
+		return fmt.Errorf("Error listing Profiles for IAM Role (%s) when trying to delete: %s", d.Id(), err)
+	}
+
+	// Loop and remove this Role from any Profiles
+	if len(resp.InstanceProfiles) > 0 {
+		for _, i := range resp.InstanceProfiles {
+			_, err := iamconn.RemoveRoleFromInstanceProfile(&iam.RemoveRoleFromInstanceProfileInput{
+				InstanceProfileName: i.InstanceProfileName,
+				RoleName:            aws.String(d.Id()),
+			})
+			if err != nil {
+				return fmt.Errorf("Error deleting IAM Role %s: %s", d.Id(), err)
+			}
+		}
+	}
+
 	request := &iam.DeleteRoleInput{
 		RoleName: aws.String(d.Id()),
 	}
diff --git a/builtin/providers/aws/resource_aws_iam_role_policy.go b/builtin/providers/aws/resource_aws_iam_role_policy.go
index d3f7dbae3..1424bb621 100644
--- a/builtin/providers/aws/resource_aws_iam_role_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_role_policy.go
@@ -3,11 +3,12 @@ package aws
 import (
 	"fmt"
 	"net/url"
+	"regexp"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -30,6 +31,19 @@ func resourceAwsIamRolePolicy() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/2485f5c/botocore/data/iam/2010-05-08/service-2.json#L8291-L8296
+					value := v.(string)
+					if len(value) > 128 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 128 characters", k))
+					}
+					if !regexp.MustCompile("^[\\w+=,.@-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must match [\\w+=,.@-]", k))
+					}
+					return
+				},
 			},
 			"role": &schema.Schema{
 				Type:     schema.TypeString,
diff --git a/builtin/providers/aws/resource_aws_iam_role_policy_test.go b/builtin/providers/aws/resource_aws_iam_role_policy_test.go
index a43fe94c8..219c676eb 100644
--- a/builtin/providers/aws/resource_aws_iam_role_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_role_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMRolePolicy(t *testing.T) {
+func TestAccAWSIAMRolePolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_role_test.go b/builtin/providers/aws/resource_aws_iam_role_test.go
index cbb75c3c4..e61d49b2a 100644
--- a/builtin/providers/aws/resource_aws_iam_role_test.go
+++ b/builtin/providers/aws/resource_aws_iam_role_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRole_normal(t *testing.T) {
+func TestAccAWSRole_basic(t *testing.T) {
 	var conf iam.GetRoleOutput
 
 	resource.Test(t, resource.TestCase{
@@ -30,6 +30,31 @@ func TestAccAWSRole_normal(t *testing.T) {
 	})
 }
 
+func TestAccAWSRole_testNameChange(t *testing.T) {
+	var conf iam.GetRoleOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSRoleDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSRolePre,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSRoleExists("aws_iam_role.role_update_test", &conf),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAWSRolePost,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSRoleExists("aws_iam_role.role_update_test", &conf),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSRoleDestroy(s *terraform.State) error {
 	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -105,3 +130,101 @@ resource "aws_iam_role" "role" {
 	assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"ec2.amazonaws.com\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
 }
 `
+
+const testAccAWSRolePre = `
+resource "aws_iam_role" "role_update_test" {
+  name = "tf_old_name"
+  path = "/test/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "role_update_test" {
+  name = "role_update_test"
+  role = "${aws_iam_role.role_update_test.id}"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListAllMyBuckets"
+      ],
+      "Resource": "arn:aws:s3:::*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "role_update_test" {
+  name = "role_update_test"
+  path = "/test/"
+  roles = ["${aws_iam_role.role_update_test.name}"]
+}
+
+`
+
+const testAccAWSRolePost = `
+resource "aws_iam_role" "role_update_test" {
+  name = "tf_new_name"
+  path = "/test/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "role_update_test" {
+  name = "role_update_test"
+  role = "${aws_iam_role.role_update_test.id}"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListAllMyBuckets"
+      ],
+      "Resource": "arn:aws:s3:::*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "role_update_test" {
+  name = "role_update_test"
+  path = "/test/"
+  roles = ["${aws_iam_role.role_update_test.name}"]
+}
+
+`
diff --git a/builtin/providers/aws/resource_aws_iam_server_certificate.go b/builtin/providers/aws/resource_aws_iam_server_certificate.go
new file mode 100644
index 000000000..ac1496133
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_server_certificate.go
@@ -0,0 +1,148 @@
+package aws
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIAMServerCertificate() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIAMServerCertificateCreate,
+		Read:   resourceAwsIAMServerCertificateRead,
+		Delete: resourceAwsIAMServerCertificateDelete,
+
+		Schema: map[string]*schema.Schema{
+			"certificate_body": &schema.Schema{
+				Type:      schema.TypeString,
+				Required:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"certificate_chain": &schema.Schema{
+				Type:      schema.TypeString,
+				Optional:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"path": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"private_key": &schema.Schema{
+				Type:      schema.TypeString,
+				Required:  true,
+				ForceNew:  true,
+				StateFunc: normalizeCert,
+			},
+
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIAMServerCertificateCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+
+	createOpts := &iam.UploadServerCertificateInput{
+		CertificateBody:       aws.String(d.Get("certificate_body").(string)),
+		PrivateKey:            aws.String(d.Get("private_key").(string)),
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	}
+
+	if v, ok := d.GetOk("certificate_chain"); ok {
+		createOpts.CertificateChain = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("Path"); ok {
+		createOpts.Path = aws.String(v.(string))
+	}
+
+	resp, err := conn.UploadServerCertificate(createOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error uploading server certificate, error: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return fmt.Errorf("[WARN] Error uploading server certificate, error: %s", err)
+	}
+
+	d.SetId(*resp.ServerCertificateMetadata.ServerCertificateID)
+
+	return resourceAwsIAMServerCertificateRead(d, meta)
+}
+
+func resourceAwsIAMServerCertificateRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	resp, err := conn.GetServerCertificate(&iam.GetServerCertificateInput{
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error reading IAM Server Certificate: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return fmt.Errorf("[WARN] Error reading IAM Server Certificate: %s", err)
+	}
+
+	// these values should always be present, and have a default if not set in
+	// configuration, and so safe to reference with nil checks
+	d.Set("certificate_body", normalizeCert(resp.ServerCertificate.CertificateBody))
+	d.Set("certificate_chain", normalizeCert(resp.ServerCertificate.CertificateChain))
+	d.Set("path", resp.ServerCertificate.ServerCertificateMetadata.Path)
+	d.Set("arn", resp.ServerCertificate.ServerCertificateMetadata.ARN)
+
+	return nil
+}
+
+func resourceAwsIAMServerCertificateDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iamconn
+	_, err := conn.DeleteServerCertificate(&iam.DeleteServerCertificateInput{
+		ServerCertificateName: aws.String(d.Get("name").(string)),
+	})
+
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error deleting server certificate: %s: %s", awsErr.Code(), awsErr.Message())
+		}
+		return err
+	}
+
+	d.SetId("")
+	return nil
+}
+
+func normalizeCert(cert interface{}) string {
+	if cert == nil {
+		return ""
+	}
+	switch cert.(type) {
+	case string:
+		hash := sha1.Sum([]byte(strings.TrimSpace(cert.(string))))
+		return hex.EncodeToString(hash[:])
+	case *string:
+		hash := sha1.Sum([]byte(strings.TrimSpace(*cert.(*string))))
+		return hex.EncodeToString(hash[:])
+	default:
+		return ""
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_iam_server_certificate_test.go b/builtin/providers/aws/resource_aws_iam_server_certificate_test.go
new file mode 100644
index 000000000..3165416fc
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_iam_server_certificate_test.go
@@ -0,0 +1,191 @@
+package aws
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccIAMServerCertificate_basic(t *testing.T) {
+	var cert iam.ServerCertificate
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckIAMServerCertificateDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccIAMServerCertConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertExists("aws_iam_server_certificate.test_cert", &cert),
+					testAccCheckAWSServerCertAttributes(&cert),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCertExists(n string, cert *iam.ServerCertificate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Server Cert ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		describeOpts := &iam.GetServerCertificateInput{
+			ServerCertificateName: aws.String(rs.Primary.Attributes["name"]),
+		}
+		resp, err := conn.GetServerCertificate(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		*cert = *resp.ServerCertificate
+
+		return nil
+	}
+}
+
+func testAccCheckAWSServerCertAttributes(cert *iam.ServerCertificate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if !strings.HasPrefix(*cert.ServerCertificateMetadata.ServerCertificateName, "terraform-test-cert") {
+			return fmt.Errorf("Bad Server Cert Name: %s", *cert.ServerCertificateMetadata.ServerCertificateName)
+		}
+
+		if *cert.CertificateBody != strings.TrimSpace(certBody) {
+			return fmt.Errorf("Bad Server Cert body\n\t expected: %s\n\tgot: %s\n", certBody, *cert.CertificateBody)
+		}
+		return nil
+	}
+}
+
+func testAccCheckIAMServerCertificateDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iamconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iam_server_certificate" {
+			continue
+		}
+
+		// Try to find the Cert
+		opts := &iam.GetServerCertificateInput{
+			ServerCertificateName: aws.String(rs.Primary.Attributes["name"]),
+		}
+		resp, err := conn.GetServerCertificate(opts)
+		if err == nil {
+			if resp.ServerCertificate != nil {
+				return fmt.Errorf("Error: Server Cert still exists")
+			}
+
+			return nil
+		}
+
+	}
+
+	return nil
+}
+
+var certBody = fmt.Sprintf(`
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAfACAQEwDQYJKoZIhvcNAQELBQAwgY4xCzAJBgNVBAYTAlVTMREwDwYD
+VQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxFjAUBgNVBAoMDUJhcmVm
+b290IExhYnMxGDAWBgNVBAMMD0phc29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJ
+ARYYamFzb25AYmFyZWZvb3Rjb2RlcnMuY29tMB4XDTE1MDYyMTA1MzcwNVoXDTE2
+MDYyMDA1MzcwNVowgYgxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazEL
+MAkGA1UEBwwCTlkxFjAUBgNVBAoMDUJhcmVmb290IExhYnMxGDAWBgNVBAMMD0ph
+c29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJARYYamFzb25AYmFyZWZvb3Rjb2Rl
+cnMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2AVGKRIx+EFM0kkg7
+6GoJv9uy0biEDHB4phQBqnDIf8J8/gq9eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jD
+bI/yS+DOAjrh30vN79Au74jGN2Cw8fIak40iDUwjZaczK2Gkna54XIO9pqMcbQ6Q
+mLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCDGNvU
+eioQMVPNlmmxW3+Rwo0Kl+/HtUOmqUDKUDvJnelxulBr7O8w75N/Z7h7+aBJCUkt
+tz+DwATZswXtsal6TuzHHpAhpFql82jQZVE8OYkrX84XKRQpm8ZnbyZObMdXTJWk
+ArC/rGVIWsvhlbgGM8zu7a3zbeuAESZ8Bn4ZbJxnoaRK8p36/alvzAwkgzSf3oUX
+HtU4LrdunevBs6/CbKCWrxYcvNCy8EcmHitqCfQL5nxCCXpgf/Mw1vmIPTwbPSJq
+oUkh5yjGRKzhh7QbG1TlFX6zUp4vb+UJn5+g4edHrqivRSjIqYrC45ygVMOABn21
+hpMXOlZL+YXfR4Kp
+-----END CERTIFICATE-----`)
+
+var testAccIAMServerCertConfig = fmt.Sprintf(`
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "terraform-test-cert-%d"
+  certificate_body = <<EOF
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAfACAQEwDQYJKoZIhvcNAQELBQAwgY4xCzAJBgNVBAYTAlVTMREwDwYD
+VQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxFjAUBgNVBAoMDUJhcmVm
+b290IExhYnMxGDAWBgNVBAMMD0phc29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJ
+ARYYamFzb25AYmFyZWZvb3Rjb2RlcnMuY29tMB4XDTE1MDYyMTA1MzcwNVoXDTE2
+MDYyMDA1MzcwNVowgYgxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazEL
+MAkGA1UEBwwCTlkxFjAUBgNVBAoMDUJhcmVmb290IExhYnMxGDAWBgNVBAMMD0ph
+c29uIEJlcmxpbnNreTEnMCUGCSqGSIb3DQEJARYYamFzb25AYmFyZWZvb3Rjb2Rl
+cnMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2AVGKRIx+EFM0kkg7
+6GoJv9uy0biEDHB4phQBqnDIf8J8/gq9eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jD
+bI/yS+DOAjrh30vN79Au74jGN2Cw8fIak40iDUwjZaczK2Gkna54XIO9pqMcbQ6Q
+mLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCDGNvU
+eioQMVPNlmmxW3+Rwo0Kl+/HtUOmqUDKUDvJnelxulBr7O8w75N/Z7h7+aBJCUkt
+tz+DwATZswXtsal6TuzHHpAhpFql82jQZVE8OYkrX84XKRQpm8ZnbyZObMdXTJWk
+ArC/rGVIWsvhlbgGM8zu7a3zbeuAESZ8Bn4ZbJxnoaRK8p36/alvzAwkgzSf3oUX
+HtU4LrdunevBs6/CbKCWrxYcvNCy8EcmHitqCfQL5nxCCXpgf/Mw1vmIPTwbPSJq
+oUkh5yjGRKzhh7QbG1TlFX6zUp4vb+UJn5+g4edHrqivRSjIqYrC45ygVMOABn21
+hpMXOlZL+YXfR4Kp
+-----END CERTIFICATE-----
+EOF
+
+  certificate_chain = <<EOF
+-----BEGIN CERTIFICATE-----
+MIID8TCCAtmgAwIBAgIJAKX2xeCkfFcbMA0GCSqGSIb3DQEBCwUAMIGOMQswCQYD
+VQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxETAPBgNVBAcMCE5ldyBZb3JrMRYw
+FAYDVQQKDA1CYXJlZm9vdCBMYWJzMRgwFgYDVQQDDA9KYXNvbiBCZXJsaW5za3kx
+JzAlBgkqhkiG9w0BCQEWGGphc29uQGJhcmVmb290Y29kZXJzLmNvbTAeFw0xNTA2
+MjEwNTM2MDZaFw0yNTA2MTgwNTM2MDZaMIGOMQswCQYDVQQGEwJVUzERMA8GA1UE
+CAwITmV3IFlvcmsxETAPBgNVBAcMCE5ldyBZb3JrMRYwFAYDVQQKDA1CYXJlZm9v
+dCBMYWJzMRgwFgYDVQQDDA9KYXNvbiBCZXJsaW5za3kxJzAlBgkqhkiG9w0BCQEW
+GGphc29uQGJhcmVmb290Y29kZXJzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMteFbwfLz7NyQn3eDxxw22l1ZPBrzfPON0HOAq8nHat4kT4A2cI
+45kCtxKMzCVoG84tXoX/rbjGkez7lz9lEfvEuSh+I+UqinFA/sefhcE63foVMZu1
+2t6O3+utdxBvOYJwAQaiGW44x0h6fTyqDv6Gc5Ml0uoIVeMWPhT1MREoOcPDz1gb
+Ep3VT2aqFULLJedP37qbzS4D04rn1tS7pcm3wYivRyjVNEvs91NsWEvvE1WtS2Cl
+2RBt+ihXwq4UNB9UPYG75+FuRcQQvfqameyweyKT9qBmJLELMtYa/KTCYvSch4JY
+YVPAPOlhFlO4BcTto/gpBes2WEAWZtE/jnECAwEAAaNQME4wHQYDVR0OBBYEFOna
+aiYnm5583EY7FT/mXwTBuLZgMB8GA1UdIwQYMBaAFOnaaiYnm5583EY7FT/mXwTB
+uLZgMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBABp/dKQ489CCzzB1
+IX78p6RFAdda4e3lL6uVjeS3itzFIIiKvdf1/txhmsEeCEYz0El6aMnXLkpk7jAr
+kCwlAOOz2R2hlA8k8opKTYX4IQQau8DATslUFAFOvRGOim/TD/Yuch+a/VF2VQKz
+L2lUVi5Hjp9KvWe2HQYPjnJaZs/OKAmZQ4uP547dqFrTz6sWfisF1rJ60JH70cyM
+qjZQp/xYHTZIB8TCPvLgtVIGFmd/VAHVBFW2p9IBwtSxBIsEPwYQOV3XbwhhmGIv
+DWx5TpnEzH7ZM33RNbAKcdwOBxdRY+SI/ua5hYCm4QngAqY69lEuk4zXZpdDLPq1
+qxxQx0E=
+-----END CERTIFICATE-----
+EOF
+
+	private_key =  <<EOF
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQD2AVGKRIx+EFM0kkg76GoJv9uy0biEDHB4phQBqnDIf8J8/gq9
+eVvQrR5jJC9Uz4zp5wG/oLZlGuF92/jDbI/yS+DOAjrh30vN79Au74jGN2Cw8fIa
+k40iDUwjZaczK2Gkna54XIO9pqMcbQ6QmLUkQXsqlJ7Q4X2kL3b9iMsXcQIDAQAB
+AoGALmVBQ5p6BKx/hMKx7NqAZSZSAP+clQrji12HGGlUq/usanZfAC0LK+f6eygv
+5QbfxJ1UrxdYTukq7dm2qOSooOMUuukWInqC6ztjdLwH70CKnl0bkNB3/NkW2VNc
+32YiUuZCM9zaeBuEUclKNs+dhD2EeGdJF8KGntWGOTU/M4ECQQD9gdYb38PvaMdu
+opM3sKJF5n9pMoLDleBpCGqq3nD3DFn0V6PHQAwn30EhRN+7BbUEpde5PmfoIdAR
+uDlj/XPlAkEA+GyY1e4uU9rz+1K4ubxmtXTp9ZIR2LsqFy5L/MS5hqX2zq5GGq8g
+jZYDxnxPEUrxaWQH4nh0qdu3skUBi4a0nQJBAKJaqLkpUd7eB/t++zHLWeHSgP7q
+bny8XABod4f+9fICYwntpuJQzngqrxeTeIXaXdggLkxg/0LXhN4UUg0LoVECQQDE
+Pi1h2dyY+37/CzLH7q+IKopjJneYqQmv9C+sxs70MgjM7liM3ckub9IdqrdfJr+c
+DJw56APo5puvZNm6mbf1AkBVMDyfdOOyoHpJjrhmZWo6QqynujfwErrBYQ0sZQ3l
+O57Z0RUNQ8DRyymhLd2t5nAHTfpcFA1sBeKE6CziLbZB
+-----END RSA PRIVATE KEY-----
+EOF
+}
+`, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
diff --git a/builtin/providers/aws/resource_aws_iam_user.go b/builtin/providers/aws/resource_aws_iam_user.go
index 3fffd2665..100197c5f 100644
--- a/builtin/providers/aws/resource_aws_iam_user.go
+++ b/builtin/providers/aws/resource_aws_iam_user.go
@@ -3,9 +3,9 @@ package aws
 import (
 	"fmt"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_iam_user_policy.go b/builtin/providers/aws/resource_aws_iam_user_policy.go
index 80cb044ff..24d107867 100644
--- a/builtin/providers/aws/resource_aws_iam_user_policy.go
+++ b/builtin/providers/aws/resource_aws_iam_user_policy.go
@@ -5,9 +5,9 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_iam_user_policy_test.go b/builtin/providers/aws/resource_aws_iam_user_policy_test.go
index 2a2147e56..f5c520180 100644
--- a/builtin/providers/aws/resource_aws_iam_user_policy_test.go
+++ b/builtin/providers/aws/resource_aws_iam_user_policy_test.go
@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSIAMUserPolicy(t *testing.T) {
+func TestAccAWSIAMUserPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_iam_user_test.go b/builtin/providers/aws/resource_aws_iam_user_test.go
index 7db0ae670..0dd2530a1 100644
--- a/builtin/providers/aws/resource_aws_iam_user_test.go
+++ b/builtin/providers/aws/resource_aws_iam_user_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSUser_normal(t *testing.T) {
+func TestAccAWSUser_basic(t *testing.T) {
 	var conf iam.GetUserOutput
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_instance.go b/builtin/providers/aws/resource_aws_instance.go
index 6c41520c2..9a4306acb 100644
--- a/builtin/providers/aws/resource_aws_instance.go
+++ b/builtin/providers/aws/resource_aws_instance.go
@@ -10,9 +10,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -37,8 +38,8 @@ func resourceAwsInstance() *schema.Resource {
 
 			"associate_public_ip_address": &schema.Schema{
 				Type:     schema.TypeBool,
-				Optional: true,
 				ForceNew: true,
+				Optional: true,
 			},
 
 			"availability_zone": &schema.Schema{
@@ -85,6 +86,7 @@ func resourceAwsInstance() *schema.Resource {
 			"source_dest_check": &schema.Schema{
 				Type:     schema.TypeBool,
 				Optional: true,
+				Default:  true,
 			},
 
 			"user_data": &schema.Schema{
@@ -146,6 +148,11 @@ func resourceAwsInstance() *schema.Resource {
 				Optional: true,
 			},
 
+			"monitoring": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+
 			"iam_instance_profile": &schema.Schema{
 				Type:     schema.TypeString,
 				ForceNew: true,
@@ -312,211 +319,34 @@ func resourceAwsInstance() *schema.Resource {
 func resourceAwsInstanceCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
-	// Figure out user data
-	userData := ""
-	if v := d.Get("user_data"); v != nil {
-		userData = base64.StdEncoding.EncodeToString([]byte(v.(string)))
-	}
-
-	// check for non-default Subnet, and cast it to a String
-	var hasSubnet bool
-	subnet, hasSubnet := d.GetOk("subnet_id")
-	subnetID := subnet.(string)
-
-	placement := &ec2.Placement{
-		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
-		GroupName:        aws.String(d.Get("placement_group").(string)),
-	}
-
-	if hasSubnet {
-		// Tenancy is only valid inside a VPC
-		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Placement.html
-		if v := d.Get("tenancy").(string); v != "" {
-			placement.Tenancy = aws.String(v)
-		}
-	}
-
-	iam := &ec2.IAMInstanceProfileSpecification{
-		Name: aws.String(d.Get("iam_instance_profile").(string)),
+	instanceOpts, err := buildAwsInstanceOpts(d, meta)
+	if err != nil {
+		return err
 	}
 
 	// Build the creation struct
 	runOpts := &ec2.RunInstancesInput{
-		ImageID:               aws.String(d.Get("ami").(string)),
-		Placement:             placement,
-		InstanceType:          aws.String(d.Get("instance_type").(string)),
+		BlockDeviceMappings:   instanceOpts.BlockDeviceMappings,
+		DisableAPITermination: instanceOpts.DisableAPITermination,
+		EBSOptimized:          instanceOpts.EBSOptimized,
+		Monitoring:            instanceOpts.Monitoring,
+		IAMInstanceProfile:    instanceOpts.IAMInstanceProfile,
+		ImageID:               instanceOpts.ImageID,
+		InstanceType:          instanceOpts.InstanceType,
+		KeyName:               instanceOpts.KeyName,
 		MaxCount:              aws.Long(int64(1)),
 		MinCount:              aws.Long(int64(1)),
-		UserData:              aws.String(userData),
-		EBSOptimized:          aws.Boolean(d.Get("ebs_optimized").(bool)),
-		DisableAPITermination: aws.Boolean(d.Get("disable_api_termination").(bool)),
-		IAMInstanceProfile:    iam,
-	}
-
-	associatePublicIPAddress := false
-	if v := d.Get("associate_public_ip_address"); v != nil {
-		associatePublicIPAddress = v.(bool)
-	}
-
-	var groups []*string
-	if v := d.Get("security_groups"); v != nil {
-		// Security group names.
-		// For a nondefault VPC, you must use security group IDs instead.
-		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
-		sgs := v.(*schema.Set).List()
-		if len(sgs) > 0 && hasSubnet {
-			log.Printf("[WARN] Deprecated. Attempting to use 'security_groups' within a VPC instance. Use 'vpc_security_group_ids' instead.")
-		}
-		for _, v := range sgs {
-			str := v.(string)
-			groups = append(groups, aws.String(str))
-		}
-	}
-
-	if hasSubnet && associatePublicIPAddress {
-		// If we have a non-default VPC / Subnet specified, we can flag
-		// AssociatePublicIpAddress to get a Public IP assigned. By default these are not provided.
-		// You cannot specify both SubnetId and the NetworkInterface.0.* parameters though, otherwise
-		// you get: Network interfaces and an instance-level subnet ID may not be specified on the same request
-		// You also need to attach Security Groups to the NetworkInterface instead of the instance,
-		// to avoid: Network interfaces and an instance-level security groups may not be specified on
-		// the same request
-		ni := &ec2.InstanceNetworkInterfaceSpecification{
-			AssociatePublicIPAddress: aws.Boolean(associatePublicIPAddress),
-			DeviceIndex:              aws.Long(int64(0)),
-			SubnetID:                 aws.String(subnetID),
-			Groups:                   groups,
-		}
-
-		if v, ok := d.GetOk("private_ip"); ok {
-			ni.PrivateIPAddress = aws.String(v.(string))
-		}
-
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
-				ni.Groups = append(ni.Groups, aws.String(v.(string)))
-			}
-		}
-
-		runOpts.NetworkInterfaces = []*ec2.InstanceNetworkInterfaceSpecification{ni}
-	} else {
-		if subnetID != "" {
-			runOpts.SubnetID = aws.String(subnetID)
-		}
-
-		if v, ok := d.GetOk("private_ip"); ok {
-			runOpts.PrivateIPAddress = aws.String(v.(string))
-		}
-		if runOpts.SubnetID != nil &&
-			*runOpts.SubnetID != "" {
-			runOpts.SecurityGroupIDs = groups
-		} else {
-			runOpts.SecurityGroups = groups
-		}
-
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
-				runOpts.SecurityGroupIDs = append(runOpts.SecurityGroupIDs, aws.String(v.(string)))
-			}
-		}
-	}
-
-	if v, ok := d.GetOk("key_name"); ok {
-		runOpts.KeyName = aws.String(v.(string))
-	}
-
-	blockDevices := make([]*ec2.BlockDeviceMapping, 0)
-
-	if v, ok := d.GetOk("ebs_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			ebs := &ec2.EBSBlockDevice{
-				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
-				Encrypted:           aws.Boolean(bd["encrypted"].(bool)),
-			}
-
-			if v, ok := bd["snapshot_id"].(string); ok && v != "" {
-				ebs.SnapshotID = aws.String(v)
-			}
-
-			if v, ok := bd["volume_size"].(int); ok && v != 0 {
-				ebs.VolumeSize = aws.Long(int64(v))
-			}
-
-			if v, ok := bd["volume_type"].(string); ok && v != "" {
-				ebs.VolumeType = aws.String(v)
-			}
-
-			if v, ok := bd["iops"].(int); ok && v > 0 {
-				ebs.IOPS = aws.Long(int64(v))
-			}
-
-			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-				DeviceName: aws.String(bd["device_name"].(string)),
-				EBS:        ebs,
-			})
-		}
-	}
-
-	if v, ok := d.GetOk("ephemeral_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-				DeviceName:  aws.String(bd["device_name"].(string)),
-				VirtualName: aws.String(bd["virtual_name"].(string)),
-			})
-		}
-	}
-
-	if v, ok := d.GetOk("root_block_device"); ok {
-		vL := v.(*schema.Set).List()
-		if len(vL) > 1 {
-			return fmt.Errorf("Cannot specify more than one root_block_device.")
-		}
-		for _, v := range vL {
-			bd := v.(map[string]interface{})
-			ebs := &ec2.EBSBlockDevice{
-				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
-			}
-
-			if v, ok := bd["volume_size"].(int); ok && v != 0 {
-				ebs.VolumeSize = aws.Long(int64(v))
-			}
-
-			if v, ok := bd["volume_type"].(string); ok && v != "" {
-				ebs.VolumeType = aws.String(v)
-			}
-
-			if v, ok := bd["iops"].(int); ok && v > 0 {
-				ebs.IOPS = aws.Long(int64(v))
-			}
-
-			if dn, err := fetchRootDeviceName(d.Get("ami").(string), conn); err == nil {
-				if dn == nil {
-					return fmt.Errorf(
-						"Expected 1 AMI for ID: %s, got none",
-						d.Get("ami").(string))
-				}
-
-				blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
-					DeviceName: dn,
-					EBS:        ebs,
-				})
-			} else {
-				return err
-			}
-		}
-	}
-
-	if len(blockDevices) > 0 {
-		runOpts.BlockDeviceMappings = blockDevices
+		NetworkInterfaces:     instanceOpts.NetworkInterfaces,
+		Placement:             instanceOpts.Placement,
+		PrivateIPAddress:      instanceOpts.PrivateIPAddress,
+		SecurityGroupIDs:      instanceOpts.SecurityGroupIDs,
+		SecurityGroups:        instanceOpts.SecurityGroups,
+		SubnetID:              instanceOpts.SubnetID,
+		UserData:              instanceOpts.UserData64,
 	}
 
 	// Create the instance
-	log.Printf("[DEBUG] Run configuration: %#v", runOpts)
-	var err error
+	log.Printf("[DEBUG] Run configuration: %s", awsutil.StringValue(runOpts))
 
 	var runResp *ec2.Reservation
 	for i := 0; i < 5; i++ {
@@ -627,6 +457,8 @@ func resourceAwsInstanceRead(d *schema.ResourceData, meta interface{}) error {
 		d.Set("tenancy", instance.Placement.Tenancy)
 	}
 
+	d.Set("ami", instance.ImageID)
+	d.Set("instance_type", instance.InstanceType)
 	d.Set("key_name", instance.KeyName)
 	d.Set("public_dns", instance.PublicDNSName)
 	d.Set("public_ip", instance.PublicIPAddress)
@@ -638,6 +470,12 @@ func resourceAwsInstanceRead(d *schema.ResourceData, meta interface{}) error {
 		d.Set("subnet_id", instance.SubnetID)
 	}
 	d.Set("ebs_optimized", instance.EBSOptimized)
+
+	if instance.Monitoring != nil && instance.Monitoring.State != nil {
+		monitoringState := *instance.Monitoring.State
+		d.Set("monitoring", monitoringState == "enabled" || monitoringState == "pending")
+	}
+
 	d.Set("tags", tagsToMap(instance.Tags))
 
 	// Determine whether we're referring to security groups with
@@ -715,8 +553,8 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 
 	if d.HasChange("vpc_security_group_ids") {
 		var groups []*string
-		if v := d.Get("vpc_security_group_ids"); v != nil {
-			for _, v := range v.(*schema.Set).List() {
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
 				groups = append(groups, aws.String(v.(string)))
 			}
 		}
@@ -752,32 +590,8 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 func resourceAwsInstanceDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).ec2conn
 
-	log.Printf("[INFO] Terminating instance: %s", d.Id())
-	req := &ec2.TerminateInstancesInput{
-		InstanceIDs: []*string{aws.String(d.Id())},
-	}
-	if _, err := conn.TerminateInstances(req); err != nil {
-		return fmt.Errorf("Error terminating instance: %s", err)
-	}
-
-	log.Printf(
-		"[DEBUG] Waiting for instance (%s) to become terminated",
-		d.Id())
-
-	stateConf := &resource.StateChangeConf{
-		Pending:    []string{"pending", "running", "shutting-down", "stopped", "stopping"},
-		Target:     "terminated",
-		Refresh:    InstanceStateRefreshFunc(conn, d.Id()),
-		Timeout:    10 * time.Minute,
-		Delay:      10 * time.Second,
-		MinTimeout: 3 * time.Second,
-	}
-
-	_, err := stateConf.WaitForState()
-	if err != nil {
-		return fmt.Errorf(
-			"Error waiting for instance (%s) to terminate: %s",
-			d.Id(), err)
+	if err := awsTerminateInstance(conn, d.Id()); err != nil {
+		return err
 	}
 
 	d.SetId("")
@@ -909,16 +723,305 @@ func fetchRootDeviceName(ami string, conn *ec2.EC2) (*string, error) {
 	}
 
 	log.Printf("[DEBUG] Describing AMI %q to get root block device name", ami)
-	req := &ec2.DescribeImagesInput{ImageIDs: []*string{aws.String(ami)}}
-	if res, err := conn.DescribeImages(req); err == nil {
-		if len(res.Images) == 1 {
-			return res.Images[0].RootDeviceName, nil
-		} else if len(res.Images) == 0 {
-			return nil, nil
-		} else {
-			return nil, fmt.Errorf("Expected 1 AMI for ID: %s, got: %#v", ami, res.Images)
-		}
-	} else {
+	res, err := conn.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIDs: []*string{aws.String(ami)},
+	})
+	if err != nil {
 		return nil, err
 	}
+
+	// For a bad image, we just return nil so we don't block a refresh
+	if len(res.Images) == 0 {
+		return nil, nil
+	}
+
+	image := res.Images[0]
+	rootDeviceName := image.RootDeviceName
+
+	// Some AMIs have a RootDeviceName like "/dev/sda1" that does not appear as a
+	// DeviceName in the BlockDeviceMapping list (which will instead have
+	// something like "/dev/sda")
+	//
+	// While this seems like it breaks an invariant of AMIs, it ends up working
+	// on the AWS side, and AMIs like this are common enough that we need to
+	// special case it so Terraform does the right thing.
+	//
+	// Our heuristic is: if the RootDeviceName does not appear in the
+	// BlockDeviceMapping, assume that the DeviceName of the first
+	// BlockDeviceMapping entry serves as the root device.
+	rootDeviceNameInMapping := false
+	for _, bdm := range image.BlockDeviceMappings {
+		if bdm.DeviceName == image.RootDeviceName {
+			rootDeviceNameInMapping = true
+		}
+	}
+
+	if !rootDeviceNameInMapping && len(image.BlockDeviceMappings) > 0 {
+		rootDeviceName = image.BlockDeviceMappings[0].DeviceName
+	}
+
+	return rootDeviceName, nil
+}
+
+func readBlockDeviceMappingsFromConfig(
+	d *schema.ResourceData, conn *ec2.EC2) ([]*ec2.BlockDeviceMapping, error) {
+	blockDevices := make([]*ec2.BlockDeviceMapping, 0)
+
+	if v, ok := d.GetOk("ebs_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			ebs := &ec2.EBSBlockDevice{
+				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
+			}
+
+			if v, ok := bd["snapshot_id"].(string); ok && v != "" {
+				ebs.SnapshotID = aws.String(v)
+			}
+
+			if v, ok := bd["encrypted"].(bool); ok && v {
+				ebs.Encrypted = aws.Boolean(v)
+			}
+
+			if v, ok := bd["volume_size"].(int); ok && v != 0 {
+				ebs.VolumeSize = aws.Long(int64(v))
+			}
+
+			if v, ok := bd["volume_type"].(string); ok && v != "" {
+				ebs.VolumeType = aws.String(v)
+			}
+
+			if v, ok := bd["iops"].(int); ok && v > 0 {
+				ebs.IOPS = aws.Long(int64(v))
+			}
+
+			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+				DeviceName: aws.String(bd["device_name"].(string)),
+				EBS:        ebs,
+			})
+		}
+	}
+
+	if v, ok := d.GetOk("ephemeral_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+				DeviceName:  aws.String(bd["device_name"].(string)),
+				VirtualName: aws.String(bd["virtual_name"].(string)),
+			})
+		}
+	}
+
+	if v, ok := d.GetOk("root_block_device"); ok {
+		vL := v.(*schema.Set).List()
+		if len(vL) > 1 {
+			return nil, fmt.Errorf("Cannot specify more than one root_block_device.")
+		}
+		for _, v := range vL {
+			bd := v.(map[string]interface{})
+			ebs := &ec2.EBSBlockDevice{
+				DeleteOnTermination: aws.Boolean(bd["delete_on_termination"].(bool)),
+			}
+
+			if v, ok := bd["volume_size"].(int); ok && v != 0 {
+				ebs.VolumeSize = aws.Long(int64(v))
+			}
+
+			if v, ok := bd["volume_type"].(string); ok && v != "" {
+				ebs.VolumeType = aws.String(v)
+			}
+
+			if v, ok := bd["iops"].(int); ok && v > 0 {
+				ebs.IOPS = aws.Long(int64(v))
+			}
+
+			if dn, err := fetchRootDeviceName(d.Get("ami").(string), conn); err == nil {
+				if dn == nil {
+					return nil, fmt.Errorf(
+						"Expected 1 AMI for ID: %s, got none",
+						d.Get("ami").(string))
+				}
+
+				blockDevices = append(blockDevices, &ec2.BlockDeviceMapping{
+					DeviceName: dn,
+					EBS:        ebs,
+				})
+			} else {
+				return nil, err
+			}
+		}
+	}
+
+	return blockDevices, nil
+}
+
+type awsInstanceOpts struct {
+	BlockDeviceMappings   []*ec2.BlockDeviceMapping
+	DisableAPITermination *bool
+	EBSOptimized          *bool
+	Monitoring            *ec2.RunInstancesMonitoringEnabled
+	IAMInstanceProfile    *ec2.IAMInstanceProfileSpecification
+	ImageID               *string
+	InstanceType          *string
+	KeyName               *string
+	NetworkInterfaces     []*ec2.InstanceNetworkInterfaceSpecification
+	Placement             *ec2.Placement
+	PrivateIPAddress      *string
+	SecurityGroupIDs      []*string
+	SecurityGroups        []*string
+	SpotPlacement         *ec2.SpotPlacement
+	SubnetID              *string
+	UserData64            *string
+}
+
+func buildAwsInstanceOpts(
+	d *schema.ResourceData, meta interface{}) (*awsInstanceOpts, error) {
+	conn := meta.(*AWSClient).ec2conn
+
+	opts := &awsInstanceOpts{
+		DisableAPITermination: aws.Boolean(d.Get("disable_api_termination").(bool)),
+		EBSOptimized:          aws.Boolean(d.Get("ebs_optimized").(bool)),
+		ImageID:               aws.String(d.Get("ami").(string)),
+		InstanceType:          aws.String(d.Get("instance_type").(string)),
+	}
+
+	opts.Monitoring = &ec2.RunInstancesMonitoringEnabled{
+		Enabled: aws.Boolean(d.Get("monitoring").(bool)),
+	}
+
+	opts.IAMInstanceProfile = &ec2.IAMInstanceProfileSpecification{
+		Name: aws.String(d.Get("iam_instance_profile").(string)),
+	}
+
+	opts.UserData64 = aws.String(
+		base64.StdEncoding.EncodeToString([]byte(d.Get("user_data").(string))))
+
+	// check for non-default Subnet, and cast it to a String
+	subnet, hasSubnet := d.GetOk("subnet_id")
+	subnetID := subnet.(string)
+
+	// Placement is used for aws_instance; SpotPlacement is used for
+	// aws_spot_instance_request. They represent the same data. :-|
+	opts.Placement = &ec2.Placement{
+		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
+		GroupName:        aws.String(d.Get("placement_group").(string)),
+	}
+
+	opts.SpotPlacement = &ec2.SpotPlacement{
+		AvailabilityZone: aws.String(d.Get("availability_zone").(string)),
+		GroupName:        aws.String(d.Get("placement_group").(string)),
+	}
+
+	if v := d.Get("tenancy").(string); v != "" {
+		opts.Placement.Tenancy = aws.String(v)
+	}
+
+	associatePublicIPAddress := d.Get("associate_public_ip_address").(bool)
+
+	var groups []*string
+	if v := d.Get("security_groups"); v != nil {
+		// Security group names.
+		// For a nondefault VPC, you must use security group IDs instead.
+		// See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
+		sgs := v.(*schema.Set).List()
+		if len(sgs) > 0 && hasSubnet {
+			log.Printf("[WARN] Deprecated. Attempting to use 'security_groups' within a VPC instance. Use 'vpc_security_group_ids' instead.")
+		}
+		for _, v := range sgs {
+			str := v.(string)
+			groups = append(groups, aws.String(str))
+		}
+	}
+
+	if hasSubnet && associatePublicIPAddress {
+		// If we have a non-default VPC / Subnet specified, we can flag
+		// AssociatePublicIpAddress to get a Public IP assigned. By default these are not provided.
+		// You cannot specify both SubnetId and the NetworkInterface.0.* parameters though, otherwise
+		// you get: Network interfaces and an instance-level subnet ID may not be specified on the same request
+		// You also need to attach Security Groups to the NetworkInterface instead of the instance,
+		// to avoid: Network interfaces and an instance-level security groups may not be specified on
+		// the same request
+		ni := &ec2.InstanceNetworkInterfaceSpecification{
+			AssociatePublicIPAddress: aws.Boolean(associatePublicIPAddress),
+			DeviceIndex:              aws.Long(int64(0)),
+			SubnetID:                 aws.String(subnetID),
+			Groups:                   groups,
+		}
+
+		if v, ok := d.GetOk("private_ip"); ok {
+			ni.PrivateIPAddress = aws.String(v.(string))
+		}
+
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
+				ni.Groups = append(ni.Groups, aws.String(v.(string)))
+			}
+		}
+
+		opts.NetworkInterfaces = []*ec2.InstanceNetworkInterfaceSpecification{ni}
+	} else {
+		if subnetID != "" {
+			opts.SubnetID = aws.String(subnetID)
+		}
+
+		if v, ok := d.GetOk("private_ip"); ok {
+			opts.PrivateIPAddress = aws.String(v.(string))
+		}
+		if opts.SubnetID != nil &&
+			*opts.SubnetID != "" {
+			opts.SecurityGroupIDs = groups
+		} else {
+			opts.SecurityGroups = groups
+		}
+
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			for _, v := range v.List() {
+				opts.SecurityGroupIDs = append(opts.SecurityGroupIDs, aws.String(v.(string)))
+			}
+		}
+	}
+
+	if v, ok := d.GetOk("key_name"); ok {
+		opts.KeyName = aws.String(v.(string))
+	}
+
+	blockDevices, err := readBlockDeviceMappingsFromConfig(d, conn)
+	if err != nil {
+		return nil, err
+	}
+	if len(blockDevices) > 0 {
+		opts.BlockDeviceMappings = blockDevices
+	}
+
+	return opts, nil
+}
+
+func awsTerminateInstance(conn *ec2.EC2, id string) error {
+	log.Printf("[INFO] Terminating instance: %s", id)
+	req := &ec2.TerminateInstancesInput{
+		InstanceIDs: []*string{aws.String(id)},
+	}
+	if _, err := conn.TerminateInstances(req); err != nil {
+		return fmt.Errorf("Error terminating instance: %s", err)
+	}
+
+	log.Printf("[DEBUG] Waiting for instance (%s) to become terminated", id)
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"pending", "running", "shutting-down", "stopped", "stopping"},
+		Target:     "terminated",
+		Refresh:    InstanceStateRefreshFunc(conn, id),
+		Timeout:    10 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err := stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for instance (%s) to terminate: %s", id, err)
+	}
+
+	return nil
 }
diff --git a/builtin/providers/aws/resource_aws_instance_test.go b/builtin/providers/aws/resource_aws_instance_test.go
index b90cf436a..c189a5963 100644
--- a/builtin/providers/aws/resource_aws_instance_test.go
+++ b/builtin/providers/aws/resource_aws_instance_test.go
@@ -5,15 +5,16 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSInstance_normal(t *testing.T) {
+func TestAccAWSInstance_basic(t *testing.T) {
 	var v ec2.Instance
 	var vol *ec2.Volume
 
@@ -456,6 +457,60 @@ func TestAccAWSInstance_associatePublicIPAndPrivateIP(t *testing.T) {
 	})
 }
 
+// Guard against regression with KeyPairs
+// https://github.com/hashicorp/terraform/issues/2302
+func TestAccAWSInstance_keyPairCheck(t *testing.T) {
+	var v ec2.Instance
+
+	testCheckKeyPair := func(keyName string) resource.TestCheckFunc {
+		return func(*terraform.State) error {
+			if v.KeyName == nil {
+				return fmt.Errorf("No Key Pair found, expected(%s)", keyName)
+			}
+			if *v.KeyName != keyName {
+				return fmt.Errorf("Bad key name, expected (%s), got (%s)", keyName, awsutil.StringValue(v.KeyName))
+			}
+
+			return nil
+		}
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceConfigKeyPair,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					testCheckKeyPair("tmp-key"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSInstance_rootBlockDeviceMismatch(t *testing.T) {
+	var v ec2.Instance
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceConfigRootBlockDeviceMismatch,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+					resource.TestCheckResourceAttr(
+						"aws_instance.foo", "root_block_device.0.volume_size", "13"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckInstanceDestroy(s *terraform.State) error {
 	return testAccCheckInstanceDestroyWithProvider(s, testAccProvider)
 }
@@ -524,6 +579,11 @@ func testAccCheckInstanceExistsWithProviders(n string, i *ec2.Instance, provider
 			return fmt.Errorf("No ID is set")
 		}
 		for _, provider := range *providers {
+			// Ignore if Meta is empty, this can happen for validation providers
+			if provider.Meta() == nil {
+				continue
+			}
+
 			conn := provider.Meta().(*AWSClient).ec2conn
 			resp, err := conn.DescribeInstances(&ec2.DescribeInstancesInput{
 				InstanceIDs: []*string{aws.String(rs.Primary.ID)},
@@ -653,7 +713,6 @@ resource "aws_instance" "foo" {
 	ami = "ami-4fccb37f"
 	instance_type = "m1.small"
 	subnet_id = "${aws_subnet.foo.id}"
-	source_dest_check = true
 }
 `
 
@@ -890,3 +949,41 @@ resource "aws_eip" "foo_eip" {
 	depends_on = ["aws_internet_gateway.gw"]
 }
 `
+
+const testAccInstanceConfigKeyPair = `
+provider "aws" {
+	region = "us-east-1"
+}
+
+resource "aws_key_pair" "debugging" {
+	key_name = "tmp-key"
+	public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 phodgson@thoughtworks.com"
+}
+
+resource "aws_instance" "foo" {
+  ami = "ami-408c7f28"
+  instance_type = "t1.micro"
+  key_name = "${aws_key_pair.debugging.key_name}"
+}
+`
+
+const testAccInstanceConfigRootBlockDeviceMismatch = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.1.0.0/16"
+}
+
+resource "aws_subnet" "foo" {
+	cidr_block = "10.1.1.0/24"
+	vpc_id = "${aws_vpc.foo.id}"
+}
+
+resource "aws_instance" "foo" {
+	// This is an AMI with RootDeviceName: "/dev/sda1"; actual root: "/dev/sda"
+	ami = "ami-ef5b69df"
+	instance_type = "t1.micro"
+	subnet_id = "${aws_subnet.foo.id}"
+	root_block_device {
+		volume_size = 13
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_internet_gateway.go b/builtin/providers/aws/resource_aws_internet_gateway.go
index d0bcd47b5..e1597b4fd 100644
--- a/builtin/providers/aws/resource_aws_internet_gateway.go
+++ b/builtin/providers/aws/resource_aws_internet_gateway.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_internet_gateway_test.go b/builtin/providers/aws/resource_aws_internet_gateway_test.go
index 23aeb1e2e..6698de6ea 100644
--- a/builtin/providers/aws/resource_aws_internet_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_internet_gateway_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/resource_aws_key_pair.go b/builtin/providers/aws/resource_aws_key_pair.go
index 036c35fe8..e747fbfc5 100644
--- a/builtin/providers/aws/resource_aws_key_pair.go
+++ b/builtin/providers/aws/resource_aws_key_pair.go
@@ -6,9 +6,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 )
 
 func resourceAwsKeyPair() *schema.Resource {
diff --git a/builtin/providers/aws/resource_aws_key_pair_test.go b/builtin/providers/aws/resource_aws_key_pair_test.go
index 874c74406..cb0b28639 100644
--- a/builtin/providers/aws/resource_aws_key_pair_test.go
+++ b/builtin/providers/aws/resource_aws_key_pair_test.go
@@ -5,14 +5,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSKeyPair_normal(t *testing.T) {
+func TestAccAWSKeyPair_basic(t *testing.T) {
 	var conf ec2.KeyPairInfo
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_kinesis_stream.go b/builtin/providers/aws/resource_aws_kinesis_stream.go
new file mode 100644
index 000000000..f4c84f803
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_kinesis_stream.go
@@ -0,0 +1,156 @@
+package aws
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsKinesisStream() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsKinesisStreamCreate,
+		Read:   resourceAwsKinesisStreamRead,
+		Delete: resourceAwsKinesisStreamDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"shard_count": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsKinesisStreamCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	sn := d.Get("name").(string)
+	createOpts := &kinesis.CreateStreamInput{
+		ShardCount: aws.Long(int64(d.Get("shard_count").(int))),
+		StreamName: aws.String(sn),
+	}
+
+	_, err := conn.CreateStream(createOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error creating Kinesis Stream: \"%s\", code: \"%s\"", awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"CREATING"},
+		Target:     "ACTIVE",
+		Refresh:    streamStateRefreshFunc(conn, sn),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	streamRaw, err := stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Kinesis Stream (%s) to become active: %s",
+			sn, err)
+	}
+
+	s := streamRaw.(*kinesis.StreamDescription)
+	d.SetId(*s.StreamARN)
+	d.Set("arn", s.StreamARN)
+
+	return nil
+}
+
+func resourceAwsKinesisStreamRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	describeOpts := &kinesis.DescribeStreamInput{
+		StreamName: aws.String(d.Get("name").(string)),
+		Limit:      aws.Long(1),
+	}
+	resp, err := conn.DescribeStream(describeOpts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			if awsErr.Code() == "ResourceNotFoundException" {
+				d.SetId("")
+				return nil
+			}
+			return fmt.Errorf("[WARN] Error reading Kinesis Stream: \"%s\", code: \"%s\"", awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	s := resp.StreamDescription
+	d.Set("arn", *s.StreamARN)
+	d.Set("shard_count", len(s.Shards))
+
+	return nil
+}
+
+func resourceAwsKinesisStreamDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).kinesisconn
+	sn := d.Get("name").(string)
+	_, err := conn.DeleteStream(&kinesis.DeleteStreamInput{
+		StreamName: aws.String(sn),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"DELETING"},
+		Target:     "DESTROYED",
+		Refresh:    streamStateRefreshFunc(conn, sn),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Stream (%s) to be destroyed: %s",
+			sn, err)
+	}
+
+	d.SetId("")
+	return nil
+}
+
+func streamStateRefreshFunc(conn *kinesis.Kinesis, sn string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(sn),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Code() == "ResourceNotFoundException" {
+					return 42, "DESTROYED", nil
+				}
+				return nil, awsErr.Code(), err
+			}
+			return nil, "failed", err
+		}
+
+		return resp.StreamDescription, *resp.StreamDescription.StreamStatus, nil
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_kinesis_stream_test.go b/builtin/providers/aws/resource_aws_kinesis_stream_test.go
new file mode 100644
index 000000000..01d14d3d0
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_kinesis_stream_test.go
@@ -0,0 +1,108 @@
+package aws
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccKinesisStream_basic(t *testing.T) {
+	var stream kinesis.StreamDescription
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckKinesisStreamDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccKinesisStreamConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKinesisStreamExists("aws_kinesis_stream.test_stream", &stream),
+					testAccCheckAWSKinesisStreamAttributes(&stream),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckKinesisStreamExists(n string, stream *kinesis.StreamDescription) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Kinesis ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).kinesisconn
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(rs.Primary.Attributes["name"]),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err != nil {
+			return err
+		}
+
+		*stream = *resp.StreamDescription
+
+		return nil
+	}
+}
+
+func testAccCheckAWSKinesisStreamAttributes(stream *kinesis.StreamDescription) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if !strings.HasPrefix(*stream.StreamName, "terraform-kinesis-test") {
+			return fmt.Errorf("Bad Stream name: %s", *stream.StreamName)
+		}
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_kinesis_stream" {
+				continue
+			}
+			if *stream.StreamARN != rs.Primary.Attributes["arn"] {
+				return fmt.Errorf("Bad Stream ARN\n\t expected: %s\n\tgot: %s\n", rs.Primary.Attributes["arn"], *stream.StreamARN)
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckKinesisStreamDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_kinesis_stream" {
+			continue
+		}
+		conn := testAccProvider.Meta().(*AWSClient).kinesisconn
+		describeOpts := &kinesis.DescribeStreamInput{
+			StreamName: aws.String(rs.Primary.Attributes["name"]),
+			Limit:      aws.Long(1),
+		}
+		resp, err := conn.DescribeStream(describeOpts)
+		if err == nil {
+			if resp.StreamDescription != nil && *resp.StreamDescription.StreamStatus != "DELETING" {
+				return fmt.Errorf("Error: Stream still exists")
+			}
+		}
+
+		return nil
+
+	}
+
+	return nil
+}
+
+var testAccKinesisStreamConfig = fmt.Sprintf(`
+resource "aws_kinesis_stream" "test_stream" {
+	name = "terraform-kinesis-test-%d"
+	shard_count = 1
+}
+`, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
diff --git a/builtin/providers/aws/resource_aws_lambda_function.go b/builtin/providers/aws/resource_aws_lambda_function.go
new file mode 100644
index 000000000..72dab0154
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_lambda_function.go
@@ -0,0 +1,207 @@
+package aws
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/mitchellh/go-homedir"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsLambdaFunction() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsLambdaFunctionCreate,
+		Read:   resourceAwsLambdaFunctionRead,
+		Update: resourceAwsLambdaFunctionUpdate,
+		Delete: resourceAwsLambdaFunctionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"filename": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"function_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"handler": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"memory_size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  128,
+				ForceNew: true, // TODO make this editable
+			},
+			"role": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true, // TODO make this editable
+			},
+			"runtime": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  "nodejs",
+			},
+			"timeout": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  3,
+				ForceNew: true, // TODO make this editable
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"last_modified": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"source_code_hash": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+// resourceAwsLambdaFunction maps to:
+// CreateFunction in the API / SDK
+func resourceAwsLambdaFunctionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	functionName := d.Get("function_name").(string)
+	iamRole := d.Get("role").(string)
+
+	log.Printf("[DEBUG] Creating Lambda Function %s with role %s", functionName, iamRole)
+
+	filename, err := homedir.Expand(d.Get("filename").(string))
+	if err != nil {
+		return err
+	}
+	zipfile, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+	d.Set("source_code_hash", sha256.Sum256(zipfile))
+
+	log.Printf("[DEBUG] ")
+
+	params := &lambda.CreateFunctionInput{
+		Code: &lambda.FunctionCode{
+			ZipFile: zipfile,
+		},
+		Description:  aws.String(d.Get("description").(string)),
+		FunctionName: aws.String(functionName),
+		Handler:      aws.String(d.Get("handler").(string)),
+		MemorySize:   aws.Long(int64(d.Get("memory_size").(int))),
+		Role:         aws.String(iamRole),
+		Runtime:      aws.String(d.Get("runtime").(string)),
+		Timeout:      aws.Long(int64(d.Get("timeout").(int))),
+	}
+
+	for i := 0; i < 5; i++ {
+		_, err = conn.CreateFunction(params)
+		if awsErr, ok := err.(awserr.Error); ok {
+
+			// IAM profiles can take ~10 seconds to propagate in AWS:
+			//  http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
+			// Error creating Lambda function: InvalidParameterValueException: The role defined for the task cannot be assumed by Lambda.
+			if awsErr.Code() == "InvalidParameterValueException" && strings.Contains(awsErr.Message(), "The role defined for the task cannot be assumed by Lambda.") {
+				log.Printf("[DEBUG] Invalid IAM Instance Profile referenced, retrying...")
+				time.Sleep(2 * time.Second)
+				continue
+			}
+		}
+		break
+	}
+	if err != nil {
+		return fmt.Errorf("Error creating Lambda function: %s", err)
+	}
+
+	d.SetId(d.Get("function_name").(string))
+
+	return resourceAwsLambdaFunctionRead(d, meta)
+}
+
+// resourceAwsLambdaFunctionRead maps to:
+// GetFunction in the API / SDK
+func resourceAwsLambdaFunctionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	log.Printf("[DEBUG] Fetching Lambda Function: %s", d.Id())
+
+	params := &lambda.GetFunctionInput{
+		FunctionName: aws.String(d.Get("function_name").(string)),
+	}
+
+	getFunctionOutput, err := conn.GetFunction(params)
+	if err != nil {
+		return err
+	}
+
+	// getFunctionOutput.Code.Location is a pre-signed URL pointing at the zip
+	// file that we uploaded when we created the resource. You can use it to
+	// download the code from AWS. The other part is
+	// getFunctionOutput.Configuration which holds metadata.
+
+	function := getFunctionOutput.Configuration
+	// TODO error checking / handling on the Set() calls.
+	d.Set("arn", function.FunctionARN)
+	d.Set("description", function.Description)
+	d.Set("handler", function.Handler)
+	d.Set("memory_size", function.MemorySize)
+	d.Set("last_modified", function.LastModified)
+	d.Set("role", function.Role)
+	d.Set("runtime", function.Runtime)
+	d.Set("timeout", function.Timeout)
+
+	return nil
+}
+
+// resourceAwsLambdaFunction maps to:
+// DeleteFunction in the API / SDK
+func resourceAwsLambdaFunctionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).lambdaconn
+
+	log.Printf("[INFO] Deleting Lambda Function: %s", d.Id())
+
+	params := &lambda.DeleteFunctionInput{
+		FunctionName: aws.String(d.Get("function_name").(string)),
+	}
+
+	_, err := conn.DeleteFunction(params)
+	if err != nil {
+		return fmt.Errorf("Error deleting Lambda Function: %s", err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+// resourceAwsLambdaFunctionUpdate maps to:
+// UpdateFunctionCode in the API / SDK
+func resourceAwsLambdaFunctionUpdate(d *schema.ResourceData, meta interface{}) error {
+	// conn := meta.(*AWSClient).lambdaconn
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_lambda_function_test.go b/builtin/providers/aws/resource_aws_lambda_function_test.go
new file mode 100644
index 000000000..d85bd7e8d
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_lambda_function_test.go
@@ -0,0 +1,125 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSLambdaFunction_normal(t *testing.T) {
+	var conf lambda.GetFunctionOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckLambdaFunctionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSLambdaConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAwsLambdaFunctionExists("aws_lambda_function.lambda_function_test", &conf),
+					testAccCheckAWSLambdaAttributes(&conf),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckLambdaFunctionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).lambdaconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_lambda_function" {
+			continue
+		}
+
+		_, err := conn.GetFunction(&lambda.GetFunctionInput{
+			FunctionName: aws.String(rs.Primary.ID),
+		})
+
+		if err == nil {
+			return fmt.Errorf("Lambda Function still exists")
+		}
+
+	}
+
+	return nil
+
+}
+
+func testAccCheckAwsLambdaFunctionExists(n string, function *lambda.GetFunctionOutput) resource.TestCheckFunc {
+	// Wait for IAM role
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Lambda function not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("Lambda function ID not set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).lambdaconn
+
+		params := &lambda.GetFunctionInput{
+			FunctionName: aws.String("example_lambda_name"),
+		}
+
+		getFunction, err := conn.GetFunction(params)
+		if err != nil {
+			return err
+		}
+
+		*function = *getFunction
+
+		return nil
+	}
+}
+
+func testAccCheckAWSLambdaAttributes(function *lambda.GetFunctionOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		c := function.Configuration
+		const expectedName = "example_lambda_name"
+		if *c.FunctionName != expectedName {
+			return fmt.Errorf("Expected function name %s, got %s", expectedName, *c.FunctionName)
+		}
+
+		if *c.FunctionARN == "" {
+			return fmt.Errorf("Could not read Lambda Function's ARN")
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSLambdaConfig = `
+resource "aws_iam_role" "iam_for_lambda" {
+    name = "iam_for_lambda"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_lambda_function" "lambda_function_test" {
+    filename = "test-fixtures/lambdatest.zip"
+    function_name = "example_lambda_name"
+    role = "${aws_iam_role.iam_for_lambda.arn}"
+    handler = "exports.example"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_launch_configuration.go b/builtin/providers/aws/resource_aws_launch_configuration.go
index 0ba78aa72..a5bc26702 100644
--- a/builtin/providers/aws/resource_aws_launch_configuration.go
+++ b/builtin/providers/aws/resource_aws_launch_configuration.go
@@ -9,10 +9,10 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -30,6 +30,15 @@ func resourceAwsLaunchConfiguration() *schema.Resource {
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					// https://github.com/boto/botocore/blob/9f322b1/botocore/data/autoscaling/2011-01-01/service-2.json#L1932-L1939
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"image_id": &schema.Schema{
@@ -106,6 +115,13 @@ func resourceAwsLaunchConfiguration() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"enable_monitoring": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
 			"ebs_block_device": &schema.Schema{
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -256,6 +272,12 @@ func resourceAwsLaunchConfigurationCreate(d *schema.ResourceData, meta interface
 		createLaunchConfigurationOpts.UserData = aws.String(userData)
 	}
 
+	if v, ok := d.GetOk("enable_monitoring"); ok {
+		createLaunchConfigurationOpts.InstanceMonitoring = &autoscaling.InstanceMonitoring{
+			Enabled: aws.Boolean(v.(bool)),
+		}
+	}
+
 	if v, ok := d.GetOk("iam_instance_profile"); ok {
 		createLaunchConfigurationOpts.IAMInstanceProfile = aws.String(v.(string))
 	}
@@ -373,7 +395,24 @@ func resourceAwsLaunchConfigurationCreate(d *schema.ResourceData, meta interface
 
 	log.Printf(
 		"[DEBUG] autoscaling create launch configuration: %#v", createLaunchConfigurationOpts)
-	_, err := autoscalingconn.CreateLaunchConfiguration(&createLaunchConfigurationOpts)
+
+	// IAM profiles can take ~10 seconds to propagate in AWS:
+	// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
+	err := resource.Retry(30*time.Second, func() error {
+		_, err := autoscalingconn.CreateLaunchConfiguration(&createLaunchConfigurationOpts)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				if awsErr.Message() == "Invalid IamInstanceProfile" {
+					return err
+				}
+			}
+			return &resource.RetryError{
+				Err: err,
+			}
+		}
+		return nil
+	})
+
 	if err != nil {
 		return fmt.Errorf("Error creating launch configuration: %s", err)
 	}
@@ -423,6 +462,7 @@ func resourceAwsLaunchConfigurationRead(d *schema.ResourceData, meta interface{}
 	d.Set("iam_instance_profile", lc.IAMInstanceProfile)
 	d.Set("ebs_optimized", lc.EBSOptimized)
 	d.Set("spot_price", lc.SpotPrice)
+	d.Set("enable_monitoring", lc.InstanceMonitoring.Enabled)
 	d.Set("security_groups", lc.SecurityGroups)
 
 	if err := readLCBlockDevices(d, lc, ec2conn); err != nil {
diff --git a/builtin/providers/aws/resource_aws_launch_configuration_test.go b/builtin/providers/aws/resource_aws_launch_configuration_test.go
index 86c970c32..bb008baaa 100644
--- a/builtin/providers/aws/resource_aws_launch_configuration_test.go
+++ b/builtin/providers/aws/resource_aws_launch_configuration_test.go
@@ -7,13 +7,33 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/autoscaling"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
+func TestAccAWSLaunchConfiguration_basic(t *testing.T) {
+	var conf autoscaling.LaunchConfiguration
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSLaunchConfigurationDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSLaunchConfigurationNoNameConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSLaunchConfigurationExists("aws_launch_configuration.bar", &conf),
+					testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
+						"aws_launch_configuration.bar", "terraform-"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSLaunchConfiguration_withBlockDevices(t *testing.T) {
 	var conf autoscaling.LaunchConfiguration
 
@@ -61,26 +81,6 @@ func TestAccAWSLaunchConfiguration_withSpotPrice(t *testing.T) {
 	})
 }
 
-func TestAccAWSLaunchConfiguration_withGeneratedName(t *testing.T) {
-	var conf autoscaling.LaunchConfiguration
-
-	resource.Test(t, resource.TestCase{
-		PreCheck:     func() { testAccPreCheck(t) },
-		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckAWSLaunchConfigurationDestroy,
-		Steps: []resource.TestStep{
-			resource.TestStep{
-				Config: testAccAWSLaunchConfigurationNoNameConfig,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSLaunchConfigurationExists("aws_launch_configuration.bar", &conf),
-					testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
-						"aws_launch_configuration.bar", "terraform-"),
-				),
-			},
-		},
-	})
-}
-
 func testAccCheckAWSLaunchConfigurationGeneratedNamePrefix(
 	resource, prefix string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
diff --git a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
index 7907e3df4..fdc8ec303 100644
--- a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
+++ b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
index 6a43496de..e1073e5e8 100644
--- a/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
+++ b/builtin/providers/aws/resource_aws_lb_cookie_stickiness_policy_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsLBCookieStickinessPolicy(t *testing.T) {
+func TestAccAwsLBCookieStickinessPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_main_route_table_association.go b/builtin/providers/aws/resource_aws_main_route_table_association.go
index 097dc1888..48008c61a 100644
--- a/builtin/providers/aws/resource_aws_main_route_table_association.go
+++ b/builtin/providers/aws/resource_aws_main_route_table_association.go
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_main_route_table_association_test.go b/builtin/providers/aws/resource_aws_main_route_table_association_test.go
index 81f87a901..344df82f6 100644
--- a/builtin/providers/aws/resource_aws_main_route_table_association_test.go
+++ b/builtin/providers/aws/resource_aws_main_route_table_association_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSMainRouteTableAssociation(t *testing.T) {
+func TestAccAWSMainRouteTableAssociation_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_network_acl.go b/builtin/providers/aws/resource_aws_network_acl.go
index 4ff439493..b689b9860 100644
--- a/builtin/providers/aws/resource_aws_network_acl.go
+++ b/builtin/providers/aws/resource_aws_network_acl.go
@@ -8,9 +8,9 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -76,6 +76,14 @@ func resourceAwsNetworkAcl() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
+						"icmp_type": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"icmp_code": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
 					},
 				},
 				Set: resourceAwsNetworkAclEntryHash,
@@ -110,6 +118,14 @@ func resourceAwsNetworkAcl() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
+						"icmp_type": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"icmp_code": &schema.Schema{
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
 					},
 				},
 				Set: resourceAwsNetworkAclEntryHash,
@@ -377,9 +393,10 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, conn *ec2
 			Protocol:     add.Protocol,
 			RuleAction:   add.RuleAction,
 			RuleNumber:   add.RuleNumber,
+			ICMPTypeCode: add.ICMPTypeCode,
 		})
 		if connErr != nil {
-			return fmt.Errorf("Error creating %s entry: %s", entryType, err)
+			return fmt.Errorf("Error creating %s entry: %s", entryType, connErr)
 		}
 	}
 	return nil
@@ -466,6 +483,13 @@ func resourceAwsNetworkAclEntryHash(v interface{}) int {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
 	}
 
+	if v, ok := m["icmp_type"]; ok {
+		buf.WriteString(fmt.Sprintf("%d-", v.(int)))
+	}
+	if v, ok := m["icmp_code"]; ok {
+		buf.WriteString(fmt.Sprintf("%d-", v.(int)))
+	}
+
 	return hashcode.String(buf.String())
 }
 
@@ -538,6 +562,11 @@ func networkAclEntriesToMapList(networkAcls []*ec2.NetworkACLEntry) []map[string
 			acl["to_port"] = *entry.PortRange.To
 		}
 
+		if entry.ICMPTypeCode != nil {
+			acl["icmp_type"] = *entry.ICMPTypeCode.Type
+			acl["icmp_code"] = *entry.ICMPTypeCode.Code
+		}
+
 		result = append(result, acl)
 	}
 
diff --git a/builtin/providers/aws/resource_aws_network_acl_test.go b/builtin/providers/aws/resource_aws_network_acl_test.go
index 1e625fc83..ad834cc66 100644
--- a/builtin/providers/aws/resource_aws_network_acl_test.go
+++ b/builtin/providers/aws/resource_aws_network_acl_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -24,29 +24,29 @@ func TestAccAWSNetworkAcl_EgressAndIngressRules(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.protocol", "6"),
+						"aws_network_acl.bar", "ingress.109047673.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.rule_no", "1"),
+						"aws_network_acl.bar", "ingress.109047673.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.from_port", "80"),
+						"aws_network_acl.bar", "ingress.109047673.from_port", "80"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.to_port", "80"),
+						"aws_network_acl.bar", "ingress.109047673.to_port", "80"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.action", "allow"),
+						"aws_network_acl.bar", "ingress.109047673.action", "allow"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "ingress.1216169466.cidr_block", "10.3.0.0/18"),
+						"aws_network_acl.bar", "ingress.109047673.cidr_block", "10.3.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.protocol", "6"),
+						"aws_network_acl.bar", "egress.868403673.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.rule_no", "2"),
+						"aws_network_acl.bar", "egress.868403673.rule_no", "2"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.from_port", "443"),
+						"aws_network_acl.bar", "egress.868403673.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.to_port", "443"),
+						"aws_network_acl.bar", "egress.868403673.to_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.cidr_block", "10.3.0.0/18"),
+						"aws_network_acl.bar", "egress.868403673.cidr_block", "10.3.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.bar", "egress.2634340476.action", "allow"),
+						"aws_network_acl.bar", "egress.868403673.action", "allow"),
 				),
 			},
 		},
@@ -67,17 +67,17 @@ func TestAccAWSNetworkAcl_OnlyIngressRules_basic(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					// testAccCheckSubnetAssociation("aws_network_acl.foos", "aws_subnet.blob"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.protocol", "6"),
+						"aws_network_acl.foos", "ingress.1451312565.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.rule_no", "2"),
+						"aws_network_acl.foos", "ingress.1451312565.rule_no", "2"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.from_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.to_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.to_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.action", "deny"),
+						"aws_network_acl.foos", "ingress.1451312565.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.1451312565.cidr_block", "10.2.0.0/18"),
 				),
 			},
 		},
@@ -98,21 +98,21 @@ func TestAccAWSNetworkAcl_OnlyIngressRules_update(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					testIngressRuleLength(&networkAcl, 2),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.protocol", "6"),
+						"aws_network_acl.foos", "ingress.2048097841.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.rule_no", "1"),
+						"aws_network_acl.foos", "ingress.2048097841.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.from_port", "0"),
+						"aws_network_acl.foos", "ingress.2048097841.from_port", "0"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.to_port", "22"),
+						"aws_network_acl.foos", "ingress.2048097841.to_port", "22"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.action", "deny"),
+						"aws_network_acl.foos", "ingress.2048097841.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.1451312565.cidr_block", "10.2.0.0/18"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.from_port", "443"),
+						"aws_network_acl.foos", "ingress.1451312565.from_port", "443"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.3264550475.rule_no", "2"),
+						"aws_network_acl.foos", "ingress.1451312565.rule_no", "2"),
 				),
 			},
 			resource.TestStep{
@@ -121,17 +121,17 @@ func TestAccAWSNetworkAcl_OnlyIngressRules_update(t *testing.T) {
 					testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
 					testIngressRuleLength(&networkAcl, 1),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.protocol", "6"),
+						"aws_network_acl.foos", "ingress.2048097841.protocol", "6"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.rule_no", "1"),
+						"aws_network_acl.foos", "ingress.2048097841.rule_no", "1"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.from_port", "0"),
+						"aws_network_acl.foos", "ingress.2048097841.from_port", "0"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.to_port", "22"),
+						"aws_network_acl.foos", "ingress.2048097841.to_port", "22"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.action", "deny"),
+						"aws_network_acl.foos", "ingress.2048097841.action", "deny"),
 					resource.TestCheckResourceAttr(
-						"aws_network_acl.foos", "ingress.2824900805.cidr_block", "10.2.0.0/18"),
+						"aws_network_acl.foos", "ingress.2048097841.cidr_block", "10.2.0.0/18"),
 				),
 			},
 		},
diff --git a/builtin/providers/aws/resource_aws_network_interface.go b/builtin/providers/aws/resource_aws_network_interface.go
index ec029778f..aee50f0aa 100644
--- a/builtin/providers/aws/resource_aws_network_interface.go
+++ b/builtin/providers/aws/resource_aws_network_interface.go
@@ -7,9 +7,9 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -78,9 +78,17 @@ func resourceAwsNetworkInterfaceCreate(d *schema.ResourceData, meta interface{})
 	conn := meta.(*AWSClient).ec2conn
 
 	request := &ec2.CreateNetworkInterfaceInput{
-		Groups:             expandStringList(d.Get("security_groups").(*schema.Set).List()),
-		SubnetID:           aws.String(d.Get("subnet_id").(string)),
-		PrivateIPAddresses: expandPrivateIPAddesses(d.Get("private_ips").(*schema.Set).List()),
+		SubnetID: aws.String(d.Get("subnet_id").(string)),
+	}
+
+	security_groups := d.Get("security_groups").(*schema.Set).List()
+	if len(security_groups) != 0 {
+		request.Groups = expandStringList(security_groups)
+	}
+
+	private_ips := d.Get("private_ips").(*schema.Set).List()
+	if len(private_ips) != 0 {
+		request.PrivateIPAddresses = expandPrivateIPAddesses(private_ips)
 	}
 
 	log.Printf("[DEBUG] Creating network interface")
diff --git a/builtin/providers/aws/resource_aws_network_interface_test.go b/builtin/providers/aws/resource_aws_network_interface_test.go
index d40802590..f83698abf 100644
--- a/builtin/providers/aws/resource_aws_network_interface_test.go
+++ b/builtin/providers/aws/resource_aws_network_interface_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/resource_aws_proxy_protocol_policy.go b/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
index 1b428195d..4f878e444 100644
--- a/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
+++ b/builtin/providers/aws/resource_aws_proxy_protocol_policy.go
@@ -6,8 +6,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go b/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
index d03cfd7eb..945a62d48 100644
--- a/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
+++ b/builtin/providers/aws/resource_aws_proxy_protocol_policy_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSProxyProtocolPolicy(t *testing.T) {
+func TestAccAWSProxyProtocolPolicy_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_route53_delegation_set.go b/builtin/providers/aws/resource_aws_route53_delegation_set.go
new file mode 100644
index 000000000..5669fe7e1
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_delegation_set.go
@@ -0,0 +1,108 @@
+package aws
+
+import (
+	"log"
+	"sort"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func resourceAwsRoute53DelegationSet() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsRoute53DelegationSetCreate,
+		Read:   resourceAwsRoute53DelegationSetRead,
+		Delete: resourceAwsRoute53DelegationSetDelete,
+
+		Schema: map[string]*schema.Schema{
+			"reference_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"name_servers": &schema.Schema{
+				Type:     schema.TypeList,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsRoute53DelegationSetCreate(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	callerRef := resource.UniqueId()
+	if v, ok := d.GetOk("reference_name"); ok {
+		callerRef = strings.Join([]string{
+			v.(string), "-", callerRef,
+		}, "")
+	}
+	input := &route53.CreateReusableDelegationSetInput{
+		CallerReference: aws.String(callerRef),
+	}
+
+	log.Printf("[DEBUG] Creating Route53 reusable delegation set: %#v", input)
+	out, err := r53.CreateReusableDelegationSet(input)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Route53 reusable delegation set created: %#v", out)
+
+	set := out.DelegationSet
+	d.SetId(cleanDelegationSetId(*set.ID))
+	d.Set("name_servers", expandNameServers(set.NameServers))
+	return nil
+}
+
+func resourceAwsRoute53DelegationSetRead(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	input := &route53.GetReusableDelegationSetInput{
+		ID: aws.String(cleanDelegationSetId(d.Id())),
+	}
+	log.Printf("[DEBUG] Reading Route53 reusable delegation set: %#v", input)
+	out, err := r53.GetReusableDelegationSet(input)
+	if err != nil {
+		return err
+	}
+	log.Printf("[DEBUG] Route53 reusable delegation set received: %#v", out)
+
+	set := out.DelegationSet
+
+	d.SetId(cleanDelegationSetId(*set.ID))
+	d.Set("name_servers", expandNameServers(set.NameServers))
+
+	return nil
+}
+
+func resourceAwsRoute53DelegationSetDelete(d *schema.ResourceData, meta interface{}) error {
+	r53 := meta.(*AWSClient).r53conn
+
+	input := &route53.DeleteReusableDelegationSetInput{
+		ID: aws.String(cleanDelegationSetId(d.Id())),
+	}
+	log.Printf("[DEBUG] Deleting Route53 reusable delegation set: %#v", input)
+	_, err := r53.DeleteReusableDelegationSet(input)
+	return err
+}
+
+func expandNameServers(name_servers []*string) []string {
+	log.Printf("[DEBUG] Processing %d name servers: %#v...", len(name_servers), name_servers)
+	ns := make([]string, len(name_servers))
+	for i, server := range name_servers {
+		ns[i] = *server
+	}
+	sort.Strings(ns)
+	log.Printf("[DEBUG] Returning processed name servers: %#v", ns)
+	return ns
+}
+
+func cleanDelegationSetId(id string) string {
+	return strings.TrimPrefix(id, "/delegationset/")
+}
diff --git a/builtin/providers/aws/resource_aws_route53_delegation_set_test.go b/builtin/providers/aws/resource_aws_route53_delegation_set_test.go
new file mode 100644
index 000000000..8de0e1b83
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_delegation_set_test.go
@@ -0,0 +1,153 @@
+package aws
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func TestAccRoute53DelegationSet_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53DelegationSetConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53DelegationSetExists("aws_route53_delegation_set.test"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53DelegationSet_withZones(t *testing.T) {
+	var zone route53.GetHostedZoneOutput
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53ZoneDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53DelegationSetWithZonesConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53DelegationSetExists("aws_route53_delegation_set.main"),
+					testAccCheckRoute53ZoneExists("aws_route53_zone.primary", &zone),
+					testAccCheckRoute53ZoneExists("aws_route53_zone.secondary", &zone),
+					testAccCheckRoute53NameServersMatch("aws_route53_delegation_set.main", "aws_route53_zone.primary"),
+					testAccCheckRoute53NameServersMatch("aws_route53_delegation_set.main", "aws_route53_zone.secondary"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckRoute53DelegationSetDestroy(s *terraform.State, provider *schema.Provider) error {
+	conn := provider.Meta().(*AWSClient).r53conn
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_route53_delegation_set" {
+			continue
+		}
+
+		_, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{ID: aws.String(rs.Primary.ID)})
+		if err == nil {
+			return fmt.Errorf("Delegation set still exists")
+		}
+	}
+	return nil
+}
+
+func testAccCheckRoute53DelegationSetExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No delegation set ID is set")
+		}
+
+		out, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{
+			ID: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", rs.Primary.ID)
+		}
+
+		setID := cleanDelegationSetId(*out.DelegationSet.ID)
+		if setID != rs.Primary.ID {
+			return fmt.Errorf("Delegation set ID does not match:\nExpected: %#v\nReturned: %#v", rs.Primary.ID, setID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckRoute53NameServersMatch(delegationSetName, zoneName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+		delegationSetLocal, ok := s.RootModule().Resources[delegationSetName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", delegationSetName)
+		}
+		delegationSet, err := conn.GetReusableDelegationSet(&route53.GetReusableDelegationSetInput{
+			ID: aws.String(delegationSetLocal.Primary.ID),
+		})
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", delegationSetLocal.Primary.ID)
+		}
+
+		hostedZoneLocal, ok := s.RootModule().Resources[zoneName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", zoneName)
+		}
+		hostedZone, err := conn.GetHostedZone(&route53.GetHostedZoneInput{
+			ID: aws.String(hostedZoneLocal.Primary.ID),
+		})
+		if err != nil {
+			return fmt.Errorf("Delegation set does not exist: %#v", hostedZoneLocal.Primary.ID)
+		}
+
+		if !reflect.DeepEqual(delegationSet.DelegationSet.NameServers, hostedZone.DelegationSet.NameServers) {
+			return fmt.Errorf("Name servers do not match:\nDelegation Set: %#v\nHosted Zone:%#v",
+				delegationSet.DelegationSet.NameServers, hostedZone.DelegationSet.NameServers)
+		}
+
+		return nil
+	}
+}
+
+const testAccRoute53DelegationSetConfig = `
+resource "aws_route53_delegation_set" "test" {
+	reference_name = "test"
+}
+`
+
+const testAccRoute53DelegationSetWithZonesConfig = `
+resource "aws_route53_delegation_set" "main" {
+    reference_name = "main"
+}
+
+resource "aws_route53_zone" "primary" {
+    name = "hashicorp.com"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+
+resource "aws_route53_zone" "secondary" {
+    name = "terraform.io"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route53_health_check.go b/builtin/providers/aws/resource_aws_route53_health_check.go
new file mode 100644
index 000000000..cd48a30b7
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_health_check.go
@@ -0,0 +1,211 @@
+package aws
+
+import (
+	"log"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func resourceAwsRoute53HealthCheck() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsRoute53HealthCheckCreate,
+		Read:   resourceAwsRoute53HealthCheckRead,
+		Update: resourceAwsRoute53HealthCheckUpdate,
+		Delete: resourceAwsRoute53HealthCheckDelete,
+
+		Schema: map[string]*schema.Schema{
+			"type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"failure_threshold": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"request_interval": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true, // todo this should be updateable but the awslabs route53 service doesnt have the ability
+			},
+			"ip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+			"fqdn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"port": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"resource_path": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"search_string": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"tags": tagsSchema(),
+		},
+	}
+}
+
+func resourceAwsRoute53HealthCheckUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	updateHealthCheck := &route53.UpdateHealthCheckInput{
+		HealthCheckID: aws.String(d.Id()),
+	}
+
+	if d.HasChange("failure_threshold") {
+		updateHealthCheck.FailureThreshold = aws.Long(int64(d.Get("failure_threshold").(int)))
+	}
+
+	if d.HasChange("fqdn") {
+		updateHealthCheck.FullyQualifiedDomainName = aws.String(d.Get("fqdn").(string))
+	}
+
+	if d.HasChange("port") {
+		updateHealthCheck.Port = aws.Long(int64(d.Get("port").(int)))
+	}
+
+	if d.HasChange("resource_path") {
+		updateHealthCheck.ResourcePath = aws.String(d.Get("resource_path").(string))
+	}
+
+	if d.HasChange("search_string") {
+		updateHealthCheck.SearchString = aws.String(d.Get("search_string").(string))
+	}
+
+	_, err := conn.UpdateHealthCheck(updateHealthCheck)
+	if err != nil {
+		return err
+	}
+
+	if err := setTagsR53(conn, d, "healthcheck"); err != nil {
+		return err
+	}
+
+	return resourceAwsRoute53HealthCheckRead(d, meta)
+}
+
+func resourceAwsRoute53HealthCheckCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	healthConfig := &route53.HealthCheckConfig{
+		Type:             aws.String(d.Get("type").(string)),
+		FailureThreshold: aws.Long(int64(d.Get("failure_threshold").(int))),
+		RequestInterval:  aws.Long(int64(d.Get("request_interval").(int))),
+	}
+
+	if v, ok := d.GetOk("fqdn"); ok {
+		healthConfig.FullyQualifiedDomainName = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("search_string"); ok {
+		healthConfig.SearchString = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("ip_address"); ok {
+		healthConfig.IPAddress = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("port"); ok {
+		healthConfig.Port = aws.Long(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("resource_path"); ok {
+		healthConfig.ResourcePath = aws.String(v.(string))
+	}
+
+	input := &route53.CreateHealthCheckInput{
+		CallerReference:   aws.String(time.Now().Format(time.RFC3339Nano)),
+		HealthCheckConfig: healthConfig,
+	}
+
+	resp, err := conn.CreateHealthCheck(input)
+
+	if err != nil {
+		return err
+	}
+
+	d.SetId(*resp.HealthCheck.ID)
+
+	if err := setTagsR53(conn, d, "healthcheck"); err != nil {
+		return err
+	}
+
+	return resourceAwsRoute53HealthCheckRead(d, meta)
+}
+
+func resourceAwsRoute53HealthCheckRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	read, err := conn.GetHealthCheck(&route53.GetHealthCheckInput{HealthCheckID: aws.String(d.Id())})
+	if err != nil {
+		if r53err, ok := err.(awserr.Error); ok && r53err.Code() == "NoSuchHealthCheck" {
+			d.SetId("")
+			return nil
+
+		}
+		return err
+	}
+
+	if read == nil {
+		return nil
+	}
+
+	updated := read.HealthCheck.HealthCheckConfig
+	d.Set("type", updated.Type)
+	d.Set("failure_threshold", updated.FailureThreshold)
+	d.Set("request_interval", updated.RequestInterval)
+	d.Set("fqdn", updated.FullyQualifiedDomainName)
+	d.Set("search_string", updated.SearchString)
+	d.Set("ip_address", updated.IPAddress)
+	d.Set("port", updated.Port)
+	d.Set("resource_path", updated.ResourcePath)
+
+	// read the tags
+	req := &route53.ListTagsForResourceInput{
+		ResourceID:   aws.String(d.Id()),
+		ResourceType: aws.String("healthcheck"),
+	}
+
+	resp, err := conn.ListTagsForResource(req)
+	if err != nil {
+		return err
+	}
+
+	var tags []*route53.Tag
+	if resp.ResourceTagSet != nil {
+		tags = resp.ResourceTagSet.Tags
+	}
+
+	if err := d.Set("tags", tagsToMapR53(tags)); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceAwsRoute53HealthCheckDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).r53conn
+
+	log.Printf("[DEBUG] Deleteing Route53 health check: %s", d.Id())
+	_, err := conn.DeleteHealthCheck(&route53.DeleteHealthCheckInput{HealthCheckID: aws.String(d.Id())})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_route53_health_check_test.go b/builtin/providers/aws/resource_aws_route53_health_check_test.go
new file mode 100644
index 000000000..32286cc41
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_route53_health_check_test.go
@@ -0,0 +1,162 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/aws/aws-sdk-go/service/route53"
+)
+
+func TestAccRoute53HealthCheck_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53HealthCheckDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.foo"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.foo"),
+					resource.TestCheckResourceAttr(
+						"aws_route53_health_check.foo", "failure_threshold", "5"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoute53HealthCheck_IpConfig(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRoute53HealthCheckDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccRoute53HealthCheckIpConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoute53HealthCheckExists("aws_route53_health_check.bar"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckRoute53HealthCheckDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_route53_health_check" {
+			continue
+		}
+
+		lopts := &route53.ListHealthChecksInput{}
+		resp, err := conn.ListHealthChecks(lopts)
+		if err != nil {
+			return err
+		}
+		if len(resp.HealthChecks) == 0 {
+			return nil
+		}
+
+		for _, check := range resp.HealthChecks {
+			if *check.ID == rs.Primary.ID {
+				return fmt.Errorf("Record still exists: %#v", check)
+			}
+
+		}
+
+	}
+	return nil
+}
+
+func testAccCheckRoute53HealthCheckExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).r53conn
+
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		fmt.Print(rs.Primary.ID)
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No health check ID is set")
+		}
+
+		lopts := &route53.ListHealthChecksInput{}
+		resp, err := conn.ListHealthChecks(lopts)
+		if err != nil {
+			return err
+		}
+		if len(resp.HealthChecks) == 0 {
+			return fmt.Errorf("Health Check does not exist")
+		}
+
+		for _, check := range resp.HealthChecks {
+			if *check.ID == rs.Primary.ID {
+				return nil
+			}
+
+		}
+		return fmt.Errorf("Health Check does not exist")
+	}
+}
+
+func testUpdateHappened(n string) resource.TestCheckFunc {
+	return nil
+}
+
+const testAccRoute53HealthCheckConfig = `
+resource "aws_route53_health_check" "foo" {
+  fqdn = "dev.notexample.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "2"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
+
+const testAccRoute53HealthCheckConfigUpdate = `
+resource "aws_route53_health_check" "foo" {
+  fqdn = "dev.notexample.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "5"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
+
+const testAccRoute53HealthCheckIpConfig = `
+resource "aws_route53_health_check" "bar" {
+  ip_address = "1.2.3.4"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "2"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+`
diff --git a/builtin/providers/aws/resource_aws_route53_record.go b/builtin/providers/aws/resource_aws_route53_record.go
index e59d8e50e..d4eeafe18 100644
--- a/builtin/providers/aws/resource_aws_route53_record.go
+++ b/builtin/providers/aws/resource_aws_route53_record.go
@@ -11,9 +11,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func resourceAwsRoute53Record() *schema.Resource {
@@ -89,6 +89,16 @@ func resourceAwsRoute53Record() *schema.Resource {
 				Set: resourceAwsRoute53AliasRecordHash,
 			},
 
+			"failover": &schema.Schema{ // PRIMARY | SECONDARY
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"health_check_id": &schema.Schema{ // ID of health check
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
 			"records": &schema.Schema{
 				Type:          schema.TypeSet,
 				ConflictsWith: []string{"alias"},
@@ -209,7 +219,7 @@ func resourceAwsRoute53RecordCreate(d *schema.ResourceData, meta interface{}) er
 		return err
 	}
 
-	return nil
+	return resourceAwsRoute53RecordRead(d, meta)
 }
 
 func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) error {
@@ -232,10 +242,6 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 		StartRecordType: aws.String(d.Get("type").(string)),
 	}
 
-	if v, ok := d.GetOk("set_identifier"); ok {
-		lopts.StartRecordIdentifier = aws.String(v.(string))
-	}
-
 	resp, err := conn.ListResourceRecordSets(lopts)
 	if err != nil {
 		return err
@@ -252,7 +258,7 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 			continue
 		}
 
-		if lopts.StartRecordIdentifier != nil && *record.SetIdentifier != *lopts.StartRecordIdentifier {
+		if record.SetIdentifier != nil && *record.SetIdentifier != d.Get("set_identifier") {
 			continue
 		}
 
@@ -262,9 +268,12 @@ func resourceAwsRoute53RecordRead(d *schema.ResourceData, meta interface{}) erro
 		if err != nil {
 			return fmt.Errorf("[DEBUG] Error setting records for: %s, error: %#v", en, err)
 		}
+
 		d.Set("ttl", record.TTL)
 		d.Set("weight", record.Weight)
 		d.Set("set_identifier", record.SetIdentifier)
+		d.Set("failover", record.Failover)
+		d.Set("health_check_id", record.HealthCheckID)
 
 		break
 	}
@@ -380,6 +389,22 @@ func resourceAwsRoute53RecordBuildSet(d *schema.ResourceData, zoneName string) (
 			HostedZoneID:         aws.String(alias["zone_id"].(string)),
 		}
 		log.Printf("[DEBUG] Creating alias: %#v", alias)
+	} else {
+		if _, ok := d.GetOk("ttl"); !ok {
+			return nil, fmt.Errorf(`provider.aws: aws_route53_record: %s: "ttl": required field is not set`, d.Get("name").(string))
+		}
+
+		if _, ok := d.GetOk("records"); !ok {
+			return nil, fmt.Errorf(`provider.aws: aws_route53_record: %s: "records": required field is not set`, d.Get("name").(string))
+		}
+	}
+
+	if v, ok := d.GetOk("failover"); ok {
+		rec.Failover = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("health_check_id"); ok {
+		rec.HealthCheckID = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("weight"); ok {
diff --git a/builtin/providers/aws/resource_aws_route53_record_test.go b/builtin/providers/aws/resource_aws_route53_record_test.go
index 724b452a8..eaa6abb7a 100644
--- a/builtin/providers/aws/resource_aws_route53_record_test.go
+++ b/builtin/providers/aws/resource_aws_route53_record_test.go
@@ -8,8 +8,8 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func TestCleanRecordName(t *testing.T) {
diff --git a/builtin/providers/aws/resource_aws_route53_zone.go b/builtin/providers/aws/resource_aws_route53_zone.go
index 296dcbacc..3cdd756c6 100644
--- a/builtin/providers/aws/resource_aws_route53_zone.go
+++ b/builtin/providers/aws/resource_aws_route53_zone.go
@@ -10,9 +10,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func resourceAwsRoute53Zone() *schema.Resource {
@@ -32,7 +32,7 @@ func resourceAwsRoute53Zone() *schema.Resource {
 			"comment": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
-				Default: "Managed by Terraform",
+				Default:  "Managed by Terraform",
 			},
 
 			"vpc_id": &schema.Schema{
@@ -53,6 +53,12 @@ func resourceAwsRoute53Zone() *schema.Resource {
 				Computed: true,
 			},
 
+			"delegation_set_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"name_servers": &schema.Schema{
 				Type:     schema.TypeList,
 				Elem:     &schema.Schema{Type: schema.TypeString},
@@ -83,6 +89,10 @@ func resourceAwsRoute53ZoneCreate(d *schema.ResourceData, meta interface{}) erro
 		d.Set("vpc_region", req.VPC.VPCRegion)
 	}
 
+	if v, ok := d.GetOk("delegation_set_id"); ok {
+		req.DelegationSetID = aws.String(v.(string))
+	}
+
 	log.Printf("[DEBUG] Creating Route53 hosted zone: %s", *req.Name)
 	var err error
 	resp, err := r53.CreateHostedZone(req)
@@ -157,6 +167,10 @@ func resourceAwsRoute53ZoneRead(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
+	if zone.DelegationSet != nil && zone.DelegationSet.ID != nil {
+		d.Set("delegation_set_id", cleanDelegationSetId(*zone.DelegationSet.ID))
+	}
+
 	// get tags
 	req := &route53.ListTagsForResourceInput{
 		ResourceID:   aws.String(d.Id()),
@@ -183,7 +197,7 @@ func resourceAwsRoute53ZoneRead(d *schema.ResourceData, meta interface{}) error
 func resourceAwsRoute53ZoneUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).r53conn
 
-	if err := setTagsR53(conn, d); err != nil {
+	if err := setTagsR53(conn, d, "hostedzone"); err != nil {
 		return err
 	} else {
 		d.SetPartial("tags")
diff --git a/builtin/providers/aws/resource_aws_route53_zone_association.go b/builtin/providers/aws/resource_aws_route53_zone_association.go
index 808b92912..1a0f86d7e 100644
--- a/builtin/providers/aws/resource_aws_route53_zone_association.go
+++ b/builtin/providers/aws/resource_aws_route53_zone_association.go
@@ -9,9 +9,9 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func resourceAwsRoute53ZoneAssociation() *schema.Resource {
diff --git a/builtin/providers/aws/resource_aws_route53_zone_association_test.go b/builtin/providers/aws/resource_aws_route53_zone_association_test.go
index 8a734463d..e929d4d31 100644
--- a/builtin/providers/aws/resource_aws_route53_zone_association_test.go
+++ b/builtin/providers/aws/resource_aws_route53_zone_association_test.go
@@ -8,8 +8,8 @@ import (
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func TestAccRoute53ZoneAssociation_basic(t *testing.T) {
diff --git a/builtin/providers/aws/resource_aws_route53_zone_test.go b/builtin/providers/aws/resource_aws_route53_zone_test.go
index 9eb6c0baf..92ab8a217 100644
--- a/builtin/providers/aws/resource_aws_route53_zone_test.go
+++ b/builtin/providers/aws/resource_aws_route53_zone_test.go
@@ -9,8 +9,8 @@ import (
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 )
 
 func TestCleanPrefix(t *testing.T) {
diff --git a/builtin/providers/aws/resource_aws_route_table.go b/builtin/providers/aws/resource_aws_route_table.go
index 26248bac1..e85601c1f 100644
--- a/builtin/providers/aws/resource_aws_route_table.go
+++ b/builtin/providers/aws/resource_aws_route_table.go
@@ -6,9 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -361,7 +361,10 @@ func resourceAwsRouteTableDelete(d *schema.ResourceData, meta interface{}) error
 func resourceAwsRouteTableHash(v interface{}) int {
 	var buf bytes.Buffer
 	m := v.(map[string]interface{})
-	buf.WriteString(fmt.Sprintf("%s-", m["cidr_block"].(string)))
+
+	if v, ok := m["cidr_block"]; ok {
+		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
+	}
 
 	if v, ok := m["gateway_id"]; ok {
 		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
diff --git a/builtin/providers/aws/resource_aws_route_table_association.go b/builtin/providers/aws/resource_aws_route_table_association.go
index 3115363a9..6c63c9e23 100644
--- a/builtin/providers/aws/resource_aws_route_table_association.go
+++ b/builtin/providers/aws/resource_aws_route_table_association.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_route_table_association_test.go b/builtin/providers/aws/resource_aws_route_table_association_test.go
index 19ddaae38..368bc829f 100644
--- a/builtin/providers/aws/resource_aws_route_table_association_test.go
+++ b/builtin/providers/aws/resource_aws_route_table_association_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRouteTableAssociation(t *testing.T) {
+func TestAccAWSRouteTableAssociation_basic(t *testing.T) {
 	var v, v2 ec2.RouteTable
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_route_table_test.go b/builtin/providers/aws/resource_aws_route_table_test.go
index 6020545ed..ff340ae0b 100644
--- a/builtin/providers/aws/resource_aws_route_table_test.go
+++ b/builtin/providers/aws/resource_aws_route_table_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSRouteTable_normal(t *testing.T) {
+func TestAccAWSRouteTable_basic(t *testing.T) {
 	var v ec2.RouteTable
 
 	testCheck := func(*terraform.State) error {
diff --git a/builtin/providers/aws/resource_aws_s3_bucket.go b/builtin/providers/aws/resource_aws_s3_bucket.go
index 1c1de96ed..93bf24390 100644
--- a/builtin/providers/aws/resource_aws_s3_bucket.go
+++ b/builtin/providers/aws/resource_aws_s3_bucket.go
@@ -7,9 +7,9 @@ import (
 
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func resourceAwsS3Bucket() *schema.Resource {
@@ -433,6 +433,13 @@ func websiteEndpoint(s3conn *s3.S3, d *schema.ResourceData) (string, error) {
 
 func WebsiteEndpointUrl(bucket string, region string) string {
 	region = normalizeRegion(region)
+
+	// Frankfurt(and probably future) regions uses different syntax for website endpoints
+	// http://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteEndpoints.html
+	if region == "eu-central-1" {
+		return fmt.Sprintf("%s.s3-website.%s.amazonaws.com", bucket, region)
+	}
+
 	return fmt.Sprintf("%s.s3-website-%s.amazonaws.com", bucket, region)
 }
 
diff --git a/builtin/providers/aws/resource_aws_s3_bucket_test.go b/builtin/providers/aws/resource_aws_s3_bucket_test.go
index 8e601d279..171109559 100644
--- a/builtin/providers/aws/resource_aws_s3_bucket_test.go
+++ b/builtin/providers/aws/resource_aws_s3_bucket_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func TestAccAWSS3Bucket_basic(t *testing.T) {
diff --git a/builtin/providers/aws/resource_aws_security_group.go b/builtin/providers/aws/resource_aws_security_group.go
index 310e478d7..b418a1759 100644
--- a/builtin/providers/aws/resource_aws_security_group.go
+++ b/builtin/providers/aws/resource_aws_security_group.go
@@ -7,9 +7,9 @@ import (
 	"sort"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -28,6 +28,14 @@ func resourceAwsSecurityGroup() *schema.Resource {
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"description": &schema.Schema{
@@ -35,6 +43,14 @@ func resourceAwsSecurityGroup() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 				Default:  "Managed by Terraform",
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					if len(value) > 255 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 255 characters", k))
+					}
+					return
+				},
 			},
 
 			"vpc_id": &schema.Schema{
diff --git a/builtin/providers/aws/resource_aws_security_group_rule.go b/builtin/providers/aws/resource_aws_security_group_rule.go
index 9e8c7c13d..927030b70 100644
--- a/builtin/providers/aws/resource_aws_security_group_rule.go
+++ b/builtin/providers/aws/resource_aws_security_group_rule.go
@@ -7,9 +7,10 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -20,6 +21,9 @@ func resourceAwsSecurityGroupRule() *schema.Resource {
 		Read:   resourceAwsSecurityGroupRuleRead,
 		Delete: resourceAwsSecurityGroupRuleDelete,
 
+		SchemaVersion: 1,
+		MigrateState:  resourceAwsSecurityGroupRuleMigrateState,
+
 		Schema: map[string]*schema.Schema{
 			"type": &schema.Schema{
 				Type:        schema.TypeString,
@@ -60,10 +64,11 @@ func resourceAwsSecurityGroupRule() *schema.Resource {
 			},
 
 			"source_security_group_id": &schema.Schema{
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Computed: true,
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				Computed:      true,
+				ConflictsWith: []string{"cidr_blocks"},
 			},
 
 			"self": &schema.Schema{
@@ -82,17 +87,18 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 	sg, err := findResourceSecurityGroup(conn, sg_id)
 
 	if err != nil {
-		return fmt.Errorf("sorry")
+		return err
 	}
 
 	perm := expandIPPerm(d, sg)
 
 	ruleType := d.Get("type").(string)
 
+	var autherr error
 	switch ruleType {
 	case "ingress":
-		log.Printf("[DEBUG] Authorizing security group %s %s rule: %#v",
-			sg_id, "Ingress", perm)
+		log.Printf("[DEBUG] Authorizing security group %s %s rule: %s",
+			sg_id, "Ingress", awsutil.StringValue(perm))
 
 		req := &ec2.AuthorizeSecurityGroupIngressInput{
 			GroupID:       sg.GroupID,
@@ -104,13 +110,7 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 			req.GroupName = sg.GroupName
 		}
 
-		_, err := conn.AuthorizeSecurityGroupIngress(req)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error authorizing security group %s rules: %s",
-				"rules", err)
-		}
+		_, autherr = conn.AuthorizeSecurityGroupIngress(req)
 
 	case "egress":
 		log.Printf("[DEBUG] Authorizing security group %s %s rule: %#v",
@@ -121,18 +121,28 @@ func resourceAwsSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}
 			IPPermissions: []*ec2.IPPermission{perm},
 		}
 
-		_, err = conn.AuthorizeSecurityGroupEgress(req)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error authorizing security group %s rules: %s",
-				"rules", err)
-		}
+		_, autherr = conn.AuthorizeSecurityGroupEgress(req)
 
 	default:
 		return fmt.Errorf("Security Group Rule must be type 'ingress' or type 'egress'")
 	}
 
+	if autherr != nil {
+		if awsErr, ok := autherr.(awserr.Error); ok {
+			if awsErr.Code() == "InvalidPermission.Duplicate" {
+				return fmt.Errorf(`[WARN] A duplicate Security Group rule was found. This may be
+a side effect of a now-fixed Terraform issue causing two security groups with
+identical attributes but different source_security_group_ids to overwrite each
+other in the state. See https://github.com/hashicorp/terraform/pull/2376 for more
+information and instructions for recovery. Error message: %s`, awsErr.Message())
+			}
+		}
+
+		return fmt.Errorf(
+			"Error authorizing security group rule type %s: %s",
+			ruleType, autherr)
+	}
+
 	d.SetId(ipPermissionIDHash(ruleType, perm))
 
 	return resourceAwsSecurityGroupRuleRead(d, meta)
@@ -195,15 +205,15 @@ func resourceAwsSecurityGroupRuleDelete(d *schema.ResourceData, meta interface{}
 	sg, err := findResourceSecurityGroup(conn, sg_id)
 
 	if err != nil {
-		return fmt.Errorf("sorry")
+		return err
 	}
 
 	perm := expandIPPerm(d, sg)
 	ruleType := d.Get("type").(string)
 	switch ruleType {
 	case "ingress":
-		log.Printf("[DEBUG] Revoking security group %#v %s rule: %#v",
-			sg_id, "ingress", perm)
+		log.Printf("[DEBUG] Revoking rule (%s) from security group %s:\n%s",
+			"ingress", sg_id, awsutil.StringValue(perm))
 		req := &ec2.RevokeSecurityGroupIngressInput{
 			GroupID:       sg.GroupID,
 			IPPermissions: []*ec2.IPPermission{perm},
@@ -245,32 +255,43 @@ func findResourceSecurityGroup(conn *ec2.EC2, id string) (*ec2.SecurityGroup, er
 	}
 	resp, err := conn.DescribeSecurityGroups(req)
 	if err != nil {
-		if ec2err, ok := err.(awserr.Error); ok {
-			if ec2err.Code() == "InvalidSecurityGroupID.NotFound" ||
-				ec2err.Code() == "InvalidGroup.NotFound" {
-				resp = nil
-				err = nil
-			}
-		}
-
-		if err != nil {
-			log.Printf("Error on findResourceSecurityGroup: %s", err)
-			return nil, err
-		}
+		return nil, err
+	}
+	if resp == nil || len(resp.SecurityGroups) != 1 || resp.SecurityGroups[0] == nil {
+		return nil, fmt.Errorf(
+			"Expected to find one security group with ID %q, got: %#v",
+			id, resp.SecurityGroups)
 	}
 
 	return resp.SecurityGroups[0], nil
 }
 
+// ByGroupPair implements sort.Interface for []*ec2.UserIDGroupPairs based on
+// GroupID or GroupName field (only one should be set).
+type ByGroupPair []*ec2.UserIDGroupPair
+
+func (b ByGroupPair) Len() int      { return len(b) }
+func (b ByGroupPair) Swap(i, j int) { b[i], b[j] = b[j], b[i] }
+func (b ByGroupPair) Less(i, j int) bool {
+	if b[i].GroupID != nil && b[j].GroupID != nil {
+		return *b[i].GroupID < *b[j].GroupID
+	}
+	if b[i].GroupName != nil && b[j].GroupName != nil {
+		return *b[i].GroupName < *b[j].GroupName
+	}
+
+	panic("mismatched security group rules, may be a terraform bug")
+}
+
 func ipPermissionIDHash(ruleType string, ip *ec2.IPPermission) string {
 	var buf bytes.Buffer
-	// for egress rules, an TCP rule of -1 is automatically added, in which case
-	// the to and from ports will be nil. We don't record this rule locally.
-	if ip.IPProtocol != nil && *ip.IPProtocol != "-1" {
+	if ip.FromPort != nil && *ip.FromPort > 0 {
 		buf.WriteString(fmt.Sprintf("%d-", *ip.FromPort))
-		buf.WriteString(fmt.Sprintf("%d-", *ip.ToPort))
-		buf.WriteString(fmt.Sprintf("%s-", *ip.IPProtocol))
 	}
+	if ip.ToPort != nil && *ip.ToPort > 0 {
+		buf.WriteString(fmt.Sprintf("%d-", *ip.ToPort))
+	}
+	buf.WriteString(fmt.Sprintf("%s-", *ip.IPProtocol))
 	buf.WriteString(fmt.Sprintf("%s-", ruleType))
 
 	// We need to make sure to sort the strings below so that we always
@@ -287,6 +308,22 @@ func ipPermissionIDHash(ruleType string, ip *ec2.IPPermission) string {
 		}
 	}
 
+	if len(ip.UserIDGroupPairs) > 0 {
+		sort.Sort(ByGroupPair(ip.UserIDGroupPairs))
+		for _, pair := range ip.UserIDGroupPairs {
+			if pair.GroupID != nil {
+				buf.WriteString(fmt.Sprintf("%s-", *pair.GroupID))
+			} else {
+				buf.WriteString("-")
+			}
+			if pair.GroupName != nil {
+				buf.WriteString(fmt.Sprintf("%s-", *pair.GroupName))
+			} else {
+				buf.WriteString("-")
+			}
+		}
+	}
+
 	return fmt.Sprintf("sg-%d", hashcode.String(buf.String()))
 }
 
@@ -297,22 +334,29 @@ func expandIPPerm(d *schema.ResourceData, sg *ec2.SecurityGroup) *ec2.IPPermissi
 	perm.ToPort = aws.Long(int64(d.Get("to_port").(int)))
 	perm.IPProtocol = aws.String(d.Get("protocol").(string))
 
-	var groups []string
+	// build a group map that behaves like a set
+	groups := make(map[string]bool)
 	if raw, ok := d.GetOk("source_security_group_id"); ok {
-		groups = append(groups, raw.(string))
+		groups[raw.(string)] = true
 	}
 
 	if v, ok := d.GetOk("self"); ok && v.(bool) {
 		if sg.VPCID != nil && *sg.VPCID != "" {
-			groups = append(groups, *sg.GroupID)
+			groups[*sg.GroupID] = true
 		} else {
-			groups = append(groups, *sg.GroupName)
+			groups[*sg.GroupName] = true
 		}
 	}
 
 	if len(groups) > 0 {
 		perm.UserIDGroupPairs = make([]*ec2.UserIDGroupPair, len(groups))
-		for i, name := range groups {
+		// build string list of group name/ids
+		var gl []string
+		for k, _ := range groups {
+			gl = append(gl, k)
+		}
+
+		for i, name := range gl {
 			ownerId, id := "", name
 			if items := strings.Split(id, "/"); len(items) > 1 {
 				ownerId, id = items[0], items[1]
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_migrate.go b/builtin/providers/aws/resource_aws_security_group_rule_migrate.go
new file mode 100644
index 000000000..30eb8c09f
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_security_group_rule_migrate.go
@@ -0,0 +1,101 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func resourceAwsSecurityGroupRuleMigrateState(
+	v int, is *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+	switch v {
+	case 0:
+		log.Println("[INFO] Found AWS Security Group State v0; migrating to v1")
+		return migrateSGRuleStateV0toV1(is)
+	default:
+		return is, fmt.Errorf("Unexpected schema version: %d", v)
+	}
+
+	return is, nil
+}
+
+func migrateSGRuleStateV0toV1(is *terraform.InstanceState) (*terraform.InstanceState, error) {
+	if is.Empty() {
+		log.Println("[DEBUG] Empty InstanceState; nothing to migrate.")
+		return is, nil
+	}
+
+	perm, err := migrateExpandIPPerm(is.Attributes)
+
+	if err != nil {
+		return nil, fmt.Errorf("[WARN] Error making new IP Permission in Security Group migration")
+	}
+
+	log.Printf("[DEBUG] Attributes before migration: %#v", is.Attributes)
+	newID := ipPermissionIDHash(is.Attributes["type"], perm)
+	is.Attributes["id"] = newID
+	is.ID = newID
+	log.Printf("[DEBUG] Attributes after migration: %#v, new id: %s", is.Attributes, newID)
+	return is, nil
+}
+
+func migrateExpandIPPerm(attrs map[string]string) (*ec2.IPPermission, error) {
+	var perm ec2.IPPermission
+	tp, err := strconv.Atoi(attrs["to_port"])
+	if err != nil {
+		return nil, fmt.Errorf("Error converting to_port in Security Group migration")
+	}
+
+	fp, err := strconv.Atoi(attrs["from_port"])
+	if err != nil {
+		return nil, fmt.Errorf("Error converting from_port in Security Group migration")
+	}
+
+	perm.ToPort = aws.Long(int64(tp))
+	perm.FromPort = aws.Long(int64(fp))
+	perm.IPProtocol = aws.String(attrs["protocol"])
+
+	groups := make(map[string]bool)
+	if attrs["self"] == "true" {
+		groups[attrs["security_group_id"]] = true
+	}
+
+	if attrs["source_security_group_id"] != "" {
+		groups[attrs["source_security_group_id"]] = true
+	}
+
+	if len(groups) > 0 {
+		perm.UserIDGroupPairs = make([]*ec2.UserIDGroupPair, len(groups))
+		// build string list of group name/ids
+		var gl []string
+		for k, _ := range groups {
+			gl = append(gl, k)
+		}
+
+		for i, name := range gl {
+			perm.UserIDGroupPairs[i] = &ec2.UserIDGroupPair{
+				GroupID: aws.String(name),
+			}
+		}
+	}
+
+	var cb []string
+	for k, v := range attrs {
+		if k != "cidr_blocks.#" && strings.HasPrefix(k, "cidr_blocks") {
+			cb = append(cb, v)
+		}
+	}
+	if len(cb) > 0 {
+		perm.IPRanges = make([]*ec2.IPRange, len(cb))
+		for i, v := range cb {
+			perm.IPRanges[i] = &ec2.IPRange{CIDRIP: aws.String(v)}
+		}
+	}
+
+	return &perm, nil
+}
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go b/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go
new file mode 100644
index 000000000..664f05039
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_security_group_rule_migrate_test.go
@@ -0,0 +1,67 @@
+package aws
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAWSSecurityGroupRuleMigrateState(t *testing.T) {
+	cases := map[string]struct {
+		StateVersion int
+		ID           string
+		Attributes   map[string]string
+		Expected     string
+		Meta         interface{}
+	}{
+		"v0_1": {
+			StateVersion: 0,
+			ID:           "sg-4235098228",
+			Attributes: map[string]string{
+				"self":                     "false",
+				"to_port":                  "0",
+				"security_group_id":        "sg-13877277",
+				"cidr_blocks.#":            "0",
+				"type":                     "ingress",
+				"protocol":                 "-1",
+				"from_port":                "0",
+				"source_security_group_id": "sg-11877275",
+			},
+			Expected: "sg-3766347571",
+		},
+		"v0_2": {
+			StateVersion: 0,
+			ID:           "sg-1021609891",
+			Attributes: map[string]string{
+				"security_group_id": "sg-0981746d",
+				"from_port":         "0",
+				"to_port":           "0",
+				"type":              "ingress",
+				"self":              "false",
+				"protocol":          "-1",
+				"cidr_blocks.0":     "172.16.1.0/24",
+				"cidr_blocks.1":     "172.16.2.0/24",
+				"cidr_blocks.2":     "172.16.3.0/24",
+				"cidr_blocks.3":     "172.16.4.0/24",
+				"cidr_blocks.#":     "4"},
+			Expected: "sg-4100229787",
+		},
+	}
+
+	for tn, tc := range cases {
+		is := &terraform.InstanceState{
+			ID:         tc.ID,
+			Attributes: tc.Attributes,
+		}
+		is, err := resourceAwsSecurityGroupRuleMigrateState(
+			tc.StateVersion, is, tc.Meta)
+
+		if err != nil {
+			t.Fatalf("bad: %s, err: %#v", tn, err)
+		}
+
+		if is.ID != tc.Expected {
+			t.Fatalf("bad sg rule id: %s\n\n expected: %s", is.ID, tc.Expected)
+		}
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_security_group_rule_test.go b/builtin/providers/aws/resource_aws_security_group_rule_test.go
index e02694ab0..595886e18 100644
--- a/builtin/providers/aws/resource_aws_security_group_rule_test.go
+++ b/builtin/providers/aws/resource_aws_security_group_rule_test.go
@@ -5,9 +5,10 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -44,6 +45,46 @@ func TestIpPermissionIDHash(t *testing.T) {
 		},
 	}
 
+	vpc_security_group_source := &ec2.IPPermission{
+		IPProtocol: aws.String("tcp"),
+		FromPort:   aws.Long(int64(80)),
+		ToPort:     aws.Long(int64(8000)),
+		UserIDGroupPairs: []*ec2.UserIDGroupPair{
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("987654321"),
+				GroupID: aws.String("sg-12345678"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("123456789"),
+				GroupID: aws.String("sg-987654321"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:  aws.String("123456789"),
+				GroupID: aws.String("sg-12345678"),
+			},
+		},
+	}
+
+	security_group_source := &ec2.IPPermission{
+		IPProtocol: aws.String("tcp"),
+		FromPort:   aws.Long(int64(80)),
+		ToPort:     aws.Long(int64(8000)),
+		UserIDGroupPairs: []*ec2.UserIDGroupPair{
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("987654321"),
+				GroupName: aws.String("my-security-group"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("123456789"),
+				GroupName: aws.String("my-security-group"),
+			},
+			&ec2.UserIDGroupPair{
+				UserID:    aws.String("123456789"),
+				GroupName: aws.String("my-other-security-group"),
+			},
+		},
+	}
+
 	// hardcoded hashes, to detect future change
 	cases := []struct {
 		Input  *ec2.IPPermission
@@ -52,13 +93,15 @@ func TestIpPermissionIDHash(t *testing.T) {
 	}{
 		{simple, "ingress", "sg-82613597"},
 		{egress, "egress", "sg-363054720"},
-		{egress_all, "egress", "sg-857124156"},
+		{egress_all, "egress", "sg-2766285362"},
+		{vpc_security_group_source, "egress", "sg-2661404947"},
+		{security_group_source, "egress", "sg-1841245863"},
 	}
 
 	for _, tc := range cases {
 		actual := ipPermissionIDHash(tc.Type, tc.Input)
 		if actual != tc.Output {
-			t.Fatalf("input: %s - %#v\noutput: %s", tc.Type, tc.Input, actual)
+			t.Errorf("input: %s - %s\noutput: %s", tc.Type, awsutil.StringValue(tc.Input), actual)
 		}
 	}
 }
@@ -141,9 +184,9 @@ func TestAccAWSSecurityGroupRule_MultiIngress(t *testing.T) {
 	var group ec2.SecurityGroup
 
 	testMultiRuleCount := func(*terraform.State) error {
-		if len(group.IPPermissions) != 3 {
+		if len(group.IPPermissions) != 2 {
 			return fmt.Errorf("Wrong Security Group rule count, expected %d, got %d",
-				3, len(group.IPPermissions))
+				2, len(group.IPPermissions))
 		}
 
 		var rule *ec2.IPPermission
@@ -196,6 +239,24 @@ func TestAccAWSSecurityGroupRule_Egress(t *testing.T) {
 	})
 }
 
+func TestAccAWSSecurityGroupRule_SelfReference(t *testing.T) {
+	var group ec2.SecurityGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSecurityGroupRuleConfigSelfReference,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSSecurityGroupRuleDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ec2conn
 
@@ -377,7 +438,6 @@ resource "aws_security_group_rule" "ingress_1" {
   cidr_blocks = ["10.0.0.0/8"]
 
   security_group_id = "${aws_security_group.web.id}"
-        source_security_group_id = "${aws_security_group.worker.id}"
 }
 
 resource "aws_security_group_rule" "ingress_2" {
@@ -390,3 +450,34 @@ resource "aws_security_group_rule" "ingress_2" {
   security_group_id = "${aws_security_group.web.id}"
 }
 `
+
+// check for GH-1985 regression
+const testAccAWSSecurityGroupRuleConfigSelfReference = `
+provider "aws" {
+  region = "us-west-2"
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+  tags {
+    Name = "sg-self-test"
+  }
+}
+
+resource "aws_security_group" "web" {
+  name = "main"
+  vpc_id = "${aws_vpc.main.id}"
+  tags {
+    Name = "sg-self-test"
+  }
+}
+
+resource "aws_security_group_rule" "self" {
+  type = "ingress"
+  protocol = "-1"
+  from_port = 0
+  to_port = 0
+  self = true
+  security_group_id = "${aws_security_group.web.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_security_group_test.go b/builtin/providers/aws/resource_aws_security_group_test.go
index e0e138cd8..d3a55da5a 100644
--- a/builtin/providers/aws/resource_aws_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_security_group_test.go
@@ -6,14 +6,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSSecurityGroup_normal(t *testing.T) {
+func TestAccAWSSecurityGroup_basic(t *testing.T) {
 	var group ec2.SecurityGroup
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_sns_topic.go b/builtin/providers/aws/resource_aws_sns_topic.go
new file mode 100644
index 000000000..33be03058
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic.go
@@ -0,0 +1,152 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sns"
+)
+
+// Mutable attributes
+var SNSAttributeMap = map[string]string{
+	"display_name":    "DisplayName",
+	"policy":          "Policy",
+	"delivery_policy": "DeliveryPolicy",
+}
+
+func resourceAwsSnsTopic() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSnsTopicCreate,
+		Read:   resourceAwsSnsTopicRead,
+		Update: resourceAwsSnsTopicUpdate,
+		Delete: resourceAwsSnsTopicDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"display_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+				Computed: true,
+			},
+			"delivery_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSnsTopicCreate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	name := d.Get("name").(string)
+
+	log.Printf("[DEBUG] SNS create topic: %s", name)
+
+	req := &sns.CreateTopicInput{
+		Name: aws.String(name),
+	}
+
+	output, err := snsconn.CreateTopic(req)
+	if err != nil {
+		return fmt.Errorf("Error creating SNS topic: %s", err)
+	}
+
+	d.SetId(*output.TopicARN)
+
+	// Write the ARN to the 'arn' field for export
+	d.Set("arn", *output.TopicARN)
+
+	return resourceAwsSnsTopicUpdate(d, meta)
+}
+
+func resourceAwsSnsTopicUpdate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	resource := *resourceAwsSnsTopic()
+
+	for k, _ := range resource.Schema {
+		if attrKey, ok := SNSAttributeMap[k]; ok {
+			if d.HasChange(k) {
+				log.Printf("[DEBUG] Updating %s", attrKey)
+				_, n := d.GetChange(k)
+				// Ignore an empty policy
+				if !(k == "policy" && n == "") {
+					// Make API call to update attributes
+					req := &sns.SetTopicAttributesInput{
+						TopicARN:       aws.String(d.Id()),
+						AttributeName:  aws.String(attrKey),
+						AttributeValue: aws.String(n.(string)),
+					}
+					snsconn.SetTopicAttributes(req)
+				}
+			}
+		}
+	}
+
+	return resourceAwsSnsTopicRead(d, meta)
+}
+
+func resourceAwsSnsTopicRead(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	attributeOutput, err := snsconn.GetTopicAttributes(&sns.GetTopicAttributesInput{
+		TopicARN: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrmap := attributeOutput.Attributes
+		resource := *resourceAwsSnsTopic()
+		// iKey = internal struct key, oKey = AWS Attribute Map key
+		for iKey, oKey := range SNSAttributeMap {
+			log.Printf("[DEBUG] Updating %s => %s", iKey, oKey)
+
+			if attrmap[oKey] != nil {
+				// Some of the fetched attributes are stateful properties such as
+				// the number of subscriptions, the owner, etc. skip those
+				if resource.Schema[iKey] != nil {
+					value := *attrmap[oKey]
+					log.Printf("[DEBUG] Updating %s => %s -> %s", iKey, oKey, value)
+					d.Set(iKey, *attrmap[oKey])
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func resourceAwsSnsTopicDelete(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] SNS Delete Topic: %s", d.Id())
+	_, err := snsconn.DeleteTopic(&sns.DeleteTopicInput{
+		TopicARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/builtin/providers/aws/resource_aws_sns_topic_subscription.go b/builtin/providers/aws/resource_aws_sns_topic_subscription.go
new file mode 100644
index 000000000..01926e895
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_subscription.go
@@ -0,0 +1,180 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sns"
+)
+
+func resourceAwsSnsTopicSubscription() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSnsTopicSubscriptionCreate,
+		Read:   resourceAwsSnsTopicSubscriptionRead,
+		Update: resourceAwsSnsTopicSubscriptionUpdate,
+		Delete: resourceAwsSnsTopicSubscriptionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"protocol": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"endpoint": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"topic_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: false,
+			},
+			"delivery_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"raw_message_delivery": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: false,
+				Default:  false,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSnsTopicSubscriptionCreate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	if d.Get("protocol") == "email" {
+		return fmt.Errorf("Email endpoints are not supported!")
+	}
+
+	output, err := subscribeToSNSTopic(d, snsconn)
+
+	if err != nil {
+		return err
+	}
+
+	log.Printf("New subscription ARN: %s", *output.SubscriptionARN)
+	d.SetId(*output.SubscriptionARN)
+
+	// Write the ARN to the 'arn' field for export
+	d.Set("arn", *output.SubscriptionARN)
+
+	return resourceAwsSnsTopicSubscriptionUpdate(d, meta)
+}
+
+func resourceAwsSnsTopicSubscriptionUpdate(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	// If any changes happened, un-subscribe and re-subscribe
+	if d.HasChange("protocol") || d.HasChange("endpoint") || d.HasChange("topic_arn") {
+		log.Printf("[DEBUG] Updating subscription %s", d.Id())
+		// Unsubscribe
+		_, err := snsconn.Unsubscribe(&sns.UnsubscribeInput{
+			SubscriptionARN: aws.String(d.Id()),
+		})
+
+		if err != nil {
+			return fmt.Errorf("Error unsubscribing from SNS topic: %s", err)
+		}
+
+		// Re-subscribe and set id
+		output, err := subscribeToSNSTopic(d, snsconn)
+		d.SetId(*output.SubscriptionARN)
+
+	}
+
+	if d.HasChange("raw_message_delivery") {
+		_, n := d.GetChange("raw_message_delivery")
+
+		attrValue := "false"
+
+		if n.(bool) {
+			attrValue = "true"
+		}
+
+		req := &sns.SetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(d.Id()),
+			AttributeName:   aws.String("RawMessageDelivery"),
+			AttributeValue:  aws.String(attrValue),
+		}
+		_, err := snsconn.SetSubscriptionAttributes(req)
+
+		if err != nil {
+			return fmt.Errorf("Unable to set raw message delivery attribute on subscription")
+		}
+	}
+
+	return resourceAwsSnsTopicSubscriptionRead(d, meta)
+}
+
+func resourceAwsSnsTopicSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] Loading subscription %s", d.Id())
+
+	attributeOutput, err := snsconn.GetSubscriptionAttributes(&sns.GetSubscriptionAttributesInput{
+		SubscriptionARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrHash := attributeOutput.Attributes
+		log.Printf("[DEBUG] raw message delivery: %s", *attrHash["RawMessageDelivery"])
+		if *attrHash["RawMessageDelivery"] == "true" {
+			d.Set("raw_message_delivery", true)
+		} else {
+			d.Set("raw_message_delivery", false)
+		}
+	}
+
+	return nil
+}
+
+func resourceAwsSnsTopicSubscriptionDelete(d *schema.ResourceData, meta interface{}) error {
+	snsconn := meta.(*AWSClient).snsconn
+
+	log.Printf("[DEBUG] SNS delete topic subscription: %s", d.Id())
+	_, err := snsconn.Unsubscribe(&sns.UnsubscribeInput{
+		SubscriptionARN: aws.String(d.Id()),
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func subscribeToSNSTopic(d *schema.ResourceData, snsconn *sns.SNS) (output *sns.SubscribeOutput, err error) {
+	protocol := d.Get("protocol").(string)
+	endpoint := d.Get("endpoint").(string)
+	topic_arn := d.Get("topic_arn").(string)
+
+	log.Printf("[DEBUG] SNS create topic subscription: %s (%s) @ '%s'", endpoint, protocol, topic_arn)
+
+	req := &sns.SubscribeInput{
+		Protocol: aws.String(protocol),
+		Endpoint: aws.String(endpoint),
+		TopicARN: aws.String(topic_arn),
+	}
+
+	output, err = snsconn.Subscribe(req)
+	if err != nil {
+		return nil, fmt.Errorf("Error creating SNS topic: %s", err)
+	}
+
+	log.Printf("[DEBUG] Created new subscription!")
+	return output, nil
+}
diff --git a/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go b/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go
new file mode 100644
index 000000000..fce5485fe
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_subscription_test.go
@@ -0,0 +1,100 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSNSTopicSubscription_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSNSTopicSubscriptionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSNSTopicSubscriptionConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSNSTopicExists("aws_sns_topic.test_topic"),
+					testAccCheckAWSSNSTopicSubscriptionExists("aws_sns_topic_subscription.test_subscription"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSNSTopicSubscriptionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sns_topic" {
+			continue
+		}
+
+		// Try to find key pair
+		req := &sns.GetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(rs.Primary.ID),
+		}
+
+		_, err := conn.GetSubscriptionAttributes(req)
+
+		if err == nil {
+			return fmt.Errorf("Subscription still exists, can't continue.")
+		}
+
+		// Verify the error is an API error, not something else
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSNSTopicSubscriptionExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS subscription with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+		params := &sns.GetSubscriptionAttributesInput{
+			SubscriptionARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetSubscriptionAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSSNSTopicSubscriptionConfig = `
+resource "aws_sns_topic" "test_topic" {
+    name = "terraform-test-topic"
+}
+
+resource "aws_sqs_queue" "test_queue" {
+	name = "terraform-subscription-test-queue"
+}
+
+resource "aws_sns_topic_subscription" "test_subscription" {
+    topic_arn = "${aws_sns_topic.test_topic.arn}"
+    protocol = "sqs"
+    endpoint = "${aws_sqs_queue.test_queue.arn}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_sns_topic_test.go b/builtin/providers/aws/resource_aws_sns_topic_test.go
new file mode 100644
index 000000000..3cbe324f3
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_sns_topic_test.go
@@ -0,0 +1,87 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sns"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSNSTopic_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSNSTopicDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSNSTopicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSNSTopicExists("aws_sns_topic.test_topic"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSNSTopicDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sns_topic" {
+			continue
+		}
+
+		// Check if the topic exists by fetching its attributes
+		params := &sns.GetTopicAttributesInput{
+			TopicARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetTopicAttributes(params)
+		if err == nil {
+			return fmt.Errorf("Topic exists when it should be destroyed!")
+		}
+
+		// Verify the error is an API error, not something else
+		_, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSNSTopicExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS topic with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).snsconn
+
+		params := &sns.GetTopicAttributesInput{
+			TopicARN: aws.String(rs.Primary.ID),
+		}
+		_, err := conn.GetTopicAttributes(params)
+
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
+const testAccAWSSNSTopicConfig = `
+resource "aws_sns_topic" "test_topic" {
+    name = "terraform-test-topic"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_spot_instance_request.go b/builtin/providers/aws/resource_aws_spot_instance_request.go
new file mode 100644
index 000000000..d37ef8a34
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_spot_instance_request.go
@@ -0,0 +1,242 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsSpotInstanceRequest() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSpotInstanceRequestCreate,
+		Read:   resourceAwsSpotInstanceRequestRead,
+		Delete: resourceAwsSpotInstanceRequestDelete,
+		Update: resourceAwsSpotInstanceRequestUpdate,
+
+		Schema: func() map[string]*schema.Schema {
+			// The Spot Instance Request Schema is based on the AWS Instance schema.
+			s := resourceAwsInstance().Schema
+
+			// Everything on a spot instance is ForceNew except tags
+			for k, v := range s {
+				if k == "tags" {
+					continue
+				}
+				v.ForceNew = true
+			}
+
+			s["spot_price"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			}
+			s["wait_for_fulfillment"] = &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			}
+			s["spot_bid_status"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+			s["spot_request_state"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+			s["spot_instance_id"] = &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			}
+
+			return s
+		}(),
+	}
+}
+
+func resourceAwsSpotInstanceRequestCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	instanceOpts, err := buildAwsInstanceOpts(d, meta)
+	if err != nil {
+		return err
+	}
+
+	spotOpts := &ec2.RequestSpotInstancesInput{
+		SpotPrice: aws.String(d.Get("spot_price").(string)),
+
+		// We always set the type to "persistent", since the imperative-like
+		// behavior of "one-time" does not map well to TF's declarative domain.
+		Type: aws.String("persistent"),
+
+		// Though the AWS API supports creating spot instance requests for multiple
+		// instances, for TF purposes we fix this to one instance per request.
+		// Users can get equivalent behavior out of TF's "count" meta-parameter.
+		InstanceCount: aws.Long(1),
+
+		LaunchSpecification: &ec2.RequestSpotLaunchSpecification{
+			BlockDeviceMappings: instanceOpts.BlockDeviceMappings,
+			EBSOptimized:        instanceOpts.EBSOptimized,
+			Monitoring:          instanceOpts.Monitoring,
+			IAMInstanceProfile:  instanceOpts.IAMInstanceProfile,
+			ImageID:             instanceOpts.ImageID,
+			InstanceType:        instanceOpts.InstanceType,
+			Placement:           instanceOpts.SpotPlacement,
+			SecurityGroupIDs:    instanceOpts.SecurityGroupIDs,
+			SecurityGroups:      instanceOpts.SecurityGroups,
+			UserData:            instanceOpts.UserData64,
+		},
+	}
+
+	// Make the spot instance request
+	log.Printf("[DEBUG] Requesting spot bid opts: %s", awsutil.StringValue(spotOpts))
+	resp, err := conn.RequestSpotInstances(spotOpts)
+	if err != nil {
+		return fmt.Errorf("Error requesting spot instances: %s", err)
+	}
+	if len(resp.SpotInstanceRequests) != 1 {
+		return fmt.Errorf(
+			"Expected response with length 1, got: %s", awsutil.StringValue(resp))
+	}
+
+	sir := *resp.SpotInstanceRequests[0]
+	d.SetId(*sir.SpotInstanceRequestID)
+
+	if d.Get("wait_for_fulfillment").(bool) {
+		spotStateConf := &resource.StateChangeConf{
+			// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html
+			Pending:    []string{"start", "pending-evaluation", "pending-fulfillment"},
+			Target:     "fulfilled",
+			Refresh:    SpotInstanceStateRefreshFunc(conn, sir),
+			Timeout:    10 * time.Minute,
+			Delay:      10 * time.Second,
+			MinTimeout: 3 * time.Second,
+		}
+
+		log.Printf("[DEBUG] waiting for spot bid to resolve... this may take several minutes.")
+		_, err = spotStateConf.WaitForState()
+
+		if err != nil {
+			return fmt.Errorf("Error while waiting for spot request (%s) to resolve: %s", awsutil.StringValue(sir), err)
+		}
+	}
+
+	return resourceAwsSpotInstanceRequestUpdate(d, meta)
+}
+
+// Update spot state, etc
+func resourceAwsSpotInstanceRequestRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	req := &ec2.DescribeSpotInstanceRequestsInput{
+		SpotInstanceRequestIDs: []*string{aws.String(d.Id())},
+	}
+	resp, err := conn.DescribeSpotInstanceRequests(req)
+
+	if err != nil {
+		// If the spot request was not found, return nil so that we can show
+		// that it is gone.
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSpotInstanceRequestID.NotFound" {
+			d.SetId("")
+			return nil
+		}
+
+		// Some other error, report it
+		return err
+	}
+
+	// If nothing was found, then return no state
+	if len(resp.SpotInstanceRequests) == 0 {
+		d.SetId("")
+		return nil
+	}
+
+	request := resp.SpotInstanceRequests[0]
+
+	// if the request is cancelled, then it is gone
+	if *request.State == "canceled" {
+		d.SetId("")
+		return nil
+	}
+
+	d.Set("spot_bid_status", *request.Status.Code)
+	d.Set("spot_instance_id", *request.InstanceID)
+	d.Set("spot_request_state", *request.State)
+	d.Set("tags", tagsToMap(request.Tags))
+
+	return nil
+}
+
+func resourceAwsSpotInstanceRequestUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	d.Partial(true)
+	if err := setTags(conn, d); err != nil {
+		return err
+	} else {
+		d.SetPartial("tags")
+	}
+
+	d.Partial(false)
+
+	return resourceAwsSpotInstanceRequestRead(d, meta)
+}
+
+func resourceAwsSpotInstanceRequestDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	log.Printf("[INFO] Cancelling spot request: %s", d.Id())
+	_, err := conn.CancelSpotInstanceRequests(&ec2.CancelSpotInstanceRequestsInput{
+		SpotInstanceRequestIDs: []*string{aws.String(d.Id())},
+	})
+
+	if err != nil {
+		return fmt.Errorf("Error cancelling spot request (%s): %s", d.Id(), err)
+	}
+
+	if instanceId := d.Get("spot_instance_id").(string); instanceId != "" {
+		log.Printf("[INFO] Terminating instance: %s", instanceId)
+		if err := awsTerminateInstance(conn, instanceId); err != nil {
+			return fmt.Errorf("Error terminating spot instance: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// SpotInstanceStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
+// an EC2 spot instance request
+func SpotInstanceStateRefreshFunc(
+	conn *ec2.EC2, sir ec2.SpotInstanceRequest) resource.StateRefreshFunc {
+
+	return func() (interface{}, string, error) {
+		resp, err := conn.DescribeSpotInstanceRequests(&ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{sir.SpotInstanceRequestID},
+		})
+
+		if err != nil {
+			if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidSpotInstanceRequestID.NotFound" {
+				// Set this to nil as if we didn't find anything.
+				resp = nil
+			} else {
+				log.Printf("Error on StateRefresh: %s", err)
+				return nil, "", err
+			}
+		}
+
+		if resp == nil || len(resp.SpotInstanceRequests) == 0 {
+			// Sometimes AWS just has consistency issues and doesn't see
+			// our request yet. Return an empty state.
+			return nil, "", nil
+		}
+
+		req := resp.SpotInstanceRequests[0]
+		return req, *req.Status.Code, nil
+	}
+}
diff --git a/builtin/providers/aws/resource_aws_spot_instance_request_test.go b/builtin/providers/aws/resource_aws_spot_instance_request_test.go
new file mode 100644
index 000000000..0524f3257
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_spot_instance_request_test.go
@@ -0,0 +1,158 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSSpotInstanceRequest_basic(t *testing.T) {
+	var sir ec2.SpotInstanceRequest
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSpotInstanceRequestDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSSpotInstanceRequestConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSpotInstanceRequestExists(
+						"aws_spot_instance_request.foo", &sir),
+					testAccCheckAWSSpotInstanceRequestAttributes(&sir),
+					resource.TestCheckResourceAttr(
+						"aws_spot_instance_request.foo", "spot_bid_status", "fulfilled"),
+					resource.TestCheckResourceAttr(
+						"aws_spot_instance_request.foo", "spot_request_state", "active"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSpotInstanceRequestDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_spot_instance_request" {
+			continue
+		}
+
+		req := &ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{aws.String(rs.Primary.ID)},
+		}
+
+		resp, err := conn.DescribeSpotInstanceRequests(req)
+		if err == nil {
+			if len(resp.SpotInstanceRequests) > 0 {
+				return fmt.Errorf("Spot instance request is still here.")
+			}
+		}
+
+		// Verify the error is what we expect
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if ec2err.Code() != "InvalidSpotInstanceRequestID.NotFound" {
+			return err
+		}
+
+		// Now check if the associated Spot Instance was also destroyed
+		instId := rs.Primary.Attributes["spot_instance_id"]
+		instResp, instErr := conn.DescribeInstances(&ec2.DescribeInstancesInput{
+			InstanceIDs: []*string{aws.String(instId)},
+		})
+		if instErr == nil {
+			if len(instResp.Reservations) > 0 {
+				return fmt.Errorf("Instance still exists.")
+			}
+
+			return nil
+		}
+
+		// Verify the error is what we expect
+		ec2err, ok = err.(awserr.Error)
+		if !ok {
+			return err
+		}
+		if ec2err.Code() != "InvalidInstanceID.NotFound" {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSpotInstanceRequestExists(
+	n string, sir *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SNS subscription with that ARN exists")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+		params := &ec2.DescribeSpotInstanceRequestsInput{
+			SpotInstanceRequestIDs: []*string{&rs.Primary.ID},
+		}
+		resp, err := conn.DescribeSpotInstanceRequests(params)
+
+		if err != nil {
+			return err
+		}
+
+		if v := len(resp.SpotInstanceRequests); v != 1 {
+			return fmt.Errorf("Expected 1 request returned, got %d", v)
+		}
+
+		*sir = *resp.SpotInstanceRequests[0]
+
+		return nil
+	}
+}
+
+func testAccCheckAWSSpotInstanceRequestAttributes(
+	sir *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if *sir.SpotPrice != "0.050000" {
+			return fmt.Errorf("Unexpected spot price: %s", *sir.SpotPrice)
+		}
+		if *sir.State != "active" {
+			return fmt.Errorf("Unexpected request state: %s", *sir.State)
+		}
+		if *sir.Status.Code != "fulfilled" {
+			return fmt.Errorf("Unexpected bid status: %s", *sir.State)
+		}
+		return nil
+	}
+}
+
+const testAccAWSSpotInstanceRequestConfig = `
+resource "aws_spot_instance_request" "foo" {
+	ami = "ami-4fccb37f"
+	instance_type = "m1.small"
+
+	// base price is $0.044 hourly, so bidding above that should theoretically
+	// always fulfill
+	spot_price = "0.05"
+
+	// we wait for fulfillment because we want to inspect the launched instance
+	// and verify termination behavior
+	wait_for_fulfillment = true
+
+	tags {
+		Name = "terraform-test"
+	}
+}
+`
diff --git a/builtin/providers/aws/resource_aws_sqs_queue.go b/builtin/providers/aws/resource_aws_sqs_queue.go
index b664bf2eb..0e85f7cbe 100644
--- a/builtin/providers/aws/resource_aws_sqs_queue.go
+++ b/builtin/providers/aws/resource_aws_sqs_queue.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/hashicorp/terraform/helper/schema"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/sqs"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sqs"
 )
 
 var AttributeMap = map[string]string{
@@ -19,6 +19,7 @@ var AttributeMap = map[string]string{
 	"visibility_timeout_seconds": "VisibilityTimeout",
 	"policy":                     "Policy",
 	"redrive_policy":             "RedrivePolicy",
+	"arn":                        "QueueArn",
 }
 
 // A number of these are marked as computed because if you don't
@@ -70,6 +71,10 @@ func resourceAwsSqsQueue() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -103,7 +108,7 @@ func resourceAwsSqsQueueCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	if len(attributes) > 0 {
-		req.Attributes = &attributes
+		req.Attributes = attributes
 	}
 
 	output, err := sqsconn.CreateQueue(req)
@@ -139,7 +144,7 @@ func resourceAwsSqsQueueUpdate(d *schema.ResourceData, meta interface{}) error {
 	if len(attributes) > 0 {
 		req := &sqs.SetQueueAttributesInput{
 			QueueURL:   aws.String(d.Id()),
-			Attributes: &attributes,
+			Attributes: attributes,
 		}
 		sqsconn.SetQueueAttributes(req)
 	}
@@ -154,12 +159,13 @@ func resourceAwsSqsQueueRead(d *schema.ResourceData, meta interface{}) error {
 		QueueURL:       aws.String(d.Id()),
 		AttributeNames: []*string{aws.String("All")},
 	})
+
 	if err != nil {
 		return err
 	}
 
-	if attributeOutput.Attributes != nil && len(*attributeOutput.Attributes) > 0 {
-		attrmap := *attributeOutput.Attributes
+	if attributeOutput.Attributes != nil && len(attributeOutput.Attributes) > 0 {
+		attrmap := attributeOutput.Attributes
 		resource := *resourceAwsSqsQueue()
 		// iKey = internal struct key, oKey = AWS Attribute Map key
 		for iKey, oKey := range AttributeMap {
diff --git a/builtin/providers/aws/resource_aws_sqs_queue_test.go b/builtin/providers/aws/resource_aws_sqs_queue_test.go
index f6d990c3a..e340a05b9 100644
--- a/builtin/providers/aws/resource_aws_sqs_queue_test.go
+++ b/builtin/providers/aws/resource_aws_sqs_queue_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/sqs"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/sqs"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSSQSQueue(t *testing.T) {
+func TestAccAWSSQSQueue_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
@@ -84,7 +84,7 @@ func testAccCheckAWSSQSExistsWithDefaults(n string) resource.TestCheckFunc {
 		}
 
 		// checking if attributes are defaults
-		for k, v := range *resp.Attributes {
+		for k, v := range resp.Attributes {
 			if k == "VisibilityTimeout" && *v != "30" {
 				return fmt.Errorf("VisibilityTimeout (%s) was not set to 30", *v)
 			}
@@ -134,7 +134,7 @@ func testAccCheckAWSSQSExistsWithOverrides(n string) resource.TestCheckFunc {
 		}
 
 		// checking if attributes match our overrides
-		for k, v := range *resp.Attributes {
+		for k, v := range resp.Attributes {
 			if k == "VisibilityTimeout" && *v != "60" {
 				return fmt.Errorf("VisibilityTimeout (%s) was not set to 60", *v)
 			}
diff --git a/builtin/providers/aws/resource_aws_subnet.go b/builtin/providers/aws/resource_aws_subnet.go
index f6d56681a..326ddc28d 100644
--- a/builtin/providers/aws/resource_aws_subnet.go
+++ b/builtin/providers/aws/resource_aws_subnet.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_subnet_test.go b/builtin/providers/aws/resource_aws_subnet_test.go
index 206333d41..78dbf2d9f 100644
--- a/builtin/providers/aws/resource_aws_subnet_test.go
+++ b/builtin/providers/aws/resource_aws_subnet_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSSubnet(t *testing.T) {
+func TestAccAWSSubnet_basic(t *testing.T) {
 	var v ec2.Subnet
 
 	testCheck := func(*terraform.State) error {
diff --git a/builtin/providers/aws/resource_aws_volume_attachment.go b/builtin/providers/aws/resource_aws_volume_attachment.go
new file mode 100644
index 000000000..6822ebd28
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_volume_attachment.go
@@ -0,0 +1,191 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsVolumeAttachment() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsVolumeAttachmentCreate,
+		Read:   resourceAwsVolumeAttachmentRead,
+		Delete: resourceAwsVolumeAttachmentDelete,
+
+		Schema: map[string]*schema.Schema{
+			"device_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"instance_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"volume_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"force_detach": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsVolumeAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+	name := d.Get("device_name").(string)
+	iID := d.Get("instance_id").(string)
+	vID := d.Get("volume_id").(string)
+
+	opts := &ec2.AttachVolumeInput{
+		Device:     aws.String(name),
+		InstanceID: aws.String(iID),
+		VolumeID:   aws.String(vID),
+	}
+
+	log.Printf("[DEBUG] Attaching Volume (%s) to Instance (%s)", vID, iID)
+	_, err := conn.AttachVolume(opts)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			return fmt.Errorf("[WARN] Error attaching volume (%s) to instance (%s), message: \"%s\", code: \"%s\"",
+				vID, iID, awsErr.Message(), awsErr.Code())
+		}
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"attaching"},
+		Target:     "attached",
+		Refresh:    volumeAttachmentStateRefreshFunc(conn, vID, iID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to attach to Instance: %s, error: %s",
+			vID, iID, err)
+	}
+
+	d.SetId(volumeAttachmentID(name, vID, iID))
+	return resourceAwsVolumeAttachmentRead(d, meta)
+}
+
+func volumeAttachmentStateRefreshFunc(conn *ec2.EC2, volumeID, instanceID string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+
+		request := &ec2.DescribeVolumesInput{
+			VolumeIDs: []*string{aws.String(volumeID)},
+			Filters: []*ec2.Filter{
+				&ec2.Filter{
+					Name:   aws.String("attachment.instance-id"),
+					Values: []*string{aws.String(instanceID)},
+				},
+			},
+		}
+
+		resp, err := conn.DescribeVolumes(request)
+		if err != nil {
+			if awsErr, ok := err.(awserr.Error); ok {
+				return nil, "failed", fmt.Errorf("code: %s, message: %s", awsErr.Code(), awsErr.Message())
+			}
+			return nil, "failed", err
+		}
+
+		if len(resp.Volumes) > 0 {
+			v := resp.Volumes[0]
+			for _, a := range v.Attachments {
+				if a.InstanceID != nil && *a.InstanceID == instanceID {
+					return a, *a.State, nil
+				}
+			}
+		}
+		// assume detached if volume count is 0
+		return 42, "detached", nil
+	}
+}
+func resourceAwsVolumeAttachmentRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	request := &ec2.DescribeVolumesInput{
+		VolumeIDs: []*string{aws.String(d.Get("volume_id").(string))},
+		Filters: []*ec2.Filter{
+			&ec2.Filter{
+				Name:   aws.String("attachment.instance-id"),
+				Values: []*string{aws.String(d.Get("instance_id").(string))},
+			},
+		},
+	}
+
+	_, err := conn.DescribeVolumes(request)
+	if err != nil {
+		if ec2err, ok := err.(awserr.Error); ok && ec2err.Code() == "InvalidVolume.NotFound" {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error reading EC2 volume %s for instance: %s: %#v", d.Get("volume_id").(string), d.Get("instance_id").(string), err)
+	}
+	return nil
+}
+
+func resourceAwsVolumeAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).ec2conn
+
+	vID := d.Get("volume_id").(string)
+	iID := d.Get("instance_id").(string)
+
+	opts := &ec2.DetachVolumeInput{
+		Device:     aws.String(d.Get("device_name").(string)),
+		InstanceID: aws.String(iID),
+		VolumeID:   aws.String(vID),
+		Force:      aws.Boolean(d.Get("force_detach").(bool)),
+	}
+
+	_, err := conn.DetachVolume(opts)
+	stateConf := &resource.StateChangeConf{
+		Pending:    []string{"detaching"},
+		Target:     "detached",
+		Refresh:    volumeAttachmentStateRefreshFunc(conn, vID, iID),
+		Timeout:    5 * time.Minute,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	log.Printf("[DEBUG] Detaching Volume (%s) from Instance (%s)", vID, iID)
+	_, err = stateConf.WaitForState()
+	if err != nil {
+		return fmt.Errorf(
+			"Error waiting for Volume (%s) to detach from Instance: %s",
+			vID, iID)
+	}
+	d.SetId("")
+	return nil
+}
+
+func volumeAttachmentID(name, volumeID, instanceID string) string {
+	var buf bytes.Buffer
+	buf.WriteString(fmt.Sprintf("%s-", name))
+	buf.WriteString(fmt.Sprintf("%s-", instanceID))
+	buf.WriteString(fmt.Sprintf("%s-", volumeID))
+
+	return fmt.Sprintf("vai-%d", hashcode.String(buf.String()))
+}
diff --git a/builtin/providers/aws/resource_aws_volume_attachment_test.go b/builtin/providers/aws/resource_aws_volume_attachment_test.go
new file mode 100644
index 000000000..66807884f
--- /dev/null
+++ b/builtin/providers/aws/resource_aws_volume_attachment_test.go
@@ -0,0 +1,93 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSVolumeAttachment_basic(t *testing.T) {
+	var i ec2.Instance
+	var v ec2.Volume
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckVolumeAttachmentDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccVolumeAttachmentConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(
+						"aws_volume_attachment.ebs_att", "device_name", "/dev/sdh"),
+					testAccCheckInstanceExists(
+						"aws_instance.web", &i),
+					testAccCheckVolumeExists(
+						"aws_ebs_volume.example", &v),
+					testAccCheckVolumeAttachmentExists(
+						"aws_volume_attachment.ebs_att", &i, &v),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVolumeAttachmentExists(n string, i *ec2.Instance, v *ec2.Volume) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		for _, b := range i.BlockDeviceMappings {
+			if rs.Primary.Attributes["device_name"] == *b.DeviceName {
+				if b.EBS.VolumeID != nil && rs.Primary.Attributes["volume_id"] == *b.EBS.VolumeID {
+					// pass
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Error finding instance/volume")
+	}
+}
+
+func testAccCheckVolumeAttachmentDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		log.Printf("\n\n----- This is never called")
+		if rs.Type != "aws_volume_attachment" {
+			continue
+		}
+	}
+	return nil
+}
+
+const testAccVolumeAttachmentConfig = `
+resource "aws_instance" "web" {
+	ami = "ami-21f78e11"
+  availability_zone = "us-west-2a"
+	instance_type = "t1.micro"
+	tags {
+		Name = "HelloWorld"
+	}
+}
+
+resource "aws_ebs_volume" "example" {
+  availability_zone = "us-west-2a"
+	size = 1
+}
+
+resource "aws_volume_attachment" "ebs_att" {
+  device_name = "/dev/sdh"
+	volume_id = "${aws_ebs_volume.example.id}"
+	instance_id = "${aws_instance.web.id}"
+}
+`
diff --git a/builtin/providers/aws/resource_aws_vpc.go b/builtin/providers/aws/resource_aws_vpc.go
index b13c1521b..dfb67172e 100644
--- a/builtin/providers/aws/resource_aws_vpc.go
+++ b/builtin/providers/aws/resource_aws_vpc.go
@@ -3,11 +3,12 @@ package aws
 import (
 	"fmt"
 	"log"
+	"net"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -24,6 +25,16 @@ func resourceAwsVpc() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+					_, ipnet, err := net.ParseCIDR(value)
+
+					if err != nil || ipnet == nil || value != ipnet.String() {
+						errors = append(errors, fmt.Errorf(
+							"%q must contain a valid CIDR", k))
+					}
+					return
+				},
 			},
 
 			"instance_tenancy": &schema.Schema{
@@ -247,16 +258,29 @@ func resourceAwsVpcDelete(d *schema.ResourceData, meta interface{}) error {
 		VPCID: &vpcID,
 	}
 	log.Printf("[INFO] Deleting VPC: %s", d.Id())
-	if _, err := conn.DeleteVPC(DeleteVpcOpts); err != nil {
-		ec2err, ok := err.(awserr.Error)
-		if ok && ec2err.Code() == "InvalidVpcID.NotFound" {
+
+	return resource.Retry(5*time.Minute, func() error {
+		_, err := conn.DeleteVPC(DeleteVpcOpts)
+		if err == nil {
 			return nil
 		}
 
-		return fmt.Errorf("Error deleting VPC: %s", err)
-	}
+		ec2err, ok := err.(awserr.Error)
+		if !ok {
+			return &resource.RetryError{Err: err}
+		}
 
-	return nil
+		switch ec2err.Code() {
+		case "InvalidVpcID.NotFound":
+			return nil
+		case "DependencyViolation":
+			return err
+		}
+
+		return &resource.RetryError{
+			Err: fmt.Errorf("Error deleting VPC: %s", err),
+		}
+	})
 }
 
 // VPCStateRefreshFunc returns a resource.StateRefreshFunc that is used to watch
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
index 4fd2d24f4..540c62802 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
index 46c447213..93ac4494e 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
index 1b00ce3dc..f40f1a06e 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_association_test.go
@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSDHCPOptionsAssociation(t *testing.T) {
+func TestAccAWSDHCPOptionsAssociation_basic(t *testing.T) {
 	var v ec2.VPC
 	var d ec2.DHCPOptions
 
diff --git a/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go b/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
index 221ba99fc..988c8b3c4 100644
--- a/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_dhcp_options_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccDHCPOptions(t *testing.T) {
+func TestAccDHCPOptions_basic(t *testing.T) {
 	var d ec2.DHCPOptions
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_vpc_peering_connection.go b/builtin/providers/aws/resource_aws_vpc_peering_connection.go
index 9a277a92b..3d768577b 100644
--- a/builtin/providers/aws/resource_aws_vpc_peering_connection.go
+++ b/builtin/providers/aws/resource_aws_vpc_peering_connection.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -101,6 +101,14 @@ func resourceAwsVPCPeeringRead(d *schema.ResourceData, meta interface{}) error {
 
 	pc := pcRaw.(*ec2.VPCPeeringConnection)
 
+	// The failed status is a status that we can assume just means the
+	// connection is gone. Destruction isn't allowed, and it eventually
+	// just "falls off" the console. See GH-2322
+	if *pc.Status.Code == "failed" {
+		d.SetId("")
+		return nil
+	}
+
 	d.Set("accept_status", *pc.Status.Code)
 	d.Set("peer_owner_id", pc.AccepterVPCInfo.OwnerID)
 	d.Set("peer_vpc_id", pc.AccepterVPCInfo.VPCID)
diff --git a/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go b/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
index a840288c9..3b7896e40 100644
--- a/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_peering_connection_test.go
@@ -5,13 +5,13 @@ import (
 	"os"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAWSVPCPeeringConnection_normal(t *testing.T) {
+func TestAccAWSVPCPeeringConnection_basic(t *testing.T) {
 	var connection ec2.VPCPeeringConnection
 
 	resource.Test(t, resource.TestCase{
diff --git a/builtin/providers/aws/resource_aws_vpc_test.go b/builtin/providers/aws/resource_aws_vpc_test.go
index 8ee7820aa..95121ec6f 100644
--- a/builtin/providers/aws/resource_aws_vpc_test.go
+++ b/builtin/providers/aws/resource_aws_vpc_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/resource_aws_vpn_connection.go b/builtin/providers/aws/resource_aws_vpn_connection.go
index 5780c887d..a97cd7559 100644
--- a/builtin/providers/aws/resource_aws_vpn_connection.go
+++ b/builtin/providers/aws/resource_aws_vpn_connection.go
@@ -6,9 +6,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
diff --git a/builtin/providers/aws/resource_aws_vpn_connection_test.go b/builtin/providers/aws/resource_aws_vpn_connection_test.go
index 6b61d97e4..55dbb447c 100644
--- a/builtin/providers/aws/resource_aws_vpn_connection_test.go
+++ b/builtin/providers/aws/resource_aws_vpn_connection_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsVpnConnection(t *testing.T) {
+func TestAccAwsVpnConnection_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/resource_aws_vpn_gateway.go b/builtin/providers/aws/resource_aws_vpn_gateway.go
index b909a460d..1a331e946 100644
--- a/builtin/providers/aws/resource_aws_vpn_gateway.go
+++ b/builtin/providers/aws/resource_aws_vpn_gateway.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
diff --git a/builtin/providers/aws/resource_aws_vpn_gateway_test.go b/builtin/providers/aws/resource_aws_vpn_gateway_test.go
index 1643da86c..6b1d3fc48 100644
--- a/builtin/providers/aws/resource_aws_vpn_gateway_test.go
+++ b/builtin/providers/aws/resource_aws_vpn_gateway_test.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/resource_vpn_connection_route.go b/builtin/providers/aws/resource_vpn_connection_route.go
index 198f730d2..062fa32b0 100644
--- a/builtin/providers/aws/resource_vpn_connection_route.go
+++ b/builtin/providers/aws/resource_vpn_connection_route.go
@@ -5,9 +5,9 @@ import (
 	"log"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -91,6 +91,12 @@ func resourceAwsVpnConnectionRouteRead(d *schema.ResourceData, meta interface{})
 			return err
 		}
 	}
+	if resp == nil || len(resp.VPNConnections) == 0 {
+		// This is kind of a weird edge case. I'd rather return an error
+		// instead of just blindly setting the ID to ""... since I don't know
+		// what might cause this.
+		return fmt.Errorf("No VPN connections returned")
+	}
 
 	vpnConnection := resp.VPNConnections[0]
 
diff --git a/builtin/providers/aws/resource_vpn_connection_route_test.go b/builtin/providers/aws/resource_vpn_connection_route_test.go
index 55779898c..955aa5f1a 100644
--- a/builtin/providers/aws/resource_vpn_connection_route_test.go
+++ b/builtin/providers/aws/resource_vpn_connection_route_test.go
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccAwsVpnConnectionRoute(t *testing.T) {
+func TestAccAwsVpnConnectionRoute_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/aws/s3_tags.go b/builtin/providers/aws/s3_tags.go
index 01782f238..5d620b132 100644
--- a/builtin/providers/aws/s3_tags.go
+++ b/builtin/providers/aws/s3_tags.go
@@ -3,9 +3,9 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/s3_tags_test.go b/builtin/providers/aws/s3_tags_test.go
index 70c76cf0d..3d4188c5f 100644
--- a/builtin/providers/aws/s3_tags_test.go
+++ b/builtin/providers/aws/s3_tags_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/structure.go b/builtin/providers/aws/structure.go
index 269734aa7..d4847de1d 100644
--- a/builtin/providers/aws/structure.go
+++ b/builtin/providers/aws/structure.go
@@ -1,15 +1,19 @@
 package aws
 
 import (
+	"bytes"
+	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -42,6 +46,64 @@ func expandListeners(configured []interface{}) ([]*elb.Listener, error) {
 	return listeners, nil
 }
 
+// Takes the result of flatmap. Expand for an array of listeners and
+// returns ECS Volume compatible objects
+func expandEcsVolumes(configured []interface{}) ([]*ecs.Volume, error) {
+	volumes := make([]*ecs.Volume, 0, len(configured))
+
+	// Loop over our configured volumes and create
+	// an array of aws-sdk-go compatible objects
+	for _, lRaw := range configured {
+		data := lRaw.(map[string]interface{})
+
+		l := &ecs.Volume{
+			Name: aws.String(data["name"].(string)),
+			Host: &ecs.HostVolumeProperties{
+				SourcePath: aws.String(data["host_path"].(string)),
+			},
+		}
+
+		volumes = append(volumes, l)
+	}
+
+	return volumes, nil
+}
+
+// Takes JSON in a string. Decodes JSON into
+// an array of ecs.ContainerDefinition compatible objects
+func expandEcsContainerDefinitions(rawDefinitions string) ([]*ecs.ContainerDefinition, error) {
+	var definitions []*ecs.ContainerDefinition
+
+	err := json.Unmarshal([]byte(rawDefinitions), &definitions)
+	if err != nil {
+		return nil, fmt.Errorf("Error decoding JSON: %s", err)
+	}
+
+	return definitions, nil
+}
+
+// Takes the result of flatmap. Expand for an array of load balancers and
+// returns ecs.LoadBalancer compatible objects
+func expandEcsLoadBalancers(configured []interface{}) []*ecs.LoadBalancer {
+	loadBalancers := make([]*ecs.LoadBalancer, 0, len(configured))
+
+	// Loop over our configured load balancers and create
+	// an array of aws-sdk-go compatible objects
+	for _, lRaw := range configured {
+		data := lRaw.(map[string]interface{})
+
+		l := &ecs.LoadBalancer{
+			ContainerName:    aws.String(data["container_name"].(string)),
+			ContainerPort:    aws.Long(int64(data["container_port"].(int))),
+			LoadBalancerName: aws.String(data["elb_name"].(string)),
+		}
+
+		loadBalancers = append(loadBalancers, l)
+	}
+
+	return loadBalancers
+}
+
 // Takes the result of flatmap.Expand for an array of ingress/egress security
 // group rules and returns EC2 API compatible objects. This function will error
 // if it finds invalid permissions input, namely a protocol of "-1" with either
@@ -140,6 +202,27 @@ func expandParameters(configured []interface{}) ([]*rds.Parameter, error) {
 	return parameters, nil
 }
 
+// Takes the result of flatmap.Expand for an array of parameters and
+// returns Parameter API compatible objects
+func expandElastiCacheParameters(configured []interface{}) ([]*elasticache.ParameterNameValue, error) {
+	parameters := make([]*elasticache.ParameterNameValue, 0, len(configured))
+
+	// Loop over our configured parameters and create
+	// an array of aws-sdk-go compatabile objects
+	for _, pRaw := range configured {
+		data := pRaw.(map[string]interface{})
+
+		p := &elasticache.ParameterNameValue{
+			ParameterName:  aws.String(data["name"].(string)),
+			ParameterValue: aws.String(data["value"].(string)),
+		}
+
+		parameters = append(parameters, p)
+	}
+
+	return parameters, nil
+}
+
 // Flattens a health check into something that flatmap.Flatten()
 // can handle
 func flattenHealthCheck(check *elb.HealthCheck) []map[string]interface{} {
@@ -215,6 +298,44 @@ func flattenListeners(list []*elb.ListenerDescription) []map[string]interface{}
 	return result
 }
 
+// Flattens an array of Volumes into a []map[string]interface{}
+func flattenEcsVolumes(list []*ecs.Volume) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, volume := range list {
+		l := map[string]interface{}{
+			"name":      *volume.Name,
+			"host_path": *volume.Host.SourcePath,
+		}
+		result = append(result, l)
+	}
+	return result
+}
+
+// Flattens an array of ECS LoadBalancers into a []map[string]interface{}
+func flattenEcsLoadBalancers(list []*ecs.LoadBalancer) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, loadBalancer := range list {
+		l := map[string]interface{}{
+			"elb_name":       *loadBalancer.LoadBalancerName,
+			"container_name": *loadBalancer.ContainerName,
+			"container_port": *loadBalancer.ContainerPort,
+		}
+		result = append(result, l)
+	}
+	return result
+}
+
+// Encodes an array of ecs.ContainerDefinitions into a JSON string
+func flattenEcsContainerDefinitions(definitions []*ecs.ContainerDefinition) (string, error) {
+	byteArray, err := json.Marshal(definitions)
+	if err != nil {
+		return "", fmt.Errorf("Error encoding to JSON: %s", err)
+	}
+
+	n := bytes.Index(byteArray, []byte{0})
+	return string(byteArray[:n]), nil
+}
+
 // Flattens an array of Parameters into a []map[string]interface{}
 func flattenParameters(list []*rds.Parameter) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, len(list))
@@ -227,6 +348,18 @@ func flattenParameters(list []*rds.Parameter) []map[string]interface{} {
 	return result
 }
 
+// Flattens an array of Parameters into a []map[string]interface{}
+func flattenElastiCacheParameters(list []*elasticache.Parameter) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(list))
+	for _, i := range list {
+		result = append(result, map[string]interface{}{
+			"name":  strings.ToLower(*i.ParameterName),
+			"value": strings.ToLower(*i.ParameterValue),
+		})
+	}
+	return result
+}
+
 // Takes the result of flatmap.Expand for an array of strings
 // and returns a []string
 func expandStringList(configured []interface{}) []*string {
diff --git a/builtin/providers/aws/structure_test.go b/builtin/providers/aws/structure_test.go
index ace216e6b..64bf8c52c 100644
--- a/builtin/providers/aws/structure_test.go
+++ b/builtin/providers/aws/structure_test.go
@@ -4,11 +4,12 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
-	"github.com/awslabs/aws-sdk-go/service/elb"
-	"github.com/awslabs/aws-sdk-go/service/rds"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/flatmap"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -393,6 +394,32 @@ func TestexpandParameters(t *testing.T) {
 	}
 }
 
+func TestexpandElasticacheParameters(t *testing.T) {
+	expanded := []interface{}{
+		map[string]interface{}{
+			"name":         "character_set_client",
+			"value":        "utf8",
+			"apply_method": "immediate",
+		},
+	}
+	parameters, err := expandElastiCacheParameters(expanded)
+	if err != nil {
+		t.Fatalf("bad: %#v", err)
+	}
+
+	expected := &elasticache.Parameter{
+		ParameterName:  aws.String("activerehashing"),
+		ParameterValue: aws.String("yes"),
+	}
+
+	if !reflect.DeepEqual(parameters[0], expected) {
+		t.Fatalf(
+			"Got:\n\n%#v\n\nExpected:\n\n%#v\n",
+			parameters[0],
+			expected)
+	}
+}
+
 func TestflattenParameters(t *testing.T) {
 	cases := []struct {
 		Input  []*rds.Parameter
@@ -422,6 +449,35 @@ func TestflattenParameters(t *testing.T) {
 	}
 }
 
+func TestflattenElasticacheParameters(t *testing.T) {
+	cases := []struct {
+		Input  []*elasticache.Parameter
+		Output []map[string]interface{}
+	}{
+		{
+			Input: []*elasticache.Parameter{
+				&elasticache.Parameter{
+					ParameterName:  aws.String("activerehashing"),
+					ParameterValue: aws.String("yes"),
+				},
+			},
+			Output: []map[string]interface{}{
+				map[string]interface{}{
+					"name":  "activerehashing",
+					"value": "yes",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		output := flattenElastiCacheParameters(tc.Input)
+		if !reflect.DeepEqual(output, tc.Output) {
+			t.Fatalf("Got:\n\n%#v\n\nExpected:\n\n%#v", output, tc.Output)
+		}
+	}
+}
+
 func TestexpandInstanceString(t *testing.T) {
 
 	expected := []*elb.Instance{
diff --git a/builtin/providers/aws/tags.go b/builtin/providers/aws/tags.go
index 07a64bbaf..3d7aff9b8 100644
--- a/builtin/providers/aws/tags.go
+++ b/builtin/providers/aws/tags.go
@@ -3,8 +3,9 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -28,7 +29,7 @@ func setTags(conn *ec2.EC2, d *schema.ResourceData) error {
 
 		// Set tags
 		if len(remove) > 0 {
-			log.Printf("[DEBUG] Removing tags: %#v", remove)
+			log.Printf("[DEBUG] Removing tags: %#v from %s", remove, d.Id())
 			_, err := conn.DeleteTags(&ec2.DeleteTagsInput{
 				Resources: []*string{aws.String(d.Id())},
 				Tags:      remove,
@@ -38,7 +39,7 @@ func setTags(conn *ec2.EC2, d *schema.ResourceData) error {
 			}
 		}
 		if len(create) > 0 {
-			log.Printf("[DEBUG] Creating tags: %#v", create)
+			log.Printf("[DEBUG] Creating tags: %s for %s", awsutil.StringValue(create), d.Id())
 			_, err := conn.CreateTags(&ec2.CreateTagsInput{
 				Resources: []*string{aws.String(d.Id())},
 				Tags:      create,
diff --git a/builtin/providers/aws/tagsEC.go b/builtin/providers/aws/tagsEC.go
index 55aa2c4e5..3a5ba1acf 100644
--- a/builtin/providers/aws/tagsEC.go
+++ b/builtin/providers/aws/tagsEC.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/tagsEC_test.go b/builtin/providers/aws/tagsEC_test.go
index dc61bd0cc..11737ecea 100644
--- a/builtin/providers/aws/tagsEC_test.go
+++ b/builtin/providers/aws/tagsEC_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/elasticache"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tagsELB.go b/builtin/providers/aws/tagsELB.go
index 0513848cc..1b1a93488 100644
--- a/builtin/providers/aws/tagsELB.go
+++ b/builtin/providers/aws/tagsELB.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/tagsELB_test.go b/builtin/providers/aws/tagsELB_test.go
index b2078a8d9..9ec6dd8db 100644
--- a/builtin/providers/aws/tagsELB_test.go
+++ b/builtin/providers/aws/tagsELB_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tagsRDS.go b/builtin/providers/aws/tagsRDS.go
index 0a1a39670..3e4e0c700 100644
--- a/builtin/providers/aws/tagsRDS.go
+++ b/builtin/providers/aws/tagsRDS.go
@@ -3,8 +3,8 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
diff --git a/builtin/providers/aws/tagsRDS_test.go b/builtin/providers/aws/tagsRDS_test.go
index 764f23e23..2aa0a05b3 100644
--- a/builtin/providers/aws/tagsRDS_test.go
+++ b/builtin/providers/aws/tagsRDS_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/rds"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tags_route53.go b/builtin/providers/aws/tags_route53.go
index 66936d1f9..864ce3350 100644
--- a/builtin/providers/aws/tags_route53.go
+++ b/builtin/providers/aws/tags_route53.go
@@ -3,14 +3,14 @@ package aws
 import (
 	"log"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
 // setTags is a helper to set the tags for a resource. It expects the
 // tags field to be named "tags"
-func setTagsR53(conn *route53.Route53, d *schema.ResourceData) error {
+func setTagsR53(conn *route53.Route53, d *schema.ResourceData, resourceType string) error {
 	if d.HasChange("tags") {
 		oraw, nraw := d.GetChange("tags")
 		o := oraw.(map[string]interface{})
@@ -25,7 +25,7 @@ func setTagsR53(conn *route53.Route53, d *schema.ResourceData) error {
 		log.Printf("[DEBUG] Changing tags: \n\tadding: %#v\n\tremoving:%#v", create, remove)
 		req := &route53.ChangeTagsForResourceInput{
 			ResourceID:   aws.String(d.Id()),
-			ResourceType: aws.String("hostedzone"),
+			ResourceType: aws.String(resourceType),
 		}
 
 		if len(create) > 0 {
diff --git a/builtin/providers/aws/tags_route53_test.go b/builtin/providers/aws/tags_route53_test.go
index 428629076..a0b2c6410 100644
--- a/builtin/providers/aws/tags_route53_test.go
+++ b/builtin/providers/aws/tags_route53_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/route53"
+	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/tags_test.go b/builtin/providers/aws/tags_test.go
index 5bbc3b78f..8aac147fc 100644
--- a/builtin/providers/aws/tags_test.go
+++ b/builtin/providers/aws/tags_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/awslabs/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
diff --git a/builtin/providers/aws/test-fixtures/lambdatest.zip b/builtin/providers/aws/test-fixtures/lambdatest.zip
new file mode 100644
index 000000000..5c636e955
Binary files /dev/null and b/builtin/providers/aws/test-fixtures/lambdatest.zip differ
diff --git a/builtin/providers/aws/website_endpoint_url_test.go b/builtin/providers/aws/website_endpoint_url_test.go
index 38b11d329..2f4ce5249 100644
--- a/builtin/providers/aws/website_endpoint_url_test.go
+++ b/builtin/providers/aws/website_endpoint_url_test.go
@@ -2,16 +2,27 @@ package aws
 
 import "testing"
 
-func TestWebsiteEndpointUrl_withoutRegion(t *testing.T) {
-	u := WebsiteEndpointUrl("buck.et", "")
-	if u != "buck.et.s3-website-us-east-1.amazonaws.com" {
-		t.Fatalf("bad: %s", u)
-	}
+// http://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteEndpoints.html
+var websiteEndpoints = []struct {
+	in  string
+	out string
+}{
+	{"", "bucket-name.s3-website-us-east-1.amazonaws.com"},
+	{"us-west-2", "bucket-name.s3-website-us-west-2.amazonaws.com"},
+	{"us-west-1", "bucket-name.s3-website-us-west-1.amazonaws.com"},
+	{"eu-west-1", "bucket-name.s3-website-eu-west-1.amazonaws.com"},
+	{"eu-central-1", "bucket-name.s3-website.eu-central-1.amazonaws.com"},
+	{"ap-southeast-1", "bucket-name.s3-website-ap-southeast-1.amazonaws.com"},
+	{"ap-northeast-1", "bucket-name.s3-website-ap-northeast-1.amazonaws.com"},
+	{"ap-southeast-2", "bucket-name.s3-website-ap-southeast-2.amazonaws.com"},
+	{"sa-east-1", "bucket-name.s3-website-sa-east-1.amazonaws.com"},
 }
 
-func TestWebsiteEndpointUrl_withRegion(t *testing.T) {
-	u := WebsiteEndpointUrl("buck.et", "us-west-1")
-	if u != "buck.et.s3-website-us-west-1.amazonaws.com" {
-		t.Fatalf("bad: %s", u)
+func TestWebsiteEndpointUrl(t *testing.T) {
+	for _, tt := range websiteEndpoints {
+		s := WebsiteEndpointUrl("bucket-name", tt.in)
+		if s != tt.out {
+			t.Errorf("WebsiteEndpointUrl(\"bucket-name\", %q) => %q, want %q", tt.in, s, tt.out)
+		}
 	}
 }
diff --git a/builtin/providers/azure/config.go b/builtin/providers/azure/config.go
new file mode 100644
index 000000000..fff31853d
--- /dev/null
+++ b/builtin/providers/azure/config.go
@@ -0,0 +1,149 @@
+package azure
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/affinitygroup"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/Azure/azure-sdk-for-go/management/osimage"
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/Azure/azure-sdk-for-go/management/storageservice"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachineimage"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/Azure/azure-sdk-for-go/storage"
+)
+
+// Config is the configuration structure used to instantiate a
+// new Azure management client.
+type Config struct {
+	SettingsFile   string
+	SubscriptionID string
+	Certificate    []byte
+	ManagementURL  string
+}
+
+// Client contains all the handles required for managing Azure services.
+type Client struct {
+	mgmtClient management.Client
+
+	affinityGroupClient affinitygroup.AffinityGroupClient
+
+	hostedServiceClient hostedservice.HostedServiceClient
+
+	secGroupClient networksecuritygroup.SecurityGroupClient
+
+	osImageClient osimage.OSImageClient
+
+	sqlClient sql.SQLDatabaseClient
+
+	storageServiceClient storageservice.StorageServiceClient
+
+	vmClient virtualmachine.VirtualMachineClient
+
+	vmDiskClient virtualmachinedisk.DiskClient
+
+	vmImageClient virtualmachineimage.Client
+
+	// unfortunately; because of how Azure's network API works; doing networking operations
+	// concurrently is very hazardous, and we need a mutex to guard the VirtualNetworkClient.
+	vnetClient virtualnetwork.VirtualNetworkClient
+	mutex      *sync.Mutex
+}
+
+// getStorageClientForStorageService is helper method which returns the
+// storage.Client associated to the given storage service name.
+func (c Client) getStorageClientForStorageService(serviceName string) (storage.Client, error) {
+	var storageClient storage.Client
+
+	keys, err := c.storageServiceClient.GetStorageServiceKeys(serviceName)
+	if err != nil {
+		return storageClient, fmt.Errorf("Failed getting Storage Service keys for %s: %s", serviceName, err)
+	}
+
+	storageClient, err = storage.NewBasicClient(serviceName, keys.PrimaryKey)
+	if err != nil {
+		return storageClient, fmt.Errorf("Failed creating Storage Service client for %s: %s", serviceName, err)
+	}
+
+	return storageClient, err
+}
+
+// getStorageServiceBlobClient is a helper method which returns the
+// storage.BlobStorageClient associated to the given storage service name.
+func (c Client) getStorageServiceBlobClient(serviceName string) (storage.BlobStorageClient, error) {
+	storageClient, err := c.getStorageClientForStorageService(serviceName)
+	if err != nil {
+		return storage.BlobStorageClient{}, err
+	}
+
+	return storageClient.GetBlobService(), nil
+}
+
+// getStorageServiceQueueClient is a helper method which returns the
+// storage.QueueServiceClient associated to the given storage service name.
+func (c Client) getStorageServiceQueueClient(serviceName string) (storage.QueueServiceClient, error) {
+	storageClient, err := c.getStorageClientForStorageService(serviceName)
+	if err != nil {
+		return storage.QueueServiceClient{}, err
+	}
+
+	return storageClient.GetQueueService(), err
+}
+
+// NewClientFromSettingsFile returns a new Azure management
+// client created using a publish settings file.
+func (c *Config) NewClientFromSettingsFile() (*Client, error) {
+	if _, err := os.Stat(c.SettingsFile); os.IsNotExist(err) {
+		return nil, fmt.Errorf("Publish Settings file %q does not exist!", c.SettingsFile)
+	}
+
+	mc, err := management.ClientFromPublishSettingsFile(c.SettingsFile, c.SubscriptionID)
+	if err != nil {
+		return nil, nil
+	}
+
+	return &Client{
+		mgmtClient:           mc,
+		affinityGroupClient:  affinitygroup.NewClient(mc),
+		hostedServiceClient:  hostedservice.NewClient(mc),
+		secGroupClient:       networksecuritygroup.NewClient(mc),
+		osImageClient:        osimage.NewClient(mc),
+		sqlClient:            sql.NewClient(mc),
+		storageServiceClient: storageservice.NewClient(mc),
+		vmClient:             virtualmachine.NewClient(mc),
+		vmDiskClient:         virtualmachinedisk.NewClient(mc),
+		vmImageClient:        virtualmachineimage.NewClient(mc),
+		vnetClient:           virtualnetwork.NewClient(mc),
+		mutex:                &sync.Mutex{},
+	}, nil
+}
+
+// NewClient returns a new Azure management client created
+// using a subscription ID and certificate.
+func (c *Config) NewClient() (*Client, error) {
+	mc, err := management.NewClient(c.SubscriptionID, c.Certificate)
+	if err != nil {
+		return nil, nil
+	}
+
+	return &Client{
+		mgmtClient:           mc,
+		affinityGroupClient:  affinitygroup.NewClient(mc),
+		hostedServiceClient:  hostedservice.NewClient(mc),
+		secGroupClient:       networksecuritygroup.NewClient(mc),
+		osImageClient:        osimage.NewClient(mc),
+		sqlClient:            sql.NewClient(mc),
+		storageServiceClient: storageservice.NewClient(mc),
+		vmClient:             virtualmachine.NewClient(mc),
+		vmDiskClient:         virtualmachinedisk.NewClient(mc),
+		vmImageClient:        virtualmachineimage.NewClient(mc),
+		vnetClient:           virtualnetwork.NewClient(mc),
+		mutex:                &sync.Mutex{},
+	}, nil
+}
diff --git a/builtin/providers/azure/constants.go b/builtin/providers/azure/constants.go
new file mode 100644
index 000000000..55264f969
--- /dev/null
+++ b/builtin/providers/azure/constants.go
@@ -0,0 +1,48 @@
+package azure
+
+const (
+	// terraformAzureLabel is used as the label for the hosted service created
+	// by Terraform on Azure.
+	terraformAzureLabel = "terraform-on-azure"
+
+	// terraformAzureDescription is the description used for the hosted service
+	// created by Terraform on Azure.
+	terraformAzureDescription = "Hosted service automatically created by terraform."
+)
+
+// parameterDescriptions holds a list of descriptions for all the available
+// parameters of an Azure configuration.
+var parameterDescriptions = map[string]string{
+	// provider descriptions:
+	"management_url": "The URL of the management API all requests should be sent to.\n" +
+		"Defaults to 'https://management.core.windows.net/', which is the default Azure API URL.\n" +
+		"This should be filled in only if you have your own datacenter with its own hosted management API.",
+	"management_certificate": "The certificate for connecting to the management API specified with 'management_url'",
+	"subscription_id":        "The subscription ID to be used when connecting to the management API.",
+	"publish_settings_file":  "The publish settings file, either created by you or downloaded from 'https://manage.windowsazure.com/publishsettings'",
+	// general resource descriptions:
+	"name":         "Name of the resource to be created as it will appear in the Azure dashboard.",
+	"service_name": "Name of the hosted service within Azure. Will have a DNS entry as dns-name.cloudapp.net",
+	"location": "The Azure location where the resource will be located.\n" +
+		"A list of Azure locations can be found here: http://azure.microsoft.com/en-us/regions/",
+	"reverse_dns_fqdn": "The reverse of the fully qualified domain name. Optional.",
+	"label":            "Label by which the resource will be identified by. Optional.",
+	"description":      "Brief description of the resource. Optional.",
+	// hosted service descriptions:
+	"ephemeral_contents": "Sets whether the associated contents of this resource should also be\n" +
+		"deleted upon this resource's deletion. Default is false.",
+	// instance descriptions:
+	"image":                          "The image the new VM will be booted from. Mandatory.",
+	"size":                           "The size in GB of the disk to be created. Mandatory.",
+	"os_type":                        "The OS type of the VM. Either Windows or Linux. Mandatory.",
+	"storage_account":                "The storage account (pool) name. Mandatory.",
+	"storage_container":              "The storage container name from the storage pool given with 'storage_pool'.",
+	"user_name":                      "The user name to be configured on the new VM.",
+	"user_password":                  "The user password to be configured on the new VM.",
+	"default_certificate_thumbprint": "The thumbprint of the WinRM Certificate to be used as a default.",
+	// local network descriptions:
+	"vpn_gateway_address":    "The IP address of the VPN gateway bridged through this virtual network.",
+	"address_space_prefixes": "List of address space prefixes in the format '<IP>/netmask'",
+	// dns descriptions:
+	"dns_address": "Address of the DNS server. Required.",
+}
diff --git a/builtin/providers/azure/provider.go b/builtin/providers/azure/provider.go
new file mode 100644
index 000000000..2c44b54f6
--- /dev/null
+++ b/builtin/providers/azure/provider.go
@@ -0,0 +1,80 @@
+package azure
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/mitchellh/go-homedir"
+)
+
+// Provider returns a terraform.ResourceProvider.
+func Provider() terraform.ResourceProvider {
+	return &schema.Provider{
+		Schema: map[string]*schema.Schema{
+			"settings_file": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_SETTINGS_FILE", nil),
+			},
+
+			"subscription_id": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_SUBSCRIPTION_ID", ""),
+			},
+
+			"certificate": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("AZURE_CERTIFICATE", ""),
+			},
+		},
+
+		ResourcesMap: map[string]*schema.Resource{
+			"azure_instance":                          resourceAzureInstance(),
+			"azure_affinity_group":                    resourceAzureAffinityGroup(),
+			"azure_data_disk":                         resourceAzureDataDisk(),
+			"azure_sql_database_server":               resourceAzureSqlDatabaseServer(),
+			"azure_sql_database_server_firewall_rule": resourceAzureSqlDatabaseServerFirewallRule(),
+			"azure_sql_database_service":              resourceAzureSqlDatabaseService(),
+			"azure_hosted_service":                    resourceAzureHostedService(),
+			"azure_storage_service":                   resourceAzureStorageService(),
+			"azure_storage_container":                 resourceAzureStorageContainer(),
+			"azure_storage_blob":                      resourceAzureStorageBlob(),
+			"azure_storage_queue":                     resourceAzureStorageQueue(),
+			"azure_virtual_network":                   resourceAzureVirtualNetwork(),
+			"azure_dns_server":                        resourceAzureDnsServer(),
+			"azure_local_network_connection":          resourceAzureLocalNetworkConnection(),
+			"azure_security_group":                    resourceAzureSecurityGroup(),
+			"azure_security_group_rule":               resourceAzureSecurityGroupRule(),
+		},
+
+		ConfigureFunc: providerConfigure,
+	}
+}
+
+func providerConfigure(d *schema.ResourceData) (interface{}, error) {
+	settingsFile, err := homedir.Expand(d.Get("settings_file").(string))
+	if err != nil {
+		return nil, fmt.Errorf("Error expanding the settings file path: %s", err)
+	}
+
+	config := Config{
+		SettingsFile:   settingsFile,
+		SubscriptionID: d.Get("subscription_id").(string),
+		Certificate:    []byte(d.Get("certificate").(string)),
+	}
+
+	if config.SettingsFile != "" {
+		return config.NewClientFromSettingsFile()
+	}
+
+	if config.SubscriptionID != "" && len(config.Certificate) > 0 {
+		return config.NewClient()
+	}
+
+	return nil, fmt.Errorf(
+		"Insufficient configuration data. Please specify either a 'settings_file'\n" +
+			"or both a 'subscription_id' and 'certificate'.")
+}
diff --git a/builtin/providers/azure/provider_test.go b/builtin/providers/azure/provider_test.go
new file mode 100644
index 000000000..3d5ec342c
--- /dev/null
+++ b/builtin/providers/azure/provider_test.go
@@ -0,0 +1,60 @@
+package azure
+
+import (
+	"os"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+var testAccProviders map[string]terraform.ResourceProvider
+var testAccProvider *schema.Provider
+
+const (
+	testAccSecurityGroupName = "terraform-security-group"
+	testAccHostedServiceName = "terraform-testing-service"
+)
+
+// testAccStorageServiceName is used as the name for the Storage Service
+// created in all storage-related tests.
+// It is much more convenient to provide a Storage Service which
+// has been created beforehand as the creation of one takes a lot
+// and would greatly impede the multitude of tests which rely on one.
+// NOTE: the storage container should be located in `West US`.
+var testAccStorageServiceName = os.Getenv("AZURE_STORAGE")
+
+const testAccStorageContainerName = "terraform-testing-container"
+
+func init() {
+	testAccProvider = Provider().(*schema.Provider)
+	testAccProviders = map[string]terraform.ResourceProvider{
+		"azure": testAccProvider,
+	}
+}
+
+func TestProvider(t *testing.T) {
+	if err := Provider().(*schema.Provider).InternalValidate(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+func TestProvider_impl(t *testing.T) {
+	var _ terraform.ResourceProvider = Provider()
+}
+
+func testAccPreCheck(t *testing.T) {
+	if v := os.Getenv("AZURE_SETTINGS_FILE"); v == "" {
+		subscriptionID := os.Getenv("AZURE_SUBSCRIPTION_ID")
+		certificate := os.Getenv("AZURE_CERTIFICATE")
+
+		if subscriptionID == "" || certificate == "" {
+			t.Fatal("either AZURE_SETTINGS_FILE, or AZURE_SUBSCRIPTION_ID " +
+				"and AZURE_CERTIFICATE must be set for acceptance tests")
+		}
+	}
+
+	if v := os.Getenv("AZURE_STORAGE"); v == "" {
+		t.Fatal("AZURE_STORAGE must be set for acceptance tests")
+	}
+}
diff --git a/builtin/providers/azure/resource_azure_affinity_group.go b/builtin/providers/azure/resource_azure_affinity_group.go
new file mode 100644
index 000000000..5dd5bced4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_affinity_group.go
@@ -0,0 +1,168 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/affinitygroup"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureAffinityGroup returns the *schema.Resource associated to a
+// resource affinity group on Azure.
+func resourceAzureAffinityGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureAffinityGroupCreate,
+		Read:   resourceAzureAffinityGroupRead,
+		Update: resourceAzureAffinityGroupUpdate,
+		Exists: resourceAzureAffinityGroupExists,
+		Delete: resourceAzureAffinityGroupDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+		},
+	}
+}
+
+// resourceAzureAffinityGroupCreate does all the necessary API calls to
+// create an affinity group on Azure.
+func resourceAzureAffinityGroupCreate(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Begun creating Azure Affinity Group creation request.")
+	name := d.Get("name").(string)
+	params := affinitygroup.CreateAffinityGroupParams{
+		Name:     name,
+		Label:    d.Get("label").(string),
+		Location: d.Get("location").(string),
+	}
+
+	if desc, ok := d.GetOk("description"); ok {
+		params.Description = desc.(string)
+	}
+
+	log.Println("[INFO] Sending Affinity Group creation request to Azure.")
+	err := affinityGroupClient.CreateAffinityGroup(params)
+	if err != nil {
+		return fmt.Errorf("Error issuing Azure Affinity Group creation: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureAffinityGroupRead does all the necessary API calls to
+// read the state of the affinity group off Azure.
+func resourceAzureAffinityGroupRead(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Issuing Azure Affinity Group list request.")
+	affinityGroups, err := affinityGroupClient.ListAffinityGroups()
+	if err != nil {
+		return fmt.Errorf("Error obtaining Affinity Group list off Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+	for _, group := range affinityGroups.AffinityGroups {
+		if group.Name == name {
+			found = true
+			d.Set("location", group.Location)
+			d.Set("label", group.Label)
+			d.Set("description", group.Description)
+			break
+		}
+	}
+
+	if !found {
+		// it means the affinity group has been deleted in the meantime, so we
+		// must stop tracking it:
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureAffinityGroupUpdate does all the necessary API calls to
+// update the state of the affinity group on Azure.
+func resourceAzureAffinityGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	name := d.Get("name").(string)
+	clabel := d.HasChange("label")
+	cdesc := d.HasChange("description")
+	if clabel || cdesc {
+		log.Println("[INFO] Beginning Affinity Group update process.")
+		params := affinitygroup.UpdateAffinityGroupParams{}
+
+		if clabel {
+			params.Label = d.Get("label").(string)
+		}
+		if cdesc {
+			params.Description = d.Get("description").(string)
+		}
+
+		log.Println("[INFO] Sending Affinity Group update request to Azure.")
+		err := affinityGroupClient.UpdateAffinityGroup(name, params)
+		if err != nil {
+			return fmt.Errorf("Error updating Azure Affinity Group parameters: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureAffinityGroupExists does all the necessary API calls to
+// check for the existence of the affinity group on Azure.
+func resourceAzureAffinityGroupExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Issuing Azure Affinity Group get request.")
+	name := d.Get("name").(string)
+	_, err := affinityGroupClient.GetAffinityGroup(name)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// it means that the affinity group has been deleted in the
+			// meantime, so we must untrack it from the schema:
+			d.SetId("")
+			return false, nil
+		} else {
+			return false, fmt.Errorf("Error getting Affinity Group off Azure: %s", err)
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureAffinityGroupDelete does all the necessary API calls to
+// delete the affinity group off Azure.
+func resourceAzureAffinityGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	affinityGroupClient := meta.(*Client).affinityGroupClient
+
+	log.Println("[INFO] Sending Affinity Group deletion request to Azure.")
+	name := d.Get("name").(string)
+	err := affinityGroupClient.DeleteAffinityGroup(name)
+	if err != nil {
+		return fmt.Errorf("Error deleting Azure Affinity Group: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_affinity_group_test.go b/builtin/providers/azure/resource_azure_affinity_group_test.go
new file mode 100644
index 000000000..1cc5211c4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_affinity_group_test.go
@@ -0,0 +1,121 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureAffinityGroupBasic(t *testing.T) {
+	name := "azure_affinity_group.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureAffinityGroupDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "A nice label."),
+					resource.TestCheckResourceAttr(name, "description", "A nice description."),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureAffinityGroupUpdate(t *testing.T) {
+	name := "azure_affinity_group.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureAffinityGroupDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "A nice label."),
+					resource.TestCheckResourceAttr(name, "description", "A nice description."),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureAffinityGroupUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureAffinityGroupExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-group"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "label", "An even nicer label."),
+					resource.TestCheckResourceAttr(name, "description", "An even nicer description."),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureAffinityGroupExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Affinity Group resource %q doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Affinity Group resource %q ID not set.", name)
+		}
+
+		affinityGroupClient := testAccProvider.Meta().(*Client).affinityGroupClient
+		_, err := affinityGroupClient.GetAffinityGroup(resource.Primary.ID)
+		return err
+	}
+}
+
+func testAccCheckAzureAffinityGroupDestroyed(s *terraform.State) error {
+	var err error
+	affinityGroupClient := testAccProvider.Meta().(*Client).affinityGroupClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_affinity_group" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Affinity Group resource ID not set.")
+		}
+
+		_, err = affinityGroupClient.GetAffinityGroup(resource.Primary.ID)
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureAffinityGroupConfig = `
+resource "azure_affinity_group" "foo" {
+	name = "terraform-testing-group"
+	location = "West US"
+	label = "A nice label."
+	description = "A nice description."
+}
+`
+
+const testAccAzureAffinityGroupUpdateConfig = `
+resource "azure_affinity_group" "foo" {
+	name = "terraform-testing-group"
+	location = "West US"
+	label = "An even nicer label."
+	description = "An even nicer description."
+}
+`
diff --git a/builtin/providers/azure/resource_azure_data_disk.go b/builtin/providers/azure/resource_azure_data_disk.go
new file mode 100644
index 000000000..6e48b976a
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_data_disk.go
@@ -0,0 +1,343 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const dataDiskBlobStorageURL = "http://%s.blob.core.windows.net/disks/%s.vhd"
+
+func resourceAzureDataDisk() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureDataDiskCreate,
+		Read:   resourceAzureDataDiskRead,
+		Update: resourceAzureDataDiskUpdate,
+		Delete: resourceAzureDataDiskDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"lun": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+
+			"size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+
+			"caching": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "None",
+			},
+
+			"storage_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"media_link": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"source_media_link": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"virtual_machine": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAzureDataDiskCreate(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	if err := verifyDataDiskParameters(d); err != nil {
+		return err
+	}
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	label := d.Get("label").(string)
+	if label == "" {
+		label = fmt.Sprintf("%s-%d", vm, lun)
+	}
+
+	p := virtualmachinedisk.CreateDataDiskParameters{
+		DiskLabel:           label,
+		Lun:                 lun,
+		LogicalDiskSizeInGB: d.Get("size").(int),
+		HostCaching:         hostCaching(d),
+		MediaLink:           mediaLink(d),
+		SourceMediaLink:     d.Get("source_media_link").(string),
+	}
+
+	if name, ok := d.GetOk("name"); ok {
+		p.DiskName = name.(string)
+	}
+
+	log.Printf("[DEBUG] Adding data disk %d to instance: %s", lun, vm)
+	req, err := vmDiskClient.AddDataDisk(vm, vm, vm, p)
+	if err != nil {
+		return fmt.Errorf("Error adding data disk %d to instance %s: %s", lun, vm, err)
+	}
+
+	// Wait until the data disk is added
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for data disk %d to be added to instance %s: %s", lun, vm, err)
+	}
+
+	log.Printf("[DEBUG] Retrieving data disk %d from instance %s", lun, vm)
+	disk, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+	if err != nil {
+		return fmt.Errorf("Error retrieving data disk %d from instance %s: %s", lun, vm, err)
+	}
+
+	d.SetId(disk.DiskName)
+
+	return resourceAzureDataDiskRead(d, meta)
+}
+
+func resourceAzureDataDiskRead(d *schema.ResourceData, meta interface{}) error {
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	log.Printf("[DEBUG] Retrieving data disk: %s", d.Id())
+	datadisk, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving data disk %s: %s", d.Id(), err)
+	}
+
+	d.Set("name", datadisk.DiskName)
+	d.Set("label", datadisk.DiskLabel)
+	d.Set("lun", datadisk.Lun)
+	d.Set("size", datadisk.LogicalDiskSizeInGB)
+	d.Set("caching", datadisk.HostCaching)
+	d.Set("media_link", datadisk.MediaLink)
+
+	log.Printf("[DEBUG] Retrieving disk: %s", d.Id())
+	disk, err := vmDiskClient.GetDisk(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error retrieving disk %s: %s", d.Id(), err)
+	}
+
+	d.Set("virtual_machine", disk.AttachedTo.RoleName)
+
+	return nil
+}
+
+func resourceAzureDataDiskUpdate(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	if d.HasChange("lun") || d.HasChange("size") || d.HasChange("virtual_machine") {
+		olun, _ := d.GetChange("lun")
+		ovm, _ := d.GetChange("virtual_machine")
+
+		log.Printf("[DEBUG] Detaching data disk: %s", d.Id())
+		req, err := vmDiskClient.
+			DeleteDataDisk(ovm.(string), ovm.(string), ovm.(string), olun.(int), false)
+		if err != nil {
+			return fmt.Errorf("Error detaching data disk %s: %s", d.Id(), err)
+		}
+
+		// Wait until the data disk is detached
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be detached: %s", d.Id(), err)
+		}
+
+		log.Printf("[DEBUG] Verifying data disk %s is properly detached...", d.Id())
+		for i := 0; i < 6; i++ {
+			disk, err := vmDiskClient.GetDisk(d.Id())
+			if err != nil {
+				return fmt.Errorf("Error retrieving disk %s: %s", d.Id(), err)
+			}
+
+			// Check if the disk is really detached
+			if disk.AttachedTo.RoleName == "" {
+				break
+			}
+
+			// If not, wait 30 seconds and try it again...
+			time.Sleep(time.Duration(30 * time.Second))
+		}
+
+		if d.HasChange("size") {
+			p := virtualmachinedisk.UpdateDiskParameters{
+				Name:            d.Id(),
+				Label:           d.Get("label").(string),
+				ResizedSizeInGB: d.Get("size").(int),
+			}
+
+			log.Printf("[DEBUG] Updating disk: %s", d.Id())
+			req, err := vmDiskClient.UpdateDisk(d.Id(), p)
+			if err != nil {
+				return fmt.Errorf("Error updating disk %s: %s", d.Id(), err)
+			}
+
+			// Wait until the disk is updated
+			if err := mc.WaitForOperation(req, nil); err != nil {
+				return fmt.Errorf(
+					"Error waiting for disk %s to be updated: %s", d.Id(), err)
+			}
+		}
+
+		p := virtualmachinedisk.CreateDataDiskParameters{
+			DiskName:    d.Id(),
+			Lun:         lun,
+			HostCaching: hostCaching(d),
+			MediaLink:   mediaLink(d),
+		}
+
+		log.Printf("[DEBUG] Attaching data disk: %s", d.Id())
+		req, err = vmDiskClient.AddDataDisk(vm, vm, vm, p)
+		if err != nil {
+			return fmt.Errorf("Error attaching data disk %s to instance %s: %s", d.Id(), vm, err)
+		}
+
+		// Wait until the data disk is attached
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be attached to instance %s: %s", d.Id(), vm, err)
+		}
+
+		// Make sure we return here since all possible changes are
+		// already updated if we reach this point
+		return nil
+	}
+
+	if d.HasChange("caching") {
+		p := virtualmachinedisk.UpdateDataDiskParameters{
+			DiskName:    d.Id(),
+			Lun:         lun,
+			HostCaching: hostCaching(d),
+			MediaLink:   mediaLink(d),
+		}
+
+		log.Printf("[DEBUG] Updating data disk: %s", d.Id())
+		req, err := vmDiskClient.UpdateDataDisk(vm, vm, vm, lun, p)
+		if err != nil {
+			return fmt.Errorf("Error updating data disk %s: %s", d.Id(), err)
+		}
+
+		// Wait until the data disk is updated
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for data disk %s to be updated: %s", d.Id(), err)
+		}
+	}
+
+	return resourceAzureDataDiskRead(d, meta)
+}
+
+func resourceAzureDataDiskDelete(d *schema.ResourceData, meta interface{}) error {
+	mc := meta.(*Client).mgmtClient
+	vmDiskClient := meta.(*Client).vmDiskClient
+
+	lun := d.Get("lun").(int)
+	vm := d.Get("virtual_machine").(string)
+
+	// If a name was not supplied, it means we created a new emtpy disk and we now want to
+	// delete that disk again. Otherwise we only want to detach the disk and keep the blob.
+	_, removeBlob := d.GetOk("name")
+
+	log.Printf("[DEBUG] Detaching data disk %s with removeBlob = %t", d.Id(), removeBlob)
+	req, err := vmDiskClient.DeleteDataDisk(vm, vm, vm, lun, removeBlob)
+	if err != nil {
+		return fmt.Errorf(
+			"Error detaching data disk %s with removeBlob = %t: %s", d.Id(), removeBlob, err)
+	}
+
+	// Wait until the data disk is detached and optionally deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for data disk %s to be detached with removeBlob = %t: %s",
+			d.Id(), removeBlob, err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+func hostCaching(d *schema.ResourceData) virtualmachinedisk.HostCachingType {
+	switch d.Get("caching").(string) {
+	case "ReadOnly":
+		return virtualmachinedisk.HostCachingTypeReadOnly
+	case "ReadWrite":
+		return virtualmachinedisk.HostCachingTypeReadWrite
+	default:
+		return virtualmachinedisk.HostCachingTypeNone
+	}
+}
+
+func mediaLink(d *schema.ResourceData) string {
+	mediaLink, ok := d.GetOk("media_link")
+	if ok {
+		return mediaLink.(string)
+	}
+
+	name, ok := d.GetOk("name")
+	if !ok {
+		name = fmt.Sprintf("%s-%d", d.Get("virtual_machine").(string), d.Get("lun").(int))
+	}
+
+	return fmt.Sprintf(dataDiskBlobStorageURL, d.Get("storage_service_name").(string), name.(string))
+}
+
+func verifyDataDiskParameters(d *schema.ResourceData) error {
+	caching := d.Get("caching").(string)
+	if caching != "None" && caching != "ReadOnly" && caching != "ReadWrite" {
+		return fmt.Errorf(
+			"Invalid caching type %s! Valid options are 'None', 'ReadOnly' and 'ReadWrite'.", caching)
+	}
+
+	if _, ok := d.GetOk("media_link"); !ok {
+		if _, ok := d.GetOk("storage_service_name"); !ok {
+			return fmt.Errorf("If not supplying 'media_link', you must supply 'storage'.")
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_data_disk_test.go b/builtin/providers/azure/resource_azure_data_disk_test.go
new file mode 100644
index 000000000..dfad26b5e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_data_disk_test.go
@@ -0,0 +1,235 @@
+package azure
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachinedisk"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureDataDisk_basic(t *testing.T) {
+	var disk virtualmachinedisk.DataDiskResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDataDiskDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDataDisk_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					testAccCheckAzureDataDiskAttributes(&disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test-0"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "10"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureDataDisk_update(t *testing.T) {
+	var disk virtualmachinedisk.DataDiskResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDataDiskDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDataDisk_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test1-1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "lun", "1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "10"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "caching", "ReadOnly"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "virtual_machine", "terraform-test1"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureDataDisk_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDataDiskExists(
+						"azure_data_disk.foo", &disk),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "label", "terraform-test1-1"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "lun", "2"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "size", "20"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "caching", "ReadWrite"),
+					resource.TestCheckResourceAttr(
+						"azure_data_disk.foo", "virtual_machine", "terraform-test2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureDataDiskExists(
+	n string,
+	disk *virtualmachinedisk.DataDiskResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Data Disk ID is set")
+		}
+
+		vm := rs.Primary.Attributes["virtual_machine"]
+		lun, err := strconv.Atoi(rs.Primary.Attributes["lun"])
+		if err != nil {
+			return err
+		}
+
+		vmDiskClient := testAccProvider.Meta().(*Client).vmDiskClient
+		d, err := vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+		if err != nil {
+			return err
+		}
+
+		if d.DiskName != rs.Primary.ID {
+			return fmt.Errorf("Data Disk not found")
+		}
+
+		*disk = d
+
+		return nil
+	}
+}
+
+func testAccCheckAzureDataDiskAttributes(
+	disk *virtualmachinedisk.DataDiskResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if disk.Lun != 0 {
+			return fmt.Errorf("Bad lun: %d", disk.Lun)
+		}
+
+		if disk.LogicalDiskSizeInGB != 10 {
+			return fmt.Errorf("Bad size: %d", disk.LogicalDiskSizeInGB)
+		}
+
+		if disk.HostCaching != "None" {
+			return fmt.Errorf("Bad caching: %s", disk.HostCaching)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureDataDiskDestroy(s *terraform.State) error {
+	vmDiskClient := testAccProvider.Meta().(*Client).vmDiskClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_data_disk" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Disk ID is set")
+		}
+
+		vm := rs.Primary.Attributes["virtual_machine"]
+		lun, err := strconv.Atoi(rs.Primary.Attributes["lun"])
+		if err != nil {
+			return err
+		}
+
+		_, err = vmDiskClient.GetDataDisk(vm, vm, vm, lun)
+		if err == nil {
+			return fmt.Errorf("Data disk %s still exists", rs.Primary.ID)
+		}
+
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureDataDisk_basic = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 0
+    size = 10
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    virtual_machine = "${azure_instance.foo.id}"
+}`, testAccStorageServiceName)
+
+var testAccAzureDataDisk_advanced = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 1
+    size = 10
+    caching = "ReadOnly"
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    virtual_machine = "${azure_instance.foo.id}"
+}`, testAccStorageServiceName)
+
+var testAccAzureDataDisk_update = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_instance" "bar" {
+    name = "terraform-test2"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "${azure_instance.foo.storage_service_name}"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+}
+
+resource "azure_data_disk" "foo" {
+    lun = 2
+    size = 20
+    caching = "ReadWrite"
+    storage_service_name = "${azure_instance.bar.storage_service_name}"
+    virtual_machine = "${azure_instance.bar.id}"
+}`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_dns_server.go b/builtin/providers/azure/resource_azure_dns_server.go
new file mode 100644
index 000000000..dd4e380dc
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_dns_server.go
@@ -0,0 +1,240 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureDnsServer returns the *schema.Resource associated
+// to an Azure hosted service.
+func resourceAzureDnsServer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureDnsServerCreate,
+		Read:   resourceAzureDnsServerRead,
+		Update: resourceAzureDnsServerUpdate,
+		Exists: resourceAzureDnsServerExists,
+		Delete: resourceAzureDnsServerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"dns_address": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["dns_address"],
+			},
+		},
+	}
+}
+
+// resourceAzureDnsServerCreate does all the necessary API calls
+// to create a new DNS server definition on Azure.
+func resourceAzureDnsServerCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network configuration exists yet; create one now:
+			netConf = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+	}
+
+	log.Println("[DEBUG] Adding new DNS server definition to Azure.")
+	name := d.Get("name").(string)
+	address := d.Get("dns_address").(string)
+	netConf.Configuration.DNS.DNSServers = append(
+		netConf.Configuration.DNS.DNSServers,
+		virtualnetwork.DNSServer{
+			Name:      name,
+			IPAddress: address,
+		})
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error setting network configuration: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureDnsServerRead does all the necessary API calls to read
+// the state of the DNS server off Azure.
+func resourceAzureDnsServerRead(d *schema.ResourceData, meta interface{}) error {
+	vnetClient := meta.(*Client).vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+
+	// search for our DNS and update it if the IP has been changed:
+	for _, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			found = true
+			d.Set("dns_address", dns.IPAddress)
+			break
+		}
+	}
+
+	// remove the resource from the state if it has been deleted in the meantime:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureDnsServerUpdate does all the necessary API calls
+// to update the DNS definition on Azure.
+func resourceAzureDnsServerUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	var found bool
+	name := d.Get("name").(string)
+
+	if d.HasChange("dns_address") {
+		log.Println("[DEBUG] DNS server address has changes; updating it on Azure.")
+		log.Println("[INFO] Fetching current network configuration from Azure.")
+		azureClient.mutex.Lock()
+		defer azureClient.mutex.Unlock()
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+
+		// search for our DNS and update its address value:
+		for i, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == name {
+				found = true
+				netConf.Configuration.DNS.DNSServers[i].IPAddress = d.Get("dns_address").(string)
+				break
+			}
+		}
+
+		// if the config has changes, send the configuration back to Azure:
+		if found {
+			log.Println("[INFO] Sending updated network configuration back to Azure.")
+			reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+			if err != nil {
+				return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+			}
+			err = mgmtClient.WaitForOperation(reqID, nil)
+			if err != nil {
+				return fmt.Errorf("Error setting network configuration: %s", err)
+			}
+
+			return nil
+		}
+	}
+
+	// remove the resource from the state if it has been deleted in the meantime:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureDnsServerExists does all the necessary API calls to
+// check if the DNS server definition alredy exists on Azure.
+func resourceAzureDnsServerExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return false, fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for the DNS server's definition:
+	for _, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			return true, nil
+		}
+	}
+
+	// if we reached this point; the resource must have been deleted; and we must untrack it:
+	d.SetId("")
+	return false, nil
+}
+
+// resourceAzureDnsServerDelete does all the necessary API calls
+// to delete the DNS server definition from Azure.
+func resourceAzureDnsServerDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for the DNS server's definition and remove it:
+	var found bool
+	for i, dns := range netConf.Configuration.DNS.DNSServers {
+		if dns.Name == name {
+			found = true
+			netConf.Configuration.DNS.DNSServers = append(
+				netConf.Configuration.DNS.DNSServers[:i],
+				netConf.Configuration.DNS.DNSServers[i+1:]...,
+			)
+			break
+		}
+	}
+
+	// if not found; don't bother re-sending the natwork config:
+	if !found {
+		return nil
+	}
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed issuing update to network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error setting network configuration: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_dns_server_test.go b/builtin/providers/azure/resource_azure_dns_server_test.go
new file mode 100644
index 000000000..8b8e335b4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_dns_server_test.go
@@ -0,0 +1,126 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureDnsServerBasic(t *testing.T) {
+	name := "azure_dns_server.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDnsServerDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDnsServerBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.8.8"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureDnsServerUpdate(t *testing.T) {
+	name := "azure_dns_server.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureDnsServerDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDnsServerBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.8.8"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureDnsServerUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureDnsServerExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-dns-server"),
+					resource.TestCheckResourceAttr(name, "dns_address", "8.8.4.4"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureDnsServerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No DNS Server ID set.")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Failed fetching networking configuration: %s", err)
+		}
+
+		for _, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Azure DNS Server not found.")
+	}
+}
+
+func testAccCheckAzureDnsServerDestroy(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_dns_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No DNS Server ID is set.")
+		}
+
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Error retrieving networking configuration from Azure: %s", err)
+		}
+
+		for _, dns := range netConf.Configuration.DNS.DNSServers {
+			if dns.Name == resource.Primary.ID {
+				return fmt.Errorf("Azure DNS Server still exists.")
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureDnsServerBasic = `
+resource "azure_dns_server" "foo" {
+    name = "terraform-dns-server"
+    dns_address = "8.8.8.8"
+}
+`
+
+const testAccAzureDnsServerUpdate = `
+resource "azure_dns_server" "foo" {
+    name = "terraform-dns-server"
+    dns_address = "8.8.4.4"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_hosted_service.go b/builtin/providers/azure/resource_azure_hosted_service.go
new file mode 100644
index 000000000..3d7a638a6
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_hosted_service.go
@@ -0,0 +1,168 @@
+package azure
+
+import (
+	"encoding/base64"
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureHostedService returns the schema.Resource associated to an
+// Azure hosted service.
+func resourceAzureHostedService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureHostedServiceCreate,
+		Read:   resourceAzureHostedServiceRead,
+		Update: resourceAzureHostedServiceUpdate,
+		Delete: resourceAzureHostedServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"location": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["location"],
+			},
+			"ephemeral_contents": &schema.Schema{
+				Type:        schema.TypeBool,
+				Required:    true,
+				Description: parameterDescriptions["ephemeral_contents"],
+			},
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"status": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"reverse_dns_fqdn": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: parameterDescriptions["reverse_dns_fqdn"],
+			},
+			"label": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Optional:    true,
+				Default:     "Made by Terraform.",
+				Description: parameterDescriptions["label"],
+			},
+			"description": &schema.Schema{
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Optional:    true,
+				Description: parameterDescriptions["description"],
+			},
+			"default_certificate_thumbprint": &schema.Schema{
+				Type:        schema.TypeString,
+				Computed:    true,
+				Optional:    true,
+				Description: parameterDescriptions["default_certificate_thumbprint"],
+			},
+		},
+	}
+}
+
+// resourceAzureHostedServiceCreate does all the necessary API calls
+// to create a hosted service on Azure.
+func resourceAzureHostedServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	hostedServiceClient := meta.(*Client).hostedServiceClient
+
+	serviceName := d.Get("name").(string)
+	location := d.Get("location").(string)
+	reverseDNS := d.Get("reverse_dns_fqdn").(string)
+	description := d.Get("description").(string)
+	label := base64.StdEncoding.EncodeToString([]byte(d.Get("label").(string)))
+
+	err := hostedServiceClient.CreateHostedService(
+		hostedservice.CreateHostedServiceParameters{
+			ServiceName:    serviceName,
+			Location:       location,
+			Label:          label,
+			Description:    description,
+			ReverseDNSFqdn: reverseDNS,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("Failed defining new Azure hosted service: %s", err)
+	}
+
+	d.SetId(serviceName)
+	return nil
+}
+
+// resourceAzureHostedServiceRead does all the necessary API calls
+// to read the state of a hosted service from Azure.
+func resourceAzureHostedServiceRead(d *schema.ResourceData, meta interface{}) error {
+	hostedServiceClient := meta.(*Client).hostedServiceClient
+
+	log.Println("[INFO] Querying for hosted service info.")
+	serviceName := d.Get("name").(string)
+	hostedService, err := hostedServiceClient.GetHostedService(serviceName)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// it means the hosted service was deleted in the meantime,
+			// so we must remove it here:
+			d.SetId("")
+			return nil
+		} else {
+			return fmt.Errorf("Failed to get hosted service: %s", err)
+		}
+	}
+
+	log.Println("[DEBUG] Reading hosted service query result data.")
+	d.Set("name", hostedService.ServiceName)
+	d.Set("url", hostedService.URL)
+	d.Set("location", hostedService.Location)
+	d.Set("description", hostedService.Description)
+	d.Set("label", hostedService.Label)
+	d.Set("status", hostedService.Status)
+	d.Set("reverse_dns_fqdn", hostedService.ReverseDNSFqdn)
+	d.Set("default_certificate_thumbprint", hostedService.DefaultWinRmCertificateThumbprint)
+
+	return nil
+}
+
+// resourceAzureHostedServiceUpdate does all the necessary API calls to
+// update some settings of a hosted service on Azure.
+func resourceAzureHostedServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	// NOTE: although no-op; this is still required in order for updates to
+	// ephemeral_contents to be possible.
+
+	// check if the service still exists:
+	return resourceAzureHostedServiceRead(d, meta)
+}
+
+// resourceAzureHostedServiceDelete does all the necessary API calls to
+// delete a hosted service from Azure.
+func resourceAzureHostedServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	hostedServiceClient := azureClient.hostedServiceClient
+
+	log.Println("[INFO] Issuing hosted service deletion.")
+	serviceName := d.Get("name").(string)
+	ephemeral := d.Get("ephemeral_contents").(bool)
+	reqID, err := hostedServiceClient.DeleteHostedService(serviceName, ephemeral)
+	if err != nil {
+		return fmt.Errorf("Failed issuing hosted service deletion request: %s", err)
+	}
+
+	log.Println("[DEBUG] Awaiting confirmation on hosted service deletion.")
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error on hosted service deletion: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_hosted_service_test.go b/builtin/providers/azure/resource_azure_hosted_service_test.go
new file mode 100644
index 000000000..bbad19632
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_hosted_service_test.go
@@ -0,0 +1,123 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureHostedServiceBasic(t *testing.T) {
+	name := "azure_hosted_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureHostedServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureHostedServiceBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "false"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureHostedServiceUpdate(t *testing.T) {
+	name := "azure_hosted_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureHostedServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureHostedServiceBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "false"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureHostedServiceUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureHostedServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(name, "location", "North Europe"),
+					resource.TestCheckResourceAttr(name, "ephemeral_contents", "true"),
+					resource.TestCheckResourceAttr(name, "description", "very discriptive"),
+					resource.TestCheckResourceAttr(name, "label", "very identifiable"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureHostedServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Hosted Service resource not found.")
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Resource's ID is not set.")
+		}
+
+		hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+		_, err := hostedServiceClient.GetHostedService(resource.Primary.ID)
+		return err
+	}
+}
+
+func testAccCheckAzureHostedServiceDestroyed(s *terraform.State) error {
+	hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_hosted_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("No Azure Hosted Service Resource found.")
+		}
+
+		_, err := hostedServiceClient.GetHostedService(resource.Primary.ID)
+
+		return testAccResourceDestroyedErrorFilter("Hosted Service", err)
+	}
+
+	return nil
+}
+
+const testAccAzureHostedServiceBasic = `
+resource "azure_hosted_service" "foo" {
+	name = "terraform-testing-service"
+	location = "North Europe"
+    ephemeral_contents = false
+	description = "very discriptive"
+    label = "very identifiable"
+}
+`
+const testAccAzureHostedServiceUpdate = `
+resource "azure_hosted_service" "foo" {
+	name = "terraform-testing-service"
+	location = "North Europe"
+    ephemeral_contents = true
+	description = "very discriptive"
+    label = "very identifiable"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_instance.go b/builtin/providers/azure/resource_azure_instance.go
new file mode 100644
index 000000000..b273675f5
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_instance.go
@@ -0,0 +1,720 @@
+package azure
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/hostedservice"
+	"github.com/Azure/azure-sdk-for-go/management/osimage"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachineimage"
+	"github.com/Azure/azure-sdk-for-go/management/vmutils"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const (
+	linux                = "Linux"
+	windows              = "Windows"
+	osDiskBlobStorageURL = "http://%s.blob.core.windows.net/vhds/%s.vhd"
+)
+
+func resourceAzureInstance() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureInstanceCreate,
+		Read:   resourceAzureInstanceRead,
+		Update: resourceAzureInstanceUpdate,
+		Delete: resourceAzureInstanceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"hosted_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"description": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"image": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"size": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"subnet": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"virtual_network": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"storage_service_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"reverse_dns": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"automatic_updates": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				ForceNew: true,
+			},
+
+			"time_zone": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"username": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"password": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"ssh_key_thumbprint": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"endpoint": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+
+						"protocol": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							Default:  "tcp",
+						},
+
+						"public_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+
+						"private_port": &schema.Schema{
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+				Set: resourceAzureEndpointHash,
+			},
+
+			"security_group": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
+			"ip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"vip_address": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAzureInstanceCreate(d *schema.ResourceData, meta interface{}) (err error) {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	hostedServiceClient := azureClient.hostedServiceClient
+	vmClient := azureClient.vmClient
+
+	name := d.Get("name").(string)
+
+	// Compute/set the description
+	description := d.Get("description").(string)
+	if description == "" {
+		description = name
+	}
+
+	// Retrieve the needed details of the image
+	configureForImage, osType, err := retrieveImageDetails(
+		meta,
+		d.Get("image").(string),
+		name,
+		d.Get("storage_service_name").(string),
+	)
+	if err != nil {
+		return err
+	}
+
+	// Verify if we have all required parameters
+	if err := verifyInstanceParameters(d, osType); err != nil {
+		return err
+	}
+
+	var hostedServiceName string
+	// check if hosted service name parameter was given:
+	if serviceName, ok := d.GetOk("hosted_service_name"); !ok {
+		// if not provided; just use the name of the instance to create a new one:
+		hostedServiceName = name
+		d.Set("hosted_service_name", hostedServiceName)
+
+		p := hostedservice.CreateHostedServiceParameters{
+			ServiceName:    hostedServiceName,
+			Label:          base64.StdEncoding.EncodeToString([]byte(name)),
+			Description:    fmt.Sprintf("Cloud Service created automatically for instance %s", name),
+			Location:       d.Get("location").(string),
+			ReverseDNSFqdn: d.Get("reverse_dns").(string),
+		}
+
+		log.Printf("[DEBUG] Creating Cloud Service for instance: %s", name)
+		err = hostedServiceClient.CreateHostedService(p)
+		if err != nil {
+			return fmt.Errorf("Error creating Cloud Service for instance %s: %s", name, err)
+		}
+	} else {
+		// else; use the provided hosted service name:
+		hostedServiceName = serviceName.(string)
+	}
+
+	// Create a new role for the instance
+	role := vmutils.NewVMConfiguration(name, d.Get("size").(string))
+
+	log.Printf("[DEBUG] Configuring deployment from image...")
+	err = configureForImage(&role)
+	if err != nil {
+		return fmt.Errorf("Error configuring the deployment for %s: %s", name, err)
+	}
+
+	if osType == linux {
+		// This is pretty ugly, but the Azure SDK leaves me no other choice...
+		if tp, ok := d.GetOk("ssh_key_thumbprint"); ok {
+			err = vmutils.ConfigureForLinux(
+				&role,
+				name,
+				d.Get("username").(string),
+				d.Get("password").(string),
+				tp.(string),
+			)
+		} else {
+			err = vmutils.ConfigureForLinux(
+				&role,
+				name,
+				d.Get("username").(string),
+				d.Get("password").(string),
+			)
+		}
+		if err != nil {
+			return fmt.Errorf("Error configuring %s for Linux: %s", name, err)
+		}
+	}
+
+	if osType == windows {
+		err = vmutils.ConfigureForWindows(
+			&role,
+			name,
+			d.Get("username").(string),
+			d.Get("password").(string),
+			d.Get("automatic_updates").(bool),
+			d.Get("time_zone").(string),
+		)
+		if err != nil {
+			return fmt.Errorf("Error configuring %s for Windows: %s", name, err)
+		}
+	}
+
+	if s := d.Get("endpoint").(*schema.Set); s.Len() > 0 {
+		for _, v := range s.List() {
+			m := v.(map[string]interface{})
+			err := vmutils.ConfigureWithExternalPort(
+				&role,
+				m["name"].(string),
+				m["private_port"].(int),
+				m["public_port"].(int),
+				endpointProtocol(m["protocol"].(string)),
+			)
+			if err != nil {
+				return fmt.Errorf(
+					"Error adding endpoint %s for instance %s: %s", m["name"].(string), name, err)
+			}
+		}
+	}
+
+	if subnet, ok := d.GetOk("subnet"); ok {
+		err = vmutils.ConfigureWithSubnet(&role, subnet.(string))
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating subnet %s with instance %s: %s", d.Get("subnet").(string), name, err)
+		}
+	}
+
+	if sg, ok := d.GetOk("security_group"); ok {
+		err = vmutils.ConfigureWithSecurityGroup(&role, sg.(string))
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating security group %s with instance %s: %s", sg.(string), name, err)
+		}
+	}
+
+	options := virtualmachine.CreateDeploymentOptions{
+		VirtualNetworkName: d.Get("virtual_network").(string),
+	}
+
+	log.Printf("[DEBUG] Creating the new instance...")
+	req, err := vmClient.CreateDeployment(role, hostedServiceName, options)
+	if err != nil {
+		return fmt.Errorf("Error creating instance %s: %s", name, err)
+	}
+
+	log.Printf("[DEBUG] Waiting for the new instance to be created...")
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for instance %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureInstanceRead(d, meta)
+}
+
+func resourceAzureInstanceRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	hostedServiceClient := azureClient.hostedServiceClient
+	vmClient := azureClient.vmClient
+
+	name := d.Get("name").(string)
+
+	// check if the instance belongs to an independent hosted service
+	// or it had one created for it.
+	var hostedServiceName string
+	if serviceName, ok := d.GetOk("hosted_service_name"); ok {
+		// if independent; use that hosted service name:
+		hostedServiceName = serviceName.(string)
+	} else {
+		// else; suppose it's the instance's name:
+		hostedServiceName = name
+	}
+
+	log.Printf("[DEBUG] Retrieving Cloud Service for instance: %s", name)
+	cs, err := hostedServiceClient.GetHostedService(hostedServiceName)
+	if err != nil {
+		return fmt.Errorf("Error retrieving Cloud Service of instance %s (%q): %s", name, hostedServiceName, err)
+	}
+
+	d.Set("reverse_dns", cs.ReverseDNSFqdn)
+	d.Set("location", cs.Location)
+
+	log.Printf("[DEBUG] Retrieving instance: %s", name)
+	dpmt, err := vmClient.GetDeployment(hostedServiceName, name)
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving instance %s: %s", name, err)
+	}
+
+	if len(dpmt.RoleList) != 1 {
+		return fmt.Errorf(
+			"Instance %s has an unexpected number of roles: %d", name, len(dpmt.RoleList))
+	}
+
+	d.Set("size", dpmt.RoleList[0].RoleSize)
+
+	if len(dpmt.RoleInstanceList) != 1 {
+		return fmt.Errorf(
+			"Instance %s has an unexpected number of role instances: %d",
+			name, len(dpmt.RoleInstanceList))
+	}
+	d.Set("ip_address", dpmt.RoleInstanceList[0].IPAddress)
+
+	if len(dpmt.RoleInstanceList[0].InstanceEndpoints) > 0 {
+		d.Set("vip_address", dpmt.RoleInstanceList[0].InstanceEndpoints[0].Vip)
+	}
+
+	// Find the network configuration set
+	for _, c := range dpmt.RoleList[0].ConfigurationSets {
+		if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+			// Create a new set to hold all configured endpoints
+			endpoints := &schema.Set{
+				F: resourceAzureEndpointHash,
+			}
+
+			// Loop through all endpoints
+			for _, ep := range c.InputEndpoints {
+				endpoint := map[string]interface{}{}
+
+				// Update the values
+				endpoint["name"] = ep.Name
+				endpoint["protocol"] = string(ep.Protocol)
+				endpoint["public_port"] = ep.Port
+				endpoint["private_port"] = ep.LocalPort
+				endpoints.Add(endpoint)
+			}
+			d.Set("endpoint", endpoints)
+
+			// Update the subnet
+			switch len(c.SubnetNames) {
+			case 1:
+				d.Set("subnet", c.SubnetNames[0])
+			case 0:
+				d.Set("subnet", "")
+			default:
+				return fmt.Errorf(
+					"Instance %s has an unexpected number of associated subnets %d",
+					name, len(dpmt.RoleInstanceList))
+			}
+
+			// Update the security group
+			d.Set("security_group", c.NetworkSecurityGroup)
+		}
+	}
+
+	connType := "ssh"
+	if dpmt.RoleList[0].OSVirtualHardDisk.OS == windows {
+		connType = "winrm"
+	}
+
+	// Set the connection info for any configured provisioners
+	d.SetConnInfo(map[string]string{
+		"type":     connType,
+		"host":     dpmt.VirtualIPs[0].Address,
+		"user":     d.Get("username").(string),
+		"password": d.Get("password").(string),
+	})
+
+	return nil
+}
+
+func resourceAzureInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	vmClient := azureClient.vmClient
+
+	// First check if anything we can update changed, and if not just return
+	if !d.HasChange("size") && !d.HasChange("endpoint") && !d.HasChange("security_group") {
+		return nil
+	}
+
+	name := d.Get("name").(string)
+	hostedServiceName := d.Get("hosted_service_name").(string)
+
+	// Get the current role
+	role, err := vmClient.GetRole(hostedServiceName, name, name)
+	if err != nil {
+		return fmt.Errorf("Error retrieving role of instance %s: %s", name, err)
+	}
+
+	// Verify if we have all required parameters
+	if err := verifyInstanceParameters(d, role.OSVirtualHardDisk.OS); err != nil {
+		return err
+	}
+
+	if d.HasChange("size") {
+		role.RoleSize = d.Get("size").(string)
+	}
+
+	if d.HasChange("endpoint") {
+		_, n := d.GetChange("endpoint")
+
+		// Delete the existing endpoints
+		for i, c := range role.ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				c.InputEndpoints = nil
+				role.ConfigurationSets[i] = c
+			}
+		}
+
+		// And add the ones we still want
+		if s := n.(*schema.Set); s.Len() > 0 {
+			for _, v := range s.List() {
+				m := v.(map[string]interface{})
+				err := vmutils.ConfigureWithExternalPort(
+					role,
+					m["name"].(string),
+					m["private_port"].(int),
+					m["public_port"].(int),
+					endpointProtocol(m["protocol"].(string)),
+				)
+				if err != nil {
+					return fmt.Errorf(
+						"Error adding endpoint %s for instance %s: %s", m["name"].(string), name, err)
+				}
+			}
+		}
+	}
+
+	if d.HasChange("security_group") {
+		sg := d.Get("security_group").(string)
+		err := vmutils.ConfigureWithSecurityGroup(role, sg)
+		if err != nil {
+			return fmt.Errorf(
+				"Error associating security group %s with instance %s: %s", sg, name, err)
+		}
+	}
+
+	// Update the adjusted role
+	req, err := vmClient.UpdateRole(hostedServiceName, name, name, *role)
+	if err != nil {
+		return fmt.Errorf("Error updating role of instance %s: %s", name, err)
+	}
+
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for role of instance %s to be updated: %s", name, err)
+	}
+
+	return resourceAzureInstanceRead(d, meta)
+}
+
+func resourceAzureInstanceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	vmClient := azureClient.vmClient
+	hostedServiceClient := azureClient.hostedServiceClient
+
+	name := d.Get("name").(string)
+	hostedServiceName := d.Get("hosted_service_name").(string)
+
+	log.Printf("[DEBUG] Deleting instance: %s", name)
+
+	// check if the instance had a hosted service created especially for it:
+	if name == hostedServiceName {
+		// if so; we must delete the associated hosted service as well:
+		req, err := hostedServiceClient.DeleteHostedService(name, true)
+		if err != nil {
+			return fmt.Errorf("Error deleting instance and hosted service %s: %s", name, err)
+		}
+
+		// Wait until the hosted service and the instance it contains is deleted:
+		if err := mc.WaitForOperation(req, nil); err != nil {
+			return fmt.Errorf(
+				"Error waiting for instance %s to be deleted: %s", name, err)
+		}
+	} else {
+		// else; just delete the instance:
+		reqID, err := vmClient.DeleteDeployment(hostedServiceName, name)
+		if err != nil {
+			return fmt.Errorf("Error deleting instance %s off hosted service %s: %s", name, hostedServiceName, err)
+		}
+
+		// and wait for the deletion:
+		if err := mc.WaitForOperation(reqID, nil); err != nil {
+			return fmt.Errorf("Error waiting for intance %s to be deleted off the hosted service %s: %s",
+				name, hostedServiceName, err)
+		}
+	}
+
+	return nil
+}
+
+func resourceAzureEndpointHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+	buf.WriteString(fmt.Sprintf("%s-", m["name"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%d-", m["public_port"].(int)))
+	buf.WriteString(fmt.Sprintf("%d-", m["private_port"].(int)))
+
+	return hashcode.String(buf.String())
+}
+
+func retrieveImageDetails(
+	meta interface{},
+	label string,
+	name string,
+	storage string) (func(*virtualmachine.Role) error, string, error) {
+
+	azureClient := meta.(*Client)
+	vmImageClient := azureClient.vmImageClient
+	osImageClient := azureClient.osImageClient
+
+	configureForImage, osType, VMLabels, err := retrieveVMImageDetails(vmImageClient, label)
+	if err == nil {
+		return configureForImage, osType, nil
+	}
+
+	configureForImage, osType, OSLabels, err := retrieveOSImageDetails(osImageClient, label, name, storage)
+	if err == nil {
+		return configureForImage, osType, nil
+	}
+
+	return nil, "", fmt.Errorf("Could not find image with label '%s'. Available images are: %s",
+		label, strings.Join(append(VMLabels, OSLabels...), ", "))
+}
+
+func retrieveVMImageDetails(
+	vmImageClient virtualmachineimage.Client,
+	label string) (func(*virtualmachine.Role) error, string, []string, error) {
+	imgs, err := vmImageClient.ListVirtualMachineImages()
+	if err != nil {
+		return nil, "", nil, fmt.Errorf("Error retrieving image details: %s", err)
+	}
+
+	var labels []string
+	for _, img := range imgs.VMImages {
+		if img.Label == label {
+			if img.OSDiskConfiguration.OS != linux && img.OSDiskConfiguration.OS != windows {
+				return nil, "", nil, fmt.Errorf("Unsupported image OS: %s", img.OSDiskConfiguration.OS)
+			}
+
+			configureForImage := func(role *virtualmachine.Role) error {
+				return vmutils.ConfigureDeploymentFromVMImage(
+					role,
+					img.Name,
+					"",
+					true,
+				)
+			}
+
+			return configureForImage, img.OSDiskConfiguration.OS, nil, nil
+		}
+
+		labels = append(labels, img.Label)
+	}
+
+	return nil, "", labels, fmt.Errorf("Could not find image with label '%s'", label)
+}
+
+func retrieveOSImageDetails(
+	osImageClient osimage.OSImageClient,
+	label string,
+	name string,
+	storage string) (func(*virtualmachine.Role) error, string, []string, error) {
+	imgs, err := osImageClient.ListOSImages()
+	if err != nil {
+		return nil, "", nil, fmt.Errorf("Error retrieving image details: %s", err)
+	}
+
+	var labels []string
+	for _, img := range imgs.OSImages {
+		if img.Label == label {
+			if img.OS != linux && img.OS != windows {
+				return nil, "", nil, fmt.Errorf("Unsupported image OS: %s", img.OS)
+			}
+			if img.MediaLink == "" {
+				if storage == "" {
+					return nil, "", nil,
+						fmt.Errorf("When using a platform image, the 'storage' parameter is required")
+				}
+				img.MediaLink = fmt.Sprintf(osDiskBlobStorageURL, storage, name)
+			}
+
+			configureForImage := func(role *virtualmachine.Role) error {
+				return vmutils.ConfigureDeploymentFromPlatformImage(
+					role,
+					img.Name,
+					img.MediaLink,
+					label,
+				)
+			}
+
+			return configureForImage, img.OS, nil, nil
+		}
+
+		labels = append(labels, img.Label)
+	}
+
+	return nil, "", labels, fmt.Errorf("Could not find image with label '%s'", label)
+}
+
+func endpointProtocol(p string) virtualmachine.InputEndpointProtocol {
+	if p == "tcp" {
+		return virtualmachine.InputEndpointProtocolTCP
+	}
+
+	return virtualmachine.InputEndpointProtocolUDP
+}
+
+func verifyInstanceParameters(d *schema.ResourceData, osType string) error {
+	if osType == linux {
+		_, pass := d.GetOk("password")
+		_, key := d.GetOk("ssh_key_thumbprint")
+
+		if !pass && !key {
+			return fmt.Errorf(
+				"You must supply a 'password' and/or a 'ssh_key_thumbprint' when using a Linux image")
+		}
+	}
+
+	if osType == windows {
+		if _, ok := d.GetOk("password"); !ok {
+			return fmt.Errorf("You must supply a 'password' when using a Windows image")
+		}
+
+		if _, ok := d.GetOk("time_zone"); !ok {
+			return fmt.Errorf("You must supply a 'time_zone' when using a Windows image")
+		}
+	}
+
+	if _, ok := d.GetOk("subnet"); ok {
+		if _, ok := d.GetOk("virtual_network"); !ok {
+			return fmt.Errorf("You must also supply a 'virtual_network' when supplying a 'subnet'")
+		}
+	}
+
+	if s := d.Get("endpoint").(*schema.Set); s.Len() > 0 {
+		for _, v := range s.List() {
+			protocol := v.(map[string]interface{})["protocol"].(string)
+
+			if protocol != "tcp" && protocol != "udp" {
+				return fmt.Errorf(
+					"Invalid endpoint protocol %s! Valid options are 'tcp' and 'udp'.", protocol)
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_instance_test.go b/builtin/providers/azure/resource_azure_instance_test.go
new file mode 100644
index 000000000..679aa015b
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_instance_test.go
@@ -0,0 +1,542 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualmachine"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureInstance_basic(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceBasicAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.2462817782.public_port", "22"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_separateHostedService(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(testAccHostedServiceName),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_seperateHostedService,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", testAccHostedServiceName, &dpmt),
+					testAccCheckAzureInstanceBasicAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-testing-service"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.2462817782.public_port", "22"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_advanced(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceAdvancedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "subnet", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "virtual_network", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureInstance_update(t *testing.T) {
+	var dpmt virtualmachine.DeploymentResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureInstanceDestroyed(""),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureInstance_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceAdvancedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "hosted_service_name", "terraform-test1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "subnet", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "virtual_network", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group1"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureInstance_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureInstanceExists(
+						"azure_instance.foo", "", &dpmt),
+					testAccCheckAzureInstanceUpdatedAttributes(&dpmt),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "size", "Basic_A2"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "security_group", "terraform-security-group2"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.1814039778.public_port", "3389"),
+					resource.TestCheckResourceAttr(
+						"azure_instance.foo", "endpoint.3713350066.public_port", "5985"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureInstanceExists(
+	n string,
+	hostedServiceName string,
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No instance ID is set")
+		}
+
+		// if not hosted service was provided; it means that we expect it
+		// to be identical with the name of the instance; which is in the ID.
+		var serviceName string
+		if hostedServiceName == "" {
+			serviceName = rs.Primary.ID
+		} else {
+			serviceName = hostedServiceName
+		}
+
+		vmClient := testAccProvider.Meta().(*Client).vmClient
+		vm, err := vmClient.GetDeployment(serviceName, rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		if vm.Name != rs.Primary.ID {
+			return fmt.Errorf("Instance not found")
+		}
+
+		*dpmt = vm
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceBasicAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A1" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceAdvancedAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test1" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if dpmt.VirtualNetworkName != "terraform-vnet" {
+			return fmt.Errorf("Bad virtual network: %s", dpmt.VirtualNetworkName)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A1" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		for _, c := range dpmt.RoleList[0].ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				if len(c.InputEndpoints) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of endpoints %d",
+						dpmt.Name, len(c.InputEndpoints))
+				}
+
+				if c.InputEndpoints[0].Name != "RDP" {
+					return fmt.Errorf("Bad endpoint name: %s", c.InputEndpoints[0].Name)
+				}
+
+				if c.InputEndpoints[0].Port != 3389 {
+					return fmt.Errorf("Bad endpoint port: %d", c.InputEndpoints[0].Port)
+				}
+
+				if len(c.SubnetNames) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of associated subnets %d",
+						dpmt.Name, len(c.SubnetNames))
+				}
+
+				if c.SubnetNames[0] != "subnet1" {
+					return fmt.Errorf("Bad subnet: %s", c.SubnetNames[0])
+				}
+
+				if c.NetworkSecurityGroup != "terraform-security-group1" {
+					return fmt.Errorf("Bad security group: %s", c.NetworkSecurityGroup)
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceUpdatedAttributes(
+	dpmt *virtualmachine.DeploymentResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if dpmt.Name != "terraform-test1" {
+			return fmt.Errorf("Bad name: %s", dpmt.Name)
+		}
+
+		if dpmt.VirtualNetworkName != "terraform-vnet" {
+			return fmt.Errorf("Bad virtual network: %s", dpmt.VirtualNetworkName)
+		}
+
+		if len(dpmt.RoleList) != 1 {
+			return fmt.Errorf(
+				"Instance %s has an unexpected number of roles: %d", dpmt.Name, len(dpmt.RoleList))
+		}
+
+		if dpmt.RoleList[0].RoleSize != "Basic_A2" {
+			return fmt.Errorf("Bad size: %s", dpmt.RoleList[0].RoleSize)
+		}
+
+		for _, c := range dpmt.RoleList[0].ConfigurationSets {
+			if c.ConfigurationSetType == virtualmachine.ConfigurationSetTypeNetwork {
+				if len(c.InputEndpoints) != 2 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of endpoints %d",
+						dpmt.Name, len(c.InputEndpoints))
+				}
+
+				if c.InputEndpoints[1].Name != "WINRM" {
+					return fmt.Errorf("Bad endpoint name: %s", c.InputEndpoints[1].Name)
+				}
+
+				if c.InputEndpoints[1].Port != 5985 {
+					return fmt.Errorf("Bad endpoint port: %d", c.InputEndpoints[1].Port)
+				}
+
+				if len(c.SubnetNames) != 1 {
+					return fmt.Errorf(
+						"Instance %s has an unexpected number of associated subnets %d",
+						dpmt.Name, len(c.SubnetNames))
+				}
+
+				if c.SubnetNames[0] != "subnet1" {
+					return fmt.Errorf("Bad subnet: %s", c.SubnetNames[0])
+				}
+
+				if c.NetworkSecurityGroup != "terraform-security-group2" {
+					return fmt.Errorf("Bad security group: %s", c.NetworkSecurityGroup)
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureInstanceDestroyed(hostedServiceName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		hostedServiceClient := testAccProvider.Meta().(*Client).hostedServiceClient
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "azure_instance" {
+				continue
+			}
+
+			if rs.Primary.ID == "" {
+				return fmt.Errorf("No instance ID is set")
+			}
+
+			// if not hosted service was provided; it means that we expect it
+			// to be identical with the name of the instance; which is in the ID.
+			var serviceName string
+			if hostedServiceName == "" {
+				serviceName = rs.Primary.ID
+			} else {
+				serviceName = hostedServiceName
+			}
+
+			_, err := hostedServiceClient.GetHostedService(serviceName)
+			if err == nil {
+				return fmt.Errorf("Instance %s still exists", rs.Primary.ID)
+			}
+
+			if !management.IsResourceNotFoundError(err) {
+				return err
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureInstance_basic = fmt.Sprintf(`
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}`, testAccStorageServiceName)
+
+var testAccAzureInstance_seperateHostedService = fmt.Sprintf(`
+resource "azure_hosted_service" "foo" {
+	name = "%s"
+	location = "West US"
+	ephemeral_contents = true
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test"
+	hosted_service_name = "${azure_hosted_service.foo.name}"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}`, testAccHostedServiceName, testAccStorageServiceName)
+
+var testAccAzureInstance_advanced = fmt.Sprintf(`
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+		location = "West US"
+
+		subnet {
+        name = "subnet1"
+				address_prefix = "10.1.2.0/25"
+		}
+
+		subnet {
+        name = "subnet2"
+				address_prefix = "10.1.2.128/25"
+    }
+}
+
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.foo.name}"]
+    priority = 101
+    source_address_prefix = "*"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	action = "Deny"
+	type = "Inbound"
+    protocol = "TCP"
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Windows Server 2012 R2 Datacenter, April 2015"
+    size = "Basic_A1"
+    storage_service_name = "%s"
+    location = "West US"
+    time_zone = "America/Los_Angeles"
+    subnet = "subnet1"
+    virtual_network = "${azure_virtual_network.foo.name}"
+    security_group = "${azure_security_group.foo.name}"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "RDP"
+        protocol = "tcp"
+        public_port = 3389
+        private_port = 3389
+    }
+}`, testAccStorageServiceName)
+
+var testAccAzureInstance_update = fmt.Sprintf(`
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+		location = "West US"
+
+    subnet {
+        name = "subnet1"
+		address_prefix = "10.1.2.0/25"
+	}
+
+    subnet {
+        name = "subnet2"
+		address_prefix = "10.1.2.128/25"
+    }
+}
+
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.foo.name}"]
+    priority = 101
+    source_address_prefix = "*"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	type = "Inbound"
+	action = "Deny"
+    protocol = "TCP"
+}
+
+resource "azure_security_group" "bar" {
+    name = "terraform-security-group2"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "bar" {
+    name = "rdp"
+    security_group_names = ["${azure_security_group.bar.name}"]
+    priority = 101
+    source_address_prefix = "192.168.0.0/24"
+    source_port_range = "*"
+    destination_address_prefix = "*"
+    destination_port_range = "3389"
+	type = "Inbound"
+	action = "Deny"
+    protocol = "TCP"
+}
+
+resource "azure_instance" "foo" {
+    name = "terraform-test1"
+    image = "Windows Server 2012 R2 Datacenter, April 2015"
+    size = "Basic_A2"
+    storage_service_name = "%s"
+    location = "West US"
+    time_zone = "America/Los_Angeles"
+    subnet = "subnet1"
+    virtual_network = "${azure_virtual_network.foo.name}"
+    security_group = "${azure_security_group.bar.name}"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "RDP"
+        protocol = "tcp"
+        public_port = 3389
+        private_port = 3389
+    }
+
+    endpoint {
+        name = "WINRM"
+        protocol = "tcp"
+        public_port = 5985
+        private_port = 5985
+    }
+}`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_local_network.go b/builtin/providers/azure/resource_azure_local_network.go
new file mode 100644
index 000000000..5c2f4f3d8
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_local_network.go
@@ -0,0 +1,253 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureLocalNetworkConnetion returns the schema.Resource associated to an
+// Azure hosted service.
+func resourceAzureLocalNetworkConnection() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureLocalNetworkConnectionCreate,
+		Read:   resourceAzureLocalNetworkConnectionRead,
+		Update: resourceAzureLocalNetworkConnectionUpdate,
+		Exists: resourceAzureLocalNetworkConnectionExists,
+		Delete: resourceAzureLocalNetworkConnectionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"vpn_gateway_address": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["vpn_gateway_address"],
+			},
+			"address_space_prefixes": &schema.Schema{
+				Type:     schema.TypeList,
+				Required: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Description: parameterDescriptions["address_space_prefixes"],
+			},
+		},
+	}
+}
+
+// sourceAzureLocalNetworkConnectionCreate issues all the necessary API calls
+// to create a virtual network on Azure.
+func resourceAzureLocalNetworkConnectionCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network config exists yet; create a new one now:
+			netConf = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+		}
+	}
+
+	// get provided configuration:
+	name := d.Get("name").(string)
+	vpnGateway := d.Get("vpn_gateway_address").(string)
+	var prefixes []string
+	for _, prefix := range d.Get("address_space_prefixes").([]interface{}) {
+		prefixes = append(prefixes, prefix.(string))
+	}
+
+	// add configuration to network config:
+	netConf.Configuration.LocalNetworkSites = append(netConf.Configuration.LocalNetworkSites,
+		virtualnetwork.LocalNetworkSite{
+			Name:              name,
+			VPNGatewayAddress: vpnGateway,
+			AddressSpace: virtualnetwork.AddressSpace{
+				AddressPrefix: prefixes,
+			},
+		})
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed setting updated network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed updating the network configuration: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionRead does all the necessary API calls to
+// read the state of our local natwork from Azure.
+func resourceAzureLocalNetworkConnectionRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	var found bool
+	name := d.Get("name").(string)
+
+	// browsing for our network config:
+	for _, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			found = true
+			d.Set("vpn_gateway_address", lnet.VPNGatewayAddress)
+			d.Set("address_space_prefixes", lnet.AddressSpace.AddressPrefix)
+			break
+		}
+	}
+
+	// remove the resource from the state of it has been deleted in the meantime:
+	if !found {
+		log.Println(fmt.Printf("[INFO] Azure local network '%s' has been deleted remotely. Removimg from Terraform.", name))
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionUpdate does all the necessary API calls
+// update the settings of our Local Network on Azure.
+func resourceAzureLocalNetworkConnectionUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+	cvpn := d.HasChange("vpn_gateway_address")
+	cprefixes := d.HasChange("address_space_prefixes")
+
+	var found bool
+	for i, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			found = true
+			if cvpn {
+				netConf.Configuration.LocalNetworkSites[i].VPNGatewayAddress = d.Get("vpn_gateway_address").(string)
+			}
+			if cprefixes {
+				var prefixes []string
+				for _, prefix := range d.Get("address_space_prefixes").([]interface{}) {
+					prefixes = append(prefixes, prefix.(string))
+				}
+				netConf.Configuration.LocalNetworkSites[i].AddressSpace.AddressPrefix = prefixes
+			}
+			break
+		}
+	}
+
+	// remove the resource from the state of it has been deleted in the meantime:
+	if !found {
+		log.Println(fmt.Printf("[INFO] Azure local network '%s' has been deleted remotely. Removimg from Terraform.", name))
+		d.SetId("")
+	} else if cvpn || cprefixes {
+		// else, send the configuration back to Azure:
+		log.Println("[INFO] Sending updated network configuration back to Azure.")
+		reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+		if err != nil {
+			return fmt.Errorf("Failed setting updated network configuration: %s", err)
+		}
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Failed updating the network configuration: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureLocalNetworkConnectionExists does all the necessary API calls
+// to check if the local network already exists on Azure.
+func resourceAzureLocalNetworkConnectionExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	vnetClient := meta.(*Client).vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return false, fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name")
+
+	for _, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// resourceAzureLocalNetworkConnectionDelete does all the necessary API calls
+// to delete a local network off Azure.
+func resourceAzureLocalNetworkConnectionDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	vnetClient := azureClient.vnetClient
+
+	log.Println("[INFO] Fetching current network configuration from Azure.")
+	azureClient.mutex.Lock()
+	defer azureClient.mutex.Unlock()
+	netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf("Failed to get the current network configuration from Azure: %s", err)
+	}
+
+	name := d.Get("name").(string)
+
+	// search for our local network and remove it if found:
+	for i, lnet := range netConf.Configuration.LocalNetworkSites {
+		if lnet.Name == name {
+			netConf.Configuration.LocalNetworkSites = append(
+				netConf.Configuration.LocalNetworkSites[:i],
+				netConf.Configuration.LocalNetworkSites[i+1:]...,
+			)
+			break
+		}
+	}
+
+	// send the configuration back to Azure:
+	log.Println("[INFO] Sending updated network configuration back to Azure.")
+	reqID, err := vnetClient.SetVirtualNetworkConfiguration(netConf)
+	if err != nil {
+		return fmt.Errorf("Failed setting updated network configuration: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed updating the network configuration: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_local_network_test.go b/builtin/providers/azure/resource_azure_local_network_test.go
new file mode 100644
index 000000000..2f9f0fdda
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_local_network_test.go
@@ -0,0 +1,139 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureLocalNetworkConnectionBasic(t *testing.T) {
+	name := "azure_local_network_connection.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureLocalNetworkConnectionDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.13"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.0/31"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.1/31"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureLocalNetworkConnectionUpdate(t *testing.T) {
+	name := "azure_local_network_connection.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureLocalNetworkConnectionDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.13"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.0/31"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.1/31"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureLocalNetworkConnectionUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureLocalNetworkConnectionExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-local-network-connection"),
+					resource.TestCheckResourceAttr(name, "vpn_gateway_address", "10.11.12.14"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.0", "10.10.10.2/30"),
+					resource.TestCheckResourceAttr(name, "address_space_prefixes.1", "10.10.10.3/30"),
+				),
+			},
+		},
+	})
+}
+
+// testAccAzureLocalNetworkConnectionExists checks whether the given local network
+// connection exists on Azure.
+func testAccAzureLocalNetworkConnectionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Local Network Connection not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Local Network Connection ID not set.")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, lnet := range netConf.Configuration.LocalNetworkSites {
+			if lnet.Name == resource.Primary.ID {
+				return nil
+			}
+			break
+		}
+
+		return fmt.Errorf("Local Network Connection not found: %s", name)
+	}
+}
+
+// testAccAzureLocalNetworkConnectionDestroyed checks whether the local network
+// connection has been destroyed on Azure or not.
+func testAccAzureLocalNetworkConnectionDestroyed(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_local_network_connection" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Local Network Connection ID not set.")
+		}
+
+		netConf, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, lnet := range netConf.Configuration.LocalNetworkSites {
+			if lnet.Name == resource.Primary.ID {
+				return fmt.Errorf("Azure Local Network Connection still exists.")
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureLocalNetworkConnectionBasic = `
+resource "azure_local_network_connection" "foo" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "10.11.12.13"
+    address_space_prefixes = ["10.10.10.0/31", "10.10.10.1/31"]
+}
+`
+
+const testAccAzureLocalNetworkConnectionUpdate = `
+resource "azure_local_network_connection" "foo" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "10.11.12.14"
+    address_space_prefixes = ["10.10.10.2/30", "10.10.10.3/30"]
+}
+`
diff --git a/builtin/providers/azure/resource_azure_security_group.go b/builtin/providers/azure/resource_azure_security_group.go
new file mode 100644
index 000000000..1d066d031
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group.go
@@ -0,0 +1,110 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAzureSecurityGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSecurityGroupCreate,
+		Read:   resourceAzureSecurityGroupRead,
+		Delete: resourceAzureSecurityGroupDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"label": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAzureSecurityGroupCreate(d *schema.ResourceData, meta interface{}) (err error) {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	name := d.Get("name").(string)
+
+	// Compute/set the label
+	label := d.Get("label").(string)
+	if label == "" {
+		label = name
+	}
+
+	req, err := secGroupClient.CreateNetworkSecurityGroup(
+		name,
+		label,
+		d.Get("location").(string),
+	)
+	if err != nil {
+		return fmt.Errorf("Error creating Network Security Group %s: %s", name, err)
+	}
+
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for Network Security Group %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureSecurityGroupRead(d, meta)
+}
+
+func resourceAzureSecurityGroupRead(d *schema.ResourceData, meta interface{}) error {
+	secGroupClient := meta.(*Client).secGroupClient
+
+	sg, err := secGroupClient.GetNetworkSecurityGroup(d.Id())
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error retrieving Network Security Group %s: %s", d.Id(), err)
+	}
+
+	d.Set("label", sg.Label)
+	d.Set("location", sg.Location)
+
+	return nil
+}
+
+func resourceAzureSecurityGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	log.Printf("[DEBUG] Deleting Network Security Group: %s", d.Id())
+	req, err := secGroupClient.DeleteNetworkSecurityGroup(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error deleting Network Security Group %s: %s", d.Id(), err)
+	}
+
+	// Wait until the network security group is deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf(
+			"Error waiting for Network Security Group %s to be deleted: %s", d.Id(), err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_security_group_rule.go b/builtin/providers/azure/resource_azure_security_group_rule.go
new file mode 100644
index 000000000..868edb150
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_rule.go
@@ -0,0 +1,301 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	netsecgroup "github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSecurityGroupRule returns the *schema.Resource for
+// a network security group rule on Azure.
+func resourceAzureSecurityGroupRule() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSecurityGroupRuleCreate,
+		Read:   resourceAzureSecurityGroupRuleRead,
+		Update: resourceAzureSecurityGroupRuleUpdate,
+		Delete: resourceAzureSecurityGroupRuleDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"security_group_names": &schema.Schema{
+				Type:        schema.TypeSet,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["netsecgroup_secgroup_names"],
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Set: schema.HashString,
+			},
+			"type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_type"],
+			},
+			"priority": &schema.Schema{
+				Type:        schema.TypeInt,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_priority"],
+			},
+			"action": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_action"],
+			},
+			"source_address_prefix": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_src_addr_prefix"],
+			},
+			"source_port_range": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_src_port_range"],
+			},
+			"destination_address_prefix": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_dest_addr_prefix"],
+			},
+			"destination_port_range": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_dest_port_range"],
+			},
+			"protocol": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: parameterDescriptions["netsecgroup_protocol"],
+			},
+		},
+	}
+}
+
+// resourceAzureSecurityGroupRuleCreate does all the necessary API calls to
+// create a new network security group rule on Azure.
+func resourceAzureSecurityGroupRuleCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	// create and configure the RuleResponse:
+	name := d.Get("name").(string)
+	rule := netsecgroup.RuleRequest{
+		Name:                     name,
+		Type:                     netsecgroup.RuleType(d.Get("type").(string)),
+		Priority:                 d.Get("priority").(int),
+		Action:                   netsecgroup.RuleAction(d.Get("action").(string)),
+		SourceAddressPrefix:      d.Get("source_address_prefix").(string),
+		SourcePortRange:          d.Get("source_port_range").(string),
+		DestinationAddressPrefix: d.Get("destination_address_prefix").(string),
+		DestinationPortRange:     d.Get("destination_port_range").(string),
+		Protocol:                 netsecgroup.RuleProtocol(d.Get("protocol").(string)),
+	}
+
+	// apply the rule to all the necessary network security groups:
+	secGroups := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroups {
+		secGroup := sg.(string)
+
+		// send the create request to Azure:
+		log.Printf("[INFO] Sending Azure security group rule addition request for security group %q.", secGroup)
+		reqID, err := secGroupClient.SetNetworkSecurityGroupRule(
+			secGroup,
+			rule,
+		)
+		if err != nil {
+			return fmt.Errorf("Error sending Azure network security group rule creation request for security group %q: %s", secGroup, err)
+		}
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error creating Azure network security group rule for security group %q: %s", secGroup, err)
+		}
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleRead does all the necessary API calls to
+// read the state of a network security group ruke off Azure.
+func resourceAzureSecurityGroupRuleRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	secGroupClient := azureClient.secGroupClient
+
+	var found bool
+	name := d.Get("name").(string)
+
+	secGroups := d.Get("security_group_names").(*schema.Set).List()
+	remaining := schema.NewSet(schema.HashString, nil)
+
+	// for each of our security groups; check for our rule:
+	for _, sg := range secGroups {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and check its rules for this one:
+		log.Printf("[INFO] Sending Azure network security group rule query for security group %s.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf("Error issuing network security group rules query for security group %q: %s", secGroupName, err)
+			} else {
+				// it meants that the network security group this rule belonged to has
+				// been deleted; so we skip this iteration:
+				continue
+			}
+		}
+
+		// find our security rule:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// note the fact that this rule still apllies to this security group:
+				found = true
+				remaining.Add(secGroupName)
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is any security group still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// now; we must update the set of security groups still having this rule:
+	d.Set("security_group_names", remaining)
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleUpdate does all the necessary API calls to
+// update the state of a network security group rule off Azure.
+func resourceAzureSecurityGroupRuleUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	var found bool
+	name := d.Get("name").(string)
+	newRule := netsecgroup.RuleRequest{
+		Name:                     d.Get("name").(string),
+		Type:                     netsecgroup.RuleType(d.Get("type").(string)),
+		Priority:                 d.Get("priority").(int),
+		Action:                   netsecgroup.RuleAction(d.Get("action").(string)),
+		SourceAddressPrefix:      d.Get("source_address_prefix").(string),
+		SourcePortRange:          d.Get("source_port_range").(string),
+		DestinationAddressPrefix: d.Get("destination_address_prefix").(string),
+		DestinationPortRange:     d.Get("destination_port_range").(string),
+		Protocol:                 netsecgroup.RuleProtocol(d.Get("protocol").(string)),
+	}
+
+	// iterate over all the security groups that should have this rule and
+	// update it per security group:
+	remaining := schema.NewSet(schema.HashString, nil)
+	secGroupNames := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroupNames {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and check its rules for this one:
+		log.Printf("[INFO] Sending Azure network security group rule query for security group %q.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf("Error issuing network security group rules query: %s", err)
+			} else {
+				// it meants that the network security group this rule belonged to has
+				// been deleted; so we skip this iteration:
+				continue
+			}
+		}
+
+		// try and find our security group rule:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// note the fact that this rule still applies to this security group:
+				found = true
+				remaining.Add(secGroupName)
+
+				// and go ahead and update it:
+				log.Printf("[INFO] Sending Azure network security group rule update request for security group %q.", secGroupName)
+				reqID, err := secGroupClient.SetNetworkSecurityGroupRule(
+					secGroupName,
+					newRule,
+				)
+				if err != nil {
+					return fmt.Errorf("Error sending Azure network security group rule update request for security group %q: %s", secGroupName, err)
+				}
+				err = mgmtClient.WaitForOperation(reqID, nil)
+				if err != nil {
+					return fmt.Errorf("Error updating Azure network security group rule for security group %q: %s", secGroupName, err)
+				}
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is any security group still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// here; we must update the set of security groups still having this rule:
+	d.Set("security_group_names", remaining)
+
+	return nil
+}
+
+// resourceAzureSecurityGroupRuleDelete does all the necessary API calls to
+// delete a network security group rule off Azure.
+func resourceAzureSecurityGroupRuleDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	name := d.Get("name").(string)
+	secGroupNames := d.Get("security_group_names").(*schema.Set).List()
+	for _, sg := range secGroupNames {
+		secGroupName := sg.(string)
+
+		// get info on the network security group and search for our rule:
+		log.Printf("[INFO] Sending network security group rule query for security group %q.", secGroupName)
+		secgroup, err := secGroupClient.GetNetworkSecurityGroup(secGroupName)
+		if err != nil {
+			if management.IsResourceNotFoundError(err) {
+				// it means that this network security group this rule belonged to has
+				// been deleted; so we need not do anything more here:
+				continue
+			} else {
+				return fmt.Errorf("Error issuing Azure network security group rules query for security group %q: %s", secGroupName, err)
+			}
+		}
+
+		// check if the rule has been deleted in the meantime:
+		for _, rule := range secgroup.Rules {
+			if rule.Name == name {
+				// if not; we shall issue the delete:
+				reqID, err := secGroupClient.DeleteNetworkSecurityGroupRule(secGroupName, name)
+				if err != nil {
+					return fmt.Errorf("Error sending network security group rule delete request to Azure: %s", err)
+				}
+				err = mgmtClient.WaitForOperation(reqID, nil)
+				if err != nil {
+					return fmt.Errorf("Error deleting network security group rule off Azure: %s", err)
+				}
+			}
+			break
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_security_group_rule_test.go b/builtin/providers/azure/resource_azure_security_group_rule_test.go
new file mode 100644
index 000000000..ec430f098
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_rule_test.go
@@ -0,0 +1,249 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+var (
+	testAcctestingSecurityGroup1     = fmt.Sprintf("%s-%d", testAccSecurityGroupName, 1)
+	testAccTestingSecurityGroupHash1 = fmt.Sprintf("%d", schema.HashString(testAcctestingSecurityGroup1))
+
+	testAcctestingSecurityGroup2     = fmt.Sprintf("%s-%d", testAccSecurityGroupName, 2)
+	testAccTestingSecurityGroupHash2 = fmt.Sprintf("%d", schema.HashString(testAcctestingSecurityGroup2))
+)
+
+func TestAccAzureSecurityGroupRuleBasic(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted([]string{testAccSecurityGroupName}),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleBasicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAccSecurityGroupName),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name,
+						fmt.Sprintf("security_group_names.%d", schema.HashString(testAccSecurityGroupName)),
+						testAccSecurityGroupName),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSecurityGroupRuleAdvanced(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted(
+			[]string{
+				testAcctestingSecurityGroup1,
+				testAcctestingSecurityGroup2,
+			},
+		),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup1),
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash1), testAcctestingSecurityGroup1),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSecurityGroupRuleUpdate(t *testing.T) {
+	name := "azure_security_group_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupRuleDeleted(
+			[]string{
+				testAcctestingSecurityGroup1,
+				testAcctestingSecurityGroup2,
+			},
+		),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup1),
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash1), testAcctestingSecurityGroup1),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Inbound"),
+					resource.TestCheckResourceAttr(name, "action", "Deny"),
+					resource.TestCheckResourceAttr(name, "priority", "200"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "100.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "protocol", "TCP"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupRuleUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupRuleExists(name, testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "name", "terraform-secgroup-rule"),
+					resource.TestCheckResourceAttr(name, fmt.Sprintf("security_group_names.%s",
+						testAccTestingSecurityGroupHash2), testAcctestingSecurityGroup2),
+					resource.TestCheckResourceAttr(name, "type", "Outbound"),
+					resource.TestCheckResourceAttr(name, "action", "Allow"),
+					resource.TestCheckResourceAttr(name, "priority", "100"),
+					resource.TestCheckResourceAttr(name, "source_address_prefix", "101.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "source_port_range", "1000"),
+					resource.TestCheckResourceAttr(name, "destination_address_prefix", "10.0.0.0/32"),
+					resource.TestCheckResourceAttr(name, "destination_port_range", "1001"),
+					resource.TestCheckResourceAttr(name, "protocol", "UDP"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSecurityGroupRuleExists(name, groupName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure security group rule not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure network security group rule ID not set: %s", name)
+		}
+
+		secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+		secGroup, err := secGroupClient.GetNetworkSecurityGroup(groupName)
+		if err != nil {
+			return fmt.Errorf("Failed getting network security group details for %q: %s", groupName, err)
+		}
+
+		for _, rule := range secGroup.Rules {
+			if rule.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Azure security group rule doesn't exist: %s", name)
+	}
+}
+
+func testAccCheckAzureSecurityGroupRuleDeleted(groups []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_security_group_rule" {
+				continue
+			}
+
+			if resource.Primary.ID == "" {
+				return fmt.Errorf("Azure network security group ID not set.")
+			}
+
+			secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+			for _, groupName := range groups {
+				secGroup, err := secGroupClient.GetNetworkSecurityGroup(groupName)
+				if err != nil {
+					if !management.IsResourceNotFoundError(err) {
+						return fmt.Errorf("Failed getting network security group details for %q: %s", groupName, err)
+					}
+				}
+
+				for _, rule := range secGroup.Rules {
+					if rule.Name == resource.Primary.ID {
+						return fmt.Errorf("Azure network security group rule still exists!")
+					}
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureSecurityGroupRuleBasicConfig = testAccAzureSecurityGroupConfig + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+`
+var testAccAzureSecurityGroupRuleAdvancedConfig = fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "foo", testAcctestingSecurityGroup1) +
+	fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "bar", testAcctestingSecurityGroup2) + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}", "${azure_security_group.bar.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+`
+
+var testAccAzureSecurityGroupRuleUpdateConfig = fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "foo", testAcctestingSecurityGroup1) +
+	fmt.Sprintf(testAccAzureSecurityGroupConfigTemplate, "bar", testAcctestingSecurityGroup2) + `
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.bar.name}"]
+	type = "Outbound"
+	action = "Allow"
+	priority = 100
+	source_address_prefix = "101.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1001"
+	protocol = "UDP"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_security_group_test.go b/builtin/providers/azure/resource_azure_security_group_test.go
new file mode 100644
index 000000000..3d86d0873
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_security_group_test.go
@@ -0,0 +1,102 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/networksecuritygroup"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSecurityGroup_basic(t *testing.T) {
+	var group networksecuritygroup.SecurityGroupResponse
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSecurityGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSecurityGroupConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureSecurityGroupExists(
+						"azure_security_group.foo", &group),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "name", "terraform-security-group"),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_security_group.foo", "label", "terraform testing security group"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSecurityGroupExists(
+	n string,
+	group *networksecuritygroup.SecurityGroupResponse) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Network Security Group ID is set")
+		}
+
+		secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+		sg, err := secGroupClient.GetNetworkSecurityGroup(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		if sg.Name != rs.Primary.ID {
+			return fmt.Errorf("Security Group not found")
+		}
+
+		*group = sg
+
+		return nil
+	}
+}
+
+func testAccCheckAzureSecurityGroupDestroy(s *terraform.State) error {
+	secGroupClient := testAccProvider.Meta().(*Client).secGroupClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_security_group" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Network Security Group ID is set")
+		}
+
+		_, err := secGroupClient.GetNetworkSecurityGroup(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network Security Group %s still exists", rs.Primary.ID)
+		}
+
+		if !management.IsResourceNotFoundError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureSecurityGroupConfigTemplate = `
+resource "azure_security_group" "%s" {
+    name = "%s"
+    location = "West US"
+    label = "terraform testing security group"
+}`
+
+var testAccAzureSecurityGroupConfig = fmt.Sprintf(
+	testAccAzureSecurityGroupConfigTemplate,
+	"foo", "terraform-security-group",
+)
diff --git a/builtin/providers/azure/resource_azure_sql_database_server.go b/builtin/providers/azure/resource_azure_sql_database_server.go
new file mode 100644
index 000000000..b3412b7b3
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server.go
@@ -0,0 +1,118 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureDatabaseServer returns the *schema.Resource associated
+// to a database server on Azure.
+func resourceAzureSqlDatabaseServer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServerCreate,
+		Read:   resourceAzureSqlDatabaseServerRead,
+		Delete: resourceAzureSqlDatabaseServerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"username": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"password": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"version": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "12.0",
+				ForceNew: true,
+			},
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServerCreate does all the necessary API calls to
+// create an SQL database server off Azure.
+func resourceAzureSqlDatabaseServerCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Began constructing SQL Server creation request.")
+	params := sql.DatabaseServerCreateParams{
+		Location:                   d.Get("location").(string),
+		AdministratorLogin:         d.Get("username").(string),
+		AdministratorLoginPassword: d.Get("password").(string),
+		Version:                    d.Get("version").(string),
+	}
+
+	log.Println("[INFO] Issuing SQL Server creation request to Azure.")
+	name, err := sqlClient.CreateServer(params)
+	if err != nil {
+		return fmt.Errorf("Error creating SQL Server on Azure: %s", err)
+	}
+
+	d.Set("name", name)
+
+	d.SetId(name)
+	return resourceAzureSqlDatabaseServerRead(d, meta)
+}
+
+// resourceAzureSqlDatabaseServerRead does all the necessary API calls to
+// read the state of the SQL database server off Azure.
+func resourceAzureSqlDatabaseServerRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Sending SQL Servers list query to Azure.")
+	srvList, err := sqlClient.ListServers()
+	if err != nil {
+		return fmt.Errorf("Error issuing SQL Servers list query to Azure: %s", err)
+	}
+
+	// search for our particular server:
+	name := d.Get("name")
+	for _, srv := range srvList.DatabaseServers {
+		if srv.Name == name {
+			d.Set("url", srv.FullyQualifiedDomainName)
+			d.Set("state", srv.State)
+			return nil
+		}
+	}
+
+	// if reached here; it means out server doesn't exist, so we must untrack it:
+	d.SetId("")
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerDelete does all the necessary API calls to
+// delete the SQL database server off Azure.
+func resourceAzureSqlDatabaseServerDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Sending SQL Server deletion request to Azure.")
+	name := d.Get("name").(string)
+	err := sqlClient.DeleteServer(name)
+	if err != nil {
+		return fmt.Errorf("Error while issuing SQL Server deletion request to Azure: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go
new file mode 100644
index 000000000..a5cb0b214
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule.go
@@ -0,0 +1,222 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSqlDatabaseServerFirewallRule returns the *schema.Resource
+// associated to a firewall rule of a database server in Azure.
+func resourceAzureSqlDatabaseServerFirewallRule() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServerFirewallRuleCreate,
+		Read:   resourceAzureSqlDatabaseServerFirewallRuleRead,
+		Update: resourceAzureSqlDatabaseServerFirewallRuleUpdate,
+		Delete: resourceAzureSqlDatabaseServerFirewallRuleDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"database_server_names": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Set: schema.HashString,
+			},
+			"start_ip": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"end_ip": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleCreate does all the necessary API
+// calls to create the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	params := sql.FirewallRuleCreateParams{
+		Name:           name,
+		StartIPAddress: d.Get("start_ip").(string),
+		EndIPAddress:   d.Get("end_ip").(string),
+	}
+
+	// loop over all the database servers and apply the firewall rule to each:
+	serverNames := d.Get("database_server_names").(*schema.Set).List()
+	for _, srv := range serverNames {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule %q creation request for Server %q.", name, serverName)
+		if err := sqlClient.CreateFirewallRule(serverName, params); err != nil {
+			return fmt.Errorf("Error creating Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+		}
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleRead does all the necessary API
+// calls to read the state of the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	remaining := schema.NewSet(schema.HashString, nil)
+
+	// for each of our servers; check to see if the rule is still present:
+	var found bool
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule list query for server %q.", serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				found = true
+				remaining.Add(serverName)
+
+				break
+			}
+		}
+	}
+
+	// check to see if there is still any Database Server still having this rule:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// else; update the list of Database Servers still having this rule:
+	d.Set("database_server_names", remaining)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleUpdate does all the necessary API
+// calls to update the state of the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleUpdate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	var found bool
+	name := d.Get("name").(string)
+	updateParams := sql.FirewallRuleUpdateParams{
+		Name:           name,
+		StartIPAddress: d.Get("start_ip").(string),
+		EndIPAddress:   d.Get("end_ip").(string),
+	}
+
+	// for each of the Database Servers our rules concerns; issue the update:
+	remaining := schema.NewSet(schema.HashString, nil)
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Issuing Azure Database Server Firewall Rule list for Database Server %q: %s.", name, serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				// take note of the fact that this Database Server still has
+				// this rule:
+				found = true
+				remaining.Add(serverName)
+
+				// go ahead and update the rule:
+				log.Printf("[INFO] Issuing update of Azure Database Server Firewall Rule %q in Server %q.", name, serverName)
+				if err := sqlClient.UpdateFirewallRule(serverName, name, updateParams); err != nil {
+					return fmt.Errorf("Error updating Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+				}
+
+				break
+			}
+		}
+	}
+
+	// check to see if the rule is still exists on any of the servers:
+	if !found {
+		d.SetId("")
+		return nil
+	}
+
+	// else; update the list with the remaining Servers:
+	d.Set("database_server_names", remaining)
+	return nil
+}
+
+// resourceAzureSqlDatabaseServerFirewallRuleDelete does all the necessary API
+// calls to delete the SQL Database Server Firewall Rule on Azure.
+func resourceAzureSqlDatabaseServerFirewallRuleDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	name := d.Get("name").(string)
+	for _, srv := range d.Get("database_server_names").(*schema.Set).List() {
+		serverName := srv.(string)
+
+		log.Printf("[INFO] Sending Azure Database Server Firewall Rule list query for Server %q.", serverName)
+		rules, err := sqlClient.ListFirewallRules(serverName)
+		if err != nil {
+			if strings.Contains(err.Error(), "does not exist") {
+				// it means that the database server this rule belonged to has
+				// been deleted in the meantime.
+				continue
+			} else {
+				return fmt.Errorf("Error getting Azure Firewall Rules for Database Server %q: %s", serverName, err)
+			}
+
+		}
+
+		// look for our rule:
+		for _, rule := range rules.FirewallRules {
+			if rule.Name == name {
+				// go ahead and delete the rule:
+				log.Printf("[INFO] Issuing deletion of Azure Database Server Firewall Rule %q in Server %q.", name, serverName)
+				if err := sqlClient.DeleteFirewallRule(serverName, name); err != nil {
+					return fmt.Errorf("Error deleting Azure Database Server Firewall Rule %q for Server %q: %s", name, serverName, err)
+				}
+
+				break
+			}
+		}
+
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go
new file mode 100644
index 000000000..9202be7e1
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_firewall_rule_test.go
@@ -0,0 +1,235 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSqlDatabaseServerFirewallRuleBasic(t *testing.T) {
+	name := "azure_sql_database_server_firewall_rule.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleBasicConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(1),
+					testAccAzureDatabaseServerFirewallRuleExists(name, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-rule"),
+					resource.TestCheckResourceAttr(name, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name, "end_ip", "10.0.0.255"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServerFirewallRuleAdvanced(t *testing.T) {
+	name1 := "azure_sql_database_server_firewall_rule.foo"
+	name2 := "azure_sql_database_server_firewall_rule.bar"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "10.0.0.255"),
+					testAccAzureDatabaseServerFirewallRuleExists(name2, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name2, "name", "terraform-testing-rule2"),
+					resource.TestCheckResourceAttr(name2, "start_ip", "200.0.0.0"),
+					resource.TestCheckResourceAttr(name2, "end_ip", "200.255.255.255"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServerFirewallRuleUpdate(t *testing.T) {
+	name1 := "azure_sql_database_server_firewall_rule.foo"
+	name2 := "azure_sql_database_server_firewall_rule.bar"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureDatabaseServerFirewallRuleDeleted(testAccAzureSqlServerNames),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleAdvancedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "10.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "10.0.0.255"),
+					testAccAzureDatabaseServerFirewallRuleExists(name2, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name2, "name", "terraform-testing-rule2"),
+					resource.TestCheckResourceAttr(name2, "start_ip", "200.0.0.0"),
+					resource.TestCheckResourceAttr(name2, "end_ip", "200.255.255.255"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureDatabaseServerFirewallRuleUpdateConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetNames,
+					testAccAzureSqlDatabaseServersNumber(2),
+					testAccAzureDatabaseServerFirewallRuleExists(name1, testAccAzureSqlServerNames),
+					resource.TestCheckResourceAttr(name1, "name", "terraform-testing-rule1"),
+					resource.TestCheckResourceAttr(name1, "start_ip", "11.0.0.0"),
+					resource.TestCheckResourceAttr(name1, "end_ip", "11.0.0.255"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAzureDatabaseServerFirewallRuleExists(name string, servers []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Database Server Firewall Rule %q doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Database Server Firewall Rule %q resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+
+		for _, server := range servers {
+			rules, err := sqlClient.ListFirewallRules(server)
+			if err != nil {
+				return fmt.Errorf("Error listing Azure Database Server Firewall Rules for Server %q: %s", server, err)
+			}
+
+			var found bool
+			for _, rule := range rules.FirewallRules {
+				if rule.Name == resource.Primary.ID {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return fmt.Errorf("Azure Database Server Firewall Rule %q doesn't exists on server %q.", resource.Primary.ID, server)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccAzureDatabaseServerFirewallRuleDeleted(servers []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_sql_database_server_firewall_rule" {
+				continue
+			}
+
+			if resource.Primary.ID == "" {
+				return fmt.Errorf("Azure Database Server Firewall Rule resource ID not set.")
+			}
+
+			sqlClient := testAccProvider.Meta().(*Client).sqlClient
+
+			for _, server := range servers {
+				rules, err := sqlClient.ListFirewallRules(server)
+				if err != nil {
+					return fmt.Errorf("Error listing Azure Database Server Firewall Rules for Server %q: %s", server, err)
+				}
+
+				for _, rule := range rules.FirewallRules {
+					if rule.Name == resource.Primary.ID {
+						return fmt.Errorf("Azure Database Server Firewall Rule %q still exists on Server %q.", resource.Primary.ID, err)
+					}
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureDatabaseServerFirewallRuleBasicConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule"
+	depends_on = ["azure_sql_database_server.foo"]
+	start_ip = "10.0.0.0"
+	end_ip = "10.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}"]
+}
+`
+
+var testAccAzureDatabaseServerFirewallRuleAdvancedConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server" "bar" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule1"
+	start_ip = "10.0.0.0"
+	end_ip = "10.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}", "${azure_sql_database_server.bar.name}"]
+}
+
+resource "azure_sql_database_server_firewall_rule" "bar" {
+	name = "terraform-testing-rule2"
+	start_ip = "200.0.0.0"
+	end_ip = "200.255.255.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}", "${azure_sql_database_server.bar.name}"]
+}
+`
+
+var testAccAzureDatabaseServerFirewallRuleUpdateConfig = `
+resource "azure_sql_database_server" "foo" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server" "bar" {
+	location = "West US"
+	username = "SuperUser"
+	password = "SuperSEKR3T"
+	version = "2.0"
+}
+
+resource "azure_sql_database_server_firewall_rule" "foo" {
+	name = "terraform-testing-rule1"
+	start_ip = "11.0.0.0"
+	end_ip = "11.0.0.255"
+	database_server_names = ["${azure_sql_database_server.foo.name}"]
+}
+`
diff --git a/builtin/providers/azure/resource_azure_sql_database_server_test.go b/builtin/providers/azure/resource_azure_sql_database_server_test.go
new file mode 100644
index 000000000..cee7cb4ed
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_server_test.go
@@ -0,0 +1,158 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+// testAccAzureSqlServerName is a helper variable in which to store
+// the randomly-generated name of the SQL Server after it is created.
+// The anonymous function is there because go is too good to &"" directly.
+var testAccAzureSqlServerName *string = func(s string) *string { return &s }("")
+var testAccAzureSqlServerNames []string = []string{}
+
+func TestAccAzureSqlDatabaseServer(t *testing.T) {
+	name := "azure_sql_database_server.foo"
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServerDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServerConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServerExists(name),
+					resource.TestCheckResourceAttrPtr(name, "name", testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "username", "SuperUser"),
+					resource.TestCheckResourceAttr(name, "password", "SuperSEKR3T"),
+					resource.TestCheckResourceAttr(name, "version", "2.0"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSqlDatabaseServerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("SQL Server %s doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Server %s resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		servers, err := sqlClient.ListServers()
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Server list request: %s", err)
+		}
+
+		for _, srv := range servers.DatabaseServers {
+			if srv.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("SQL Server %s doesn't exist.", name)
+	}
+}
+
+func testAccCheckAzureSqlDatabaseServerDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Server resource ID not set.")
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		servers, err := sqlClient.ListServers()
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Server list request: %s", err)
+		}
+
+		for _, srv := range servers.DatabaseServers {
+			if srv.Name == resource.Primary.ID {
+				fmt.Errorf("SQL Server %s still exists.", resource.Primary.ID)
+			}
+		}
+	}
+	return nil
+}
+
+// testAccAzureSqlDatabaseServerGetName is ahelper function which reads the current
+// state form Terraform and sets the testAccAzureSqlServerName variable
+// to the ID (which is actually the name) of the newly created server.
+// It is modeled as a resource.TestCheckFunc so as to be easily-embeddable in
+// test cases and run live.
+func testAccAzureSqlDatabaseServerGetName(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure SQL Server resource ID not set.")
+		}
+
+		*testAccAzureSqlServerName = resource.Primary.ID
+		return nil
+	}
+
+	return fmt.Errorf("No Azure SQL Servers found.")
+}
+
+// testAccAzureSqlDatabaseServerGetNames is the same as the above; only it gets
+// all the servers' names.
+func testAccAzureSqlDatabaseServerGetNames(s *terraform.State) error {
+	testAccAzureSqlServerNames = []string{}
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_server" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure SQL Server resource ID not set.")
+		}
+
+		testAccAzureSqlServerNames = append(testAccAzureSqlServerNames, resource.Primary.ID)
+	}
+
+	if len(testAccAzureSqlServerNames) == 0 {
+		return fmt.Errorf("No Azure SQL Servers found.")
+	}
+
+	return nil
+}
+
+// testAccAzureSqlDatabaseServersNumber checks if the numbers of servers is
+// exactly equal to the given number. It is modeled as a resource.TestCheckFunc
+// to be easily embeddable in test checks.
+func testAccAzureSqlDatabaseServersNumber(n int) resource.TestCheckFunc {
+	return func(_ *terraform.State) error {
+		if len(testAccAzureSqlServerNames) != n {
+			return fmt.Errorf("Erroneous number of Azure Sql Database Servers. Expected %d; have %d.", n,
+				len(testAccAzureSqlServerNames))
+		}
+
+		return nil
+	}
+}
+
+const testAccAzureSqlDatabaseServerConfig = `
+resource "azure_sql_database_server" "foo" {
+    location = "West US"
+    username = "SuperUser"
+    password = "SuperSEKR3T"
+    version = "2.0"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_sql_database_service.go b/builtin/providers/azure/resource_azure_sql_database_service.go
new file mode 100644
index 000000000..29824d743
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_service.go
@@ -0,0 +1,234 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/management/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureSqlDatabaseService returns the *schema.Resource
+// associated to an SQL Database Service on Azure.
+func resourceAzureSqlDatabaseService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureSqlDatabaseServiceCreate,
+		Read:   resourceAzureSqlDatabaseServiceRead,
+		Update: resourceAzureSqlDatabaseServiceUpdate,
+		Exists: resourceAzureSqlDatabaseServiceExists,
+		Delete: resourceAzureSqlDatabaseServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"database_server_name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"collation": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"edition": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"max_size_bytes": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"service_level_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureSqlDatabaseServiceCreate does all the necessary API calls to
+// create an SQL Database Service on Azure.
+func resourceAzureSqlDatabaseServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Creating Azure SQL Database service creation request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	params := sql.DatabaseCreateParams{
+		Name:               name,
+		Edition:            d.Get("edition").(string),
+		CollationName:      d.Get("collation").(string),
+		ServiceObjectiveID: d.Get("service_level_id").(string),
+	}
+
+	if maxSize, ok := d.GetOk("max_size_bytes"); ok {
+		val, err := strconv.ParseInt(maxSize.(string), 10, 64)
+		if err != nil {
+			return fmt.Errorf("Provided max_size_bytes is not an integer: %s", err)
+		}
+		params.MaxSizeBytes = val
+	}
+
+	log.Println("[INFO] Sending SQL Database Service creation request to Azure.")
+	err := sqlClient.CreateDatabase(serverName, params)
+	if err != nil {
+		return fmt.Errorf("Error issuing Azure SQL Database Service creation: %s", err)
+	}
+
+	log.Println("[INFO] Beginning wait for Azure SQL Database Service creation.")
+	err = sqlClient.WaitForDatabaseCreation(serverName, name, nil)
+	if err != nil {
+		return fmt.Errorf("Error whilst waiting for Azure SQL Database Service creation: %s", err)
+	}
+
+	d.SetId(name)
+
+	return resourceAzureSqlDatabaseServiceRead(d, meta)
+}
+
+// resourceAzureSqlDatabaseServiceRead does all the necessary API calls to
+// read the state of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceRead(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database Services list operation.")
+	serverName := d.Get("database_server_name").(string)
+	dbs, err := sqlClient.ListDatabases(serverName)
+	if err != nil {
+		return fmt.Errorf("Error whilst listing Database Services off Azure: %s", err)
+	}
+
+	// search for our database:
+	var found bool
+	name := d.Get("name").(string)
+	for _, db := range dbs.ServiceResources {
+		if db.Name == name {
+			found = true
+			d.Set("edition", db.Edition)
+			d.Set("collation", db.CollationName)
+			d.Set("max_size_bytes", strconv.FormatInt(db.MaxSizeBytes, 10))
+			d.Set("service_level_id", db.ServiceObjectiveID)
+			break
+		}
+	}
+
+	// if not found; we must untrack the resource:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureSqlDatabaseServiceUpdate does all the necessary API calls to
+// update the state of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceUpdate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	sqlClient := azureClient.sqlClient
+	serverName := d.Get("database_server_name").(string)
+
+	// changes to the name must occur seperately from changes to the attributes:
+	if d.HasChange("name") {
+		oldv, newv := d.GetChange("name")
+
+		// issue the update request:
+		log.Println("[INFO] Issuing Azure Database Service name change.")
+		reqID, err := sqlClient.UpdateDatabase(serverName, oldv.(string),
+			sql.ServiceResourceUpdateParams{
+				Name: newv.(string),
+			})
+
+		// wait for the update to occur:
+		log.Println("[INFO] Waiting for Azure SQL Database Service name change.")
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error waiting for Azure SQL Database Service name update: %s", err)
+		}
+
+		// set the new name as the ID:
+		d.SetId(newv.(string))
+	}
+
+	name := d.Get("name").(string)
+	cedition := d.HasChange("edition")
+	cmaxsize := d.HasChange("max_size_bytes")
+	clevel := d.HasChange("service_level_id")
+	if cedition || cmaxsize || clevel {
+		updateParams := sql.ServiceResourceUpdateParams{
+			// we still have to stick the name in here for good measure:
+			Name: name,
+		}
+
+		// build the update request:
+		if cedition {
+			updateParams.Edition = d.Get("edition").(string)
+		}
+		if maxSize, ok := d.GetOk("max_size_bytes"); cmaxsize && ok && maxSize.(string) != "" {
+			val, err := strconv.ParseInt(maxSize.(string), 10, 64)
+			if err != nil {
+				return fmt.Errorf("Provided max_size_bytes is not an integer: %s", err)
+			}
+			updateParams.MaxSizeBytes = val
+		}
+		if clevel {
+			updateParams.ServiceObjectiveID = d.Get("service_level_id").(string)
+		}
+
+		// issue the update:
+		log.Println("[INFO] Issuing Azure Database Service parameter update.")
+		reqID, err := sqlClient.UpdateDatabase(serverName, name, updateParams)
+		if err != nil {
+			return fmt.Errorf("Failed issuing Azure SQL Service paramater update: %s", err)
+		}
+
+		log.Println("[INFO] Waiting for Azure SQL Database Service parameter update.")
+		err = mgmtClient.WaitForOperation(reqID, nil)
+		if err != nil {
+			return fmt.Errorf("Error waiting for Azure SQL Database Service parameter update: %s", err)
+		}
+	}
+
+	return nil
+}
+
+// resourceAzureSqlDatabaseServiceExists does all the necessary API calls to
+// check for the existence of the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database Service get request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	_, err := sqlClient.GetDatabase(serverName, name)
+	if err != nil {
+		if strings.Contains(err.Error(), "does not exist") {
+			d.SetId("")
+			return false, nil
+		} else {
+			return false, fmt.Errorf("Error whilst getting Azure SQL Database Service info: %s", err)
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureSqlDatabaseServiceDelete does all the necessary API calls to
+// delete the SQL Database Service off Azure.
+func resourceAzureSqlDatabaseServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	sqlClient := meta.(*Client).sqlClient
+
+	log.Println("[INFO] Issuing Azure SQL Database deletion request.")
+	name := d.Get("name").(string)
+	serverName := d.Get("database_server_name").(string)
+	return sqlClient.DeleteDatabase(serverName, name)
+}
diff --git a/builtin/providers/azure/resource_azure_sql_database_service_test.go b/builtin/providers/azure/resource_azure_sql_database_service_test.go
new file mode 100644
index 000000000..24d865774
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_sql_database_service_test.go
@@ -0,0 +1,190 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureSqlDatabaseServiceBasic(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigBasic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "collation",
+						"SQL_Latin1_General_CP1_CI_AS"),
+					resource.TestCheckResourceAttr(name, "edition", "Standard"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServiceAdvanced(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigAdvanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Premium"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"Arabic_BIN"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "10737418240"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"7203483a-c4fb-4304-9e9f-17c71c904f5d"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureSqlDatabaseServiceUpdate(t *testing.T) {
+	name := "azure_sql_database_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureSqlDatabaseServiceDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigAdvanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-testing-db"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Premium"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"Arabic_BIN"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "10737418240"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"7203483a-c4fb-4304-9e9f-17c71c904f5d"),
+				),
+			},
+			resource.TestStep{
+				Config: testAccAzureSqlDatabaseServiceConfigUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureSqlDatabaseServerGetName,
+					testAccCheckAzureSqlDatabaseServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name",
+						"terraform-testing-db-renamed"),
+					resource.TestCheckResourceAttrPtr(name, "database_server_name",
+						testAccAzureSqlServerName),
+					resource.TestCheckResourceAttr(name, "edition", "Standard"),
+					resource.TestCheckResourceAttr(name, "collation",
+						"SQL_Latin1_General_CP1_CI_AS"),
+					resource.TestCheckResourceAttr(name, "max_size_bytes", "5368709120"),
+					resource.TestCheckResourceAttr(name, "service_level_id",
+						"f1173c43-91bd-4aaa-973c-54e79e15235b"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureSqlDatabaseServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("SQL Service %s doesn't exist.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Service %s resource ID not set.", name)
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		dbs, err := sqlClient.ListDatabases(*testAccAzureSqlServerName)
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Service list request: %s", err)
+		}
+
+		for _, srv := range dbs.ServiceResources {
+			if srv.Name == resource.Primary.ID {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("SQL Service %s doesn't exist.", name)
+	}
+}
+
+func testAccCheckAzureSqlDatabaseServiceDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_sql_database_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("SQL Service resource ID not set.")
+		}
+
+		sqlClient := testAccProvider.Meta().(*Client).sqlClient
+		dbs, err := sqlClient.ListDatabases(*testAccAzureSqlServerName)
+		if err != nil {
+			return fmt.Errorf("Error issuing Azure SQL Service list request: %s", err)
+		}
+
+		for _, srv := range dbs.ServiceResources {
+			if srv.Name == resource.Primary.ID {
+				fmt.Errorf("SQL Service %s still exists.", resource.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureSqlDatabaseServiceConfigBasic = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Standard"
+}
+`
+
+const testAccAzureSqlDatabaseServiceConfigAdvanced = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Premium"
+    collation = "Arabic_BIN"
+    max_size_bytes = "10737418240"
+    service_level_id = "7203483a-c4fb-4304-9e9f-17c71c904f5d"
+}
+`
+
+const testAccAzureSqlDatabaseServiceConfigUpdate = testAccAzureSqlDatabaseServerConfig + `
+resource "azure_sql_database_service" "foo" {
+    name = "terraform-testing-db-renamed"
+    database_server_name = "${azure_sql_database_server.foo.name}"
+    edition = "Standard"
+    collation = "SQL_Latin1_General_CP1_CI_AS"
+    max_size_bytes = "5368709120"
+    service_level_id = "f1173c43-91bd-4aaa-973c-54e79e15235b"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_storage_blob.go b/builtin/providers/azure/resource_azure_storage_blob.go
new file mode 100644
index 000000000..de2431c2f
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_blob.go
@@ -0,0 +1,184 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageBlob returns the *schema.Resource associated
+// with a storage blob on Azure.
+func resourceAzureStorageBlob() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageBlobCreate,
+		Read:   resourceAzureStorageBlobRead,
+		Update: resourceAzureStorageBlobUpdate,
+		Exists: resourceAzureStorageBlobExists,
+		Delete: resourceAzureStorageBlobDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["type"],
+			},
+			"size": &schema.Schema{
+				Type:     schema.TypeInt,
+				Required: true,
+				ForceNew: true,
+				DefaultFunc: func() (interface{}, error) {
+					return int64(0), nil
+				},
+			},
+			"storage_container_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_container_name"],
+			},
+			"storage_service_name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+			"url": &schema.Schema{
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: parameterDescriptions["url"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageBlobCreate does all the necessary API calls to
+// create the storage blob on Azure.
+func resourceAzureStorageBlobCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing create on Azure storage blob.")
+	name := d.Get("name").(string)
+	blobType := d.Get("type").(string)
+	cont := d.Get("storage_container_name").(string)
+	switch blobType {
+	case "BlockBlob":
+		err = blobClient.CreateBlockBlob(cont, name)
+	case "PageBlob":
+		size := int64(d.Get("size").(int))
+		err = blobClient.PutPageBlob(cont, name, size)
+	default:
+		err = fmt.Errorf("Invalid blob type specified; see parameter desciptions for more info.")
+	}
+	if err != nil {
+		return fmt.Errorf("Error creating storage blob on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageBlobRead(d, meta)
+}
+
+// resourceAzureStorageBlobRead does all the necessary API calls to
+// read the status of the storage blob off Azure.
+func resourceAzureStorageBlobRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+
+	// check for it's existence:
+	exists, err := resourceAzureStorageBlobExists(d, meta)
+	if err != nil {
+		return err
+	}
+
+	// if it exists; read relevant information:
+	if exists {
+		storName := d.Get("storage_service_name").(string)
+
+		blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+		if err != nil {
+			return err
+		}
+
+		name := d.Get("name").(string)
+		cont := d.Get("storage_container_name").(string)
+		url := blobClient.GetBlobURL(cont, name)
+		d.Set("url", url)
+	}
+
+	// NOTE: no need to unset the ID here, as resourceAzureStorageBlobExists
+	// already should have done so if it were required.
+	return nil
+}
+
+// resourceAzureStorageBlobUpdate does all the necessary API calls to
+// update a blob on Azure.
+func resourceAzureStorageBlobUpdate(d *schema.ResourceData, meta interface{}) error {
+	// NOTE: although empty as most paramters have ForceNew set; this is
+	// still required in case of changes to the storage_service_key
+
+	// run the ExistsFunc beforehand to ensure the resource's existence nonetheless:
+	_, err := resourceAzureStorageBlobExists(d, meta)
+	return err
+}
+
+// resourceAzureStorageBlobExists does all the necessary API calls to
+// check for the existence of the blob on Azure.
+func resourceAzureStorageBlobExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return false, err
+	}
+
+	log.Println("[INFO] Querying Azure for storage blob's existence.")
+	name := d.Get("name").(string)
+	cont := d.Get("storage_container_name").(string)
+	exists, err := blobClient.BlobExists(cont, name)
+	if err != nil {
+		return false, fmt.Errorf("Error whilst checking for Azure storage blob's existence: %s", err)
+	}
+
+	// if not found; it means it was deleted in the meantime and
+	// we must remove it from the schema.
+	if !exists {
+		d.SetId("")
+	}
+
+	return exists, nil
+}
+
+// resourceAzureStorageBlobDelete does all the necessary API calls to
+// delete the blob off Azure.
+func resourceAzureStorageBlobDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing storage blob delete command off Azure.")
+	name := d.Get("name").(string)
+	cont := d.Get("storage_container_name").(string)
+	if _, err = blobClient.DeleteBlobIfExists(cont, name); err != nil {
+		return fmt.Errorf("Error whilst deleting storage blob: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_blob_test.go b/builtin/providers/azure/resource_azure_storage_blob_test.go
new file mode 100644
index 000000000..d559a6bcd
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_blob_test.go
@@ -0,0 +1,153 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageBlockBlob(t *testing.T) {
+	name := "azure_storage_blob.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageBlobDeleted("block"),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageBlockBlobConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageBlobExists(name, "block"),
+					resource.TestCheckResourceAttr(name, "name", "tftesting-blob"),
+					resource.TestCheckResourceAttr(name, "type", "BlockBlob"),
+					resource.TestCheckResourceAttr(name, "storage_container_name",
+						fmt.Sprintf("%s-block", testAccStorageContainerName)),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureStoragePageBlob(t *testing.T) {
+	name := "azure_storage_blob.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageBlobDeleted("page"),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStoragePageBlobConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageBlobExists(name, "page"),
+					resource.TestCheckResourceAttr(name, "name", "tftesting-blob"),
+					resource.TestCheckResourceAttr(name, "type", "PageBlob"),
+					resource.TestCheckResourceAttr(name, "size", "512"),
+					resource.TestCheckResourceAttr(name, "storage_container_name",
+						fmt.Sprintf("%s-page", testAccStorageContainerName)),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureStorageBlobExists(name, typ string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Container resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Container ID not set: %s", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.BlobExists(fmt.Sprintf("%s-%s", testAccStorageContainerName, typ),
+			resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Blob %s doesn't exist.", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageBlobDeleted(typ string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, resource := range s.RootModule().Resources {
+			if resource.Type != "azure_storage_blob" {
+				continue
+			}
+
+			azureClient := testAccProvider.Meta().(*Client)
+			blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+			if err != nil {
+				return err
+			}
+
+			exists, err := blobClient.BlobExists(fmt.Sprintf("%s-%s", testAccStorageContainerName,
+				typ), resource.Primary.ID)
+			if err != nil {
+				return err
+			}
+			if exists {
+				return fmt.Errorf("Azure Storage Blob still exists.")
+			}
+		}
+
+		return nil
+	}
+}
+
+var testAccAzureStorageBlockBlobConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s-block"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+
+resource "azure_storage_blob" "foo" {
+	name = "tftesting-blob"
+	type = "BlockBlob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "${azure_storage_container.foo.storage_service_name}"
+	storage_container_name = "${azure_storage_container.foo.name}"
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
+
+var testAccAzureStoragePageBlobConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s-page"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+
+resource "azure_storage_blob" "foo" {
+	name = "tftesting-blob"
+	type = "PageBlob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "${azure_storage_container.foo.storage_service_name}"
+	storage_container_name = "${azure_storage_container.foo.name}"
+    # NOTE: must be a multiple of 512:
+    size = 512
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_container.go b/builtin/providers/azure/resource_azure_storage_container.go
new file mode 100644
index 000000000..8b8e375da
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_container.go
@@ -0,0 +1,163 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/storage"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageContainer returns the *schema.Resource associated
+// to a storage container on Azure.
+func resourceAzureStorageContainer() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageContainerCreate,
+		Read:   resourceAzureStorageContainerRead,
+		Exists: resourceAzureStorageContainerExists,
+		Delete: resourceAzureStorageContainerDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"storage_service_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+			"container_access_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["container_access_type"],
+			},
+			"properties": &schema.Schema{
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Elem:        schema.TypeString,
+				Description: parameterDescriptions["properties"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageContainerCreate does all the necessary API calls to
+// create the storage container on Azure.
+func resourceAzureStorageContainerCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Creating storage container on Azure.")
+	name := d.Get("name").(string)
+	accessType := storage.ContainerAccessType(d.Get("container_access_type").(string))
+	err = blobClient.CreateContainer(name, accessType)
+	if err != nil {
+		return fmt.Errorf("Failed to create storage container on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageContainerRead(d, meta)
+}
+
+// resourceAzureStorageContainerRead does all the necessary API calls to
+// read the status of the storage container off Azure.
+func resourceAzureStorageContainerRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Querying Azure for storage containers.")
+	name := d.Get("name").(string)
+	containers, err := blobClient.ListContainers(storage.ListContainersParameters{
+		Prefix:  name,
+		Timeout: 90,
+	})
+	if err != nil {
+		return fmt.Errorf("Failed to query Azure for its storage containers: %s", err)
+	}
+
+	// search for our storage container and update its stats:
+	var found bool
+	// loop just to make sure we got the right container:
+	for _, cont := range containers.Containers {
+		if cont.Name == name {
+			found = true
+
+			props := make(map[string]interface{})
+			props["last_modified"] = cont.Properties.LastModified
+			props["lease_status"] = cont.Properties.LeaseStatus
+			props["lease_state"] = cont.Properties.LeaseState
+			props["lease_duration"] = cont.Properties.LeaseDuration
+
+			d.Set("properties", props)
+		}
+	}
+
+	// if not found; it means the resource has been deleted
+	// in the meantime; so we must untrack it:
+	if !found {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureStorageContainerExists does all the necessary API calls to
+// check if the storage container already exists on Azure.
+func resourceAzureStorageContainerExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return false, err
+	}
+
+	log.Println("[INFO] Checking existence of storage container on Azure.")
+	name := d.Get("name").(string)
+	exists, err := blobClient.ContainerExists(name)
+	if err != nil {
+		return false, fmt.Errorf("Failed to query for Azure storage container existence: %s", err)
+	}
+
+	// if it does not exist; untrack the resource:
+	if !exists {
+		d.SetId("")
+	}
+	return exists, nil
+}
+
+// resourceAzureStorageContainerDelete does all the necessary API calls to
+// delete a storage container off Azure.
+func resourceAzureStorageContainerDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storName := d.Get("storage_service_name").(string)
+
+	blobClient, err := azureClient.getStorageServiceBlobClient(storName)
+	if err != nil {
+		return err
+	}
+
+	log.Println("[INFO] Issuing Azure storage container deletion call.")
+	name := d.Get("name").(string)
+	if _, err := blobClient.DeleteContainerIfExists(name); err != nil {
+		return fmt.Errorf("Failed deleting storage container off Azure: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_container_test.go b/builtin/providers/azure/resource_azure_storage_container_test.go
new file mode 100644
index 000000000..6c110c5e4
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_container_test.go
@@ -0,0 +1,97 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageContainer(t *testing.T) {
+	name := "azure_storage_container.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageContainerDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageContainerConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageContainerExists(name),
+					resource.TestCheckResourceAttr(name, "name", testAccStorageContainerName),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+					resource.TestCheckResourceAttr(name, "container_access_type", "blob"),
+				),
+			},
+		},
+	})
+
+	// because containers take a while to get deleted, sleep for one minute:
+	time.Sleep(3 * time.Minute)
+}
+
+func testAccCheckAzureStorageContainerExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Container resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Container ID not set: %s", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.ContainerExists(resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Container %s doesn't exist.", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageContainerDestroyed(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_container" {
+			continue
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		blobClient, err := azureClient.getStorageServiceBlobClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := blobClient.ContainerExists(resource.Primary.ID)
+		if err != nil {
+			return err
+		}
+		if exists {
+			return fmt.Errorf("Azure Storage Container still exists.")
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureStorageContainerConfig = fmt.Sprintf(`
+resource "azure_storage_container" "foo" {
+	name = "%s"
+	container_access_type = "blob"
+    # NOTE: A pre-existing Storage Service is used here so as to avoid
+    # the huge wait for creation of one.
+	storage_service_name = "%s"
+}
+`, testAccStorageContainerName, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_queue.go b/builtin/providers/azure/resource_azure_storage_queue.go
new file mode 100644
index 000000000..4799e236e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_queue.go
@@ -0,0 +1,103 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageQueue returns the *schema.Resource associated
+// to a storage queue on Azure.
+func resourceAzureStorageQueue() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageQueueCreate,
+		Read:   resourceAzureStorageQueueRead,
+		Delete: resourceAzureStorageQueueDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["name"],
+			},
+			"storage_service_name": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["storage_service_name"],
+			},
+		},
+	}
+}
+
+// resourceAzureStorageQueueCreate does all the necessary API calls to
+// create a storage queue on Azure.
+func resourceAzureStorageQueueCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// create the queue:
+	log.Println("Sending Storage Queue creation request to Azure.")
+	name := d.Get("name").(string)
+	err = queueClient.CreateQueue(name)
+	if err != nil {
+		return fmt.Errorf("Error creation Storage Queue on Azure: %s", err)
+	}
+
+	d.SetId(name)
+	return nil
+}
+
+// resourceAzureStorageQueueRead does all the necessary API calls to
+// read the state of the storage queue off Azure.
+func resourceAzureStorageQueueRead(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// check for queue's existence:
+	log.Println("[INFO] Sending Storage Queue existence query to Azure.")
+	name := d.Get("name").(string)
+	exists, err := queueClient.QueueExists(name)
+	if err != nil {
+		return fmt.Errorf("Error checking for Storage Queue existence: %s", err)
+	}
+
+	// If the queue has been deleted in the meantime;
+	// untrack the resource from the schema.
+	if !exists {
+		d.SetId("")
+	}
+
+	return nil
+}
+
+// resourceAzureStorageQueueDelete does all the necessary API calls to
+// delete the storage queue off Azure.
+func resourceAzureStorageQueueDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	storServName := d.Get("storage_service_name").(string)
+	queueClient, err := azureClient.getStorageServiceQueueClient(storServName)
+	if err != nil {
+		return err
+	}
+
+	// issue the deletion of the storage queue:
+	log.Println("[INFO] Sending Storage Queue deletion request to Azure.")
+	name := d.Get("name").(string)
+	err = queueClient.DeleteQueue(name)
+	if err != nil {
+		return fmt.Errorf("Error deleting Storage queue off Azure: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_queue_test.go b/builtin/providers/azure/resource_azure_storage_queue_test.go
new file mode 100644
index 000000000..c7c691f4e
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_queue_test.go
@@ -0,0 +1,93 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageQueue(t *testing.T) {
+	name := "azure_storage_queue.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureStorageQueueDeleted,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageQueueConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureStorageQueueExists(name),
+					resource.TestCheckResourceAttr(name, "name", "terraform-queue"),
+					resource.TestCheckResourceAttr(name, "storage_service_name", testAccStorageServiceName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureStorageQueueExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Queue resource '%s' is missing.", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service Queue ID %s is missing.", name)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		queueClient, err := azureClient.getStorageServiceQueueClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := queueClient.QueueExists(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Error querying Azure for Storage Queue existence: %s", err)
+		}
+		if !exists {
+			return fmt.Errorf("Azure Storage Queue %s doesn't exist!", resource.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureStorageQueueDeleted(s *terraform.State) error {
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_queue" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service Queue ID %s is missing.", resource.Primary.ID)
+		}
+
+		azureClient := testAccProvider.Meta().(*Client)
+		queueClient, err := azureClient.getStorageServiceQueueClient(testAccStorageServiceName)
+		if err != nil {
+			return err
+		}
+
+		exists, err := queueClient.QueueExists(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Error querying Azure for Storage Queue existence: %s", err)
+		}
+		if exists {
+			return fmt.Errorf("Azure Storage Queue %s still exists!", resource.Primary.ID)
+		}
+	}
+
+	return nil
+}
+
+var testAccAzureStorageQueueConfig = fmt.Sprintf(`
+resource "azure_storage_queue" "foo" {
+    name = "terraform-queue"
+    storage_service_name = "%s"
+}
+`, testAccStorageServiceName)
diff --git a/builtin/providers/azure/resource_azure_storage_service.go b/builtin/providers/azure/resource_azure_storage_service.go
new file mode 100644
index 000000000..1d3a0c251
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_service.go
@@ -0,0 +1,217 @@
+package azure
+
+import (
+	"encoding/base64"
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/storageservice"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// resourceAzureStorageService returns the *schema.Resource associated
+// to an Azure hosted service.
+func resourceAzureStorageService() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureStorageServiceCreate,
+		Read:   resourceAzureStorageServiceRead,
+		Exists: resourceAzureStorageServiceExists,
+		Delete: resourceAzureStorageServiceDelete,
+
+		Schema: map[string]*schema.Schema{
+			// General attributes:
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				// TODO(aznashwan): constrain name in description
+				Description: parameterDescriptions["name"],
+			},
+			"location": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["location"],
+			},
+			"label": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Default:     "Made by Terraform.",
+				Description: parameterDescriptions["label"],
+			},
+			"description": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["description"],
+			},
+			// Functional attributes:
+			"account_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["account_type"],
+			},
+			"affinity_group": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Description: parameterDescriptions["affinity_group"],
+			},
+			"properties": &schema.Schema{
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Elem:     schema.TypeString,
+			},
+			// Computed attributes:
+			"url": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"primary_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"secondary_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// resourceAzureStorageServiceCreate does all the necessary API calls to
+// create a new Azure storage service.
+func resourceAzureStorageServiceCreate(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	storageServiceClient := azureClient.storageServiceClient
+
+	// get all the values:
+	log.Println("[INFO] Creating Azure Storage Service creation parameters.")
+	name := d.Get("name").(string)
+	location := d.Get("location").(string)
+	accountType := storageservice.AccountType(d.Get("account_type").(string))
+	affinityGroup := d.Get("affinity_group").(string)
+	description := d.Get("description").(string)
+	label := base64.StdEncoding.EncodeToString([]byte(d.Get("label").(string)))
+	var props []storageservice.ExtendedProperty
+	if given := d.Get("properties").(map[string]interface{}); len(given) > 0 {
+		props = []storageservice.ExtendedProperty{}
+		for k, v := range given {
+			props = append(props, storageservice.ExtendedProperty{
+				Name:  k,
+				Value: v.(string),
+			})
+		}
+	}
+
+	// create parameters and send request:
+	log.Println("[INFO] Sending Storage Service creation request to Azure.")
+	reqID, err := storageServiceClient.CreateStorageService(
+		storageservice.StorageAccountCreateParameters{
+			ServiceName:   name,
+			Location:      location,
+			Description:   description,
+			Label:         label,
+			AffinityGroup: affinityGroup,
+			AccountType:   accountType,
+			ExtendedProperties: storageservice.ExtendedPropertyList{
+				ExtendedProperty: props,
+			},
+		})
+	if err != nil {
+		return fmt.Errorf("Failed to create Azure storage service %s: %s", name, err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Failed creating storage service %s: %s", name, err)
+	}
+
+	d.SetId(name)
+	return resourceAzureStorageServiceRead(d, meta)
+}
+
+// resourceAzureStorageServiceRead does all the necessary API calls to
+// read the state of the storage service off Azure.
+func resourceAzureStorageServiceRead(d *schema.ResourceData, meta interface{}) error {
+	storageServiceClient := meta.(*Client).storageServiceClient
+
+	// get our storage service:
+	log.Println("[INFO] Sending query about storage service to Azure.")
+	name := d.Get("name").(string)
+	storsvc, err := storageServiceClient.GetStorageService(name)
+	if err != nil {
+		if !management.IsResourceNotFoundError(err) {
+			return fmt.Errorf("Failed to query about Azure about storage service: %s", err)
+		} else {
+			// it means that the resource has been deleted from Azure
+			// in the meantime and we must remove its associated Resource.
+			d.SetId("")
+			return nil
+
+		}
+	}
+
+	// read values:
+	d.Set("url", storsvc.URL)
+	log.Println("[INFO] Querying keys of Azure storage service.")
+	keys, err := storageServiceClient.GetStorageServiceKeys(name)
+	if err != nil {
+		return fmt.Errorf("Failed querying keys for Azure storage service: %s", err)
+	}
+	d.Set("primary_key", keys.PrimaryKey)
+	d.Set("secondary_key", keys.SecondaryKey)
+
+	return nil
+}
+
+// resourceAzureStorageServiceExists does all the necessary API calls to
+// check if the storage service exists on Azure.
+func resourceAzureStorageServiceExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	storageServiceClient := meta.(*Client).storageServiceClient
+
+	// get our storage service:
+	log.Println("[INFO] Sending query about storage service to Azure.")
+	name := d.Get("name").(string)
+	_, err := storageServiceClient.GetStorageService(name)
+	if err != nil {
+		if !management.IsResourceNotFoundError(err) {
+			return false, fmt.Errorf("Failed to query about Azure about storage service: %s", err)
+		} else {
+			// it means that the resource has been deleted from Azure
+			// in the meantime and we must remove its associated Resource.
+			d.SetId("")
+			return false, nil
+
+		}
+	}
+
+	return true, nil
+}
+
+// resourceAzureStorageServiceDelete does all the necessary API calls to
+// delete the storage service off Azure.
+func resourceAzureStorageServiceDelete(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mgmtClient := azureClient.mgmtClient
+	storageServiceClient := azureClient.storageServiceClient
+
+	// issue the deletion:
+	name := d.Get("name").(string)
+	log.Println("[INFO] Issuing delete of storage service off Azure.")
+	reqID, err := storageServiceClient.DeleteStorageService(name)
+	if err != nil {
+		return fmt.Errorf("Error whilst issuing deletion of storage service off Azure: %s", err)
+	}
+	err = mgmtClient.WaitForOperation(reqID, nil)
+	if err != nil {
+		return fmt.Errorf("Error whilst deleting storage service off Azure: %s", err)
+	}
+
+	d.SetId("")
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_storage_service_test.go b/builtin/providers/azure/resource_azure_storage_service_test.go
new file mode 100644
index 000000000..e3ac588d2
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_storage_service_test.go
@@ -0,0 +1,78 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureStorageService(t *testing.T) {
+	name := "azure_storage_service.foo"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAzureStorageServiceDestroyed,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureStorageServiceConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccAzureStorageServiceExists(name),
+					resource.TestCheckResourceAttr(name, "name", "tftesting"),
+					resource.TestCheckResourceAttr(name, "location", "West US"),
+					resource.TestCheckResourceAttr(name, "description", "very descriptive"),
+					resource.TestCheckResourceAttr(name, "account_type", "Standard_LRS"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAzureStorageServiceExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Azure Storage Service Resource not found: %s", name)
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service ID not set.")
+		}
+
+		storageServiceClient := testAccProvider.Meta().(*Client).storageServiceClient
+		_, err := storageServiceClient.GetStorageService(resource.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccAzureStorageServiceDestroyed(s *terraform.State) error {
+	storageServiceClient := testAccProvider.Meta().(*Client).storageServiceClient
+
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azure_storage_service" {
+			continue
+		}
+
+		if resource.Primary.ID == "" {
+			return fmt.Errorf("Azure Storage Service ID not set.")
+		}
+
+		_, err := storageServiceClient.GetStorageService(resource.Primary.ID)
+		return testAccResourceDestroyedErrorFilter("Storage Service", err)
+	}
+
+	return nil
+}
+
+var testAccAzureStorageServiceConfig = `
+resource "azure_storage_service" "foo" {
+  # NOTE: storage service names constrained to lowercase letters only.
+  name = "tftesting"
+  location = "West US"
+  description = "very descriptive"
+  account_type = "Standard_LRS"
+}
+`
diff --git a/builtin/providers/azure/resource_azure_virtual_network.go b/builtin/providers/azure/resource_azure_virtual_network.go
new file mode 100644
index 000000000..dcb008f07
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_virtual_network.go
@@ -0,0 +1,367 @@
+package azure
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+const (
+	virtualNetworkRetrievalError = "Error retrieving Virtual Network Configuration: %s"
+)
+
+func resourceAzureVirtualNetwork() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureVirtualNetworkCreate,
+		Read:   resourceAzureVirtualNetworkRead,
+		Update: resourceAzureVirtualNetworkUpdate,
+		Delete: resourceAzureVirtualNetworkDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"address_space": &schema.Schema{
+				Type:     schema.TypeList,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+
+			"dns_servers_names": &schema.Schema{
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+
+			"subnet": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"address_prefix": &schema.Schema{
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"security_group": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+				Set: resourceAzureSubnetHash,
+			},
+
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAzureVirtualNetworkCreate(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	name := d.Get("name").(string)
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		if management.IsResourceNotFoundError(err) {
+			// if no network config exists yet; create a new one now:
+			nc = virtualnetwork.NetworkConfiguration{}
+		} else {
+			return fmt.Errorf(virtualNetworkRetrievalError, err)
+		}
+	}
+
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == name {
+			return fmt.Errorf("Virtual Network %s already exists!", name)
+		}
+	}
+
+	network := createVirtualNetwork(d)
+	nc.Configuration.VirtualNetworkSites = append(nc.Configuration.VirtualNetworkSites, network)
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error creating Virtual Network %s: %s", name, err)
+	}
+
+	// Wait until the virtual network is created
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be created: %s", name, err)
+	}
+
+	d.SetId(name)
+
+	if err := associateSecurityGroups(d, meta); err != nil {
+		return err
+	}
+
+	return resourceAzureVirtualNetworkRead(d, meta)
+}
+
+func resourceAzureVirtualNetworkRead(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	vnetClient := ac.vnetClient
+	secGroupClient := ac.secGroupClient
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == d.Id() {
+			d.Set("address_space", n.AddressSpace.AddressPrefix)
+			d.Set("location", n.Location)
+
+			// Create a new set to hold all configured subnets
+			subnets := &schema.Set{
+				F: resourceAzureSubnetHash,
+			}
+
+			// Loop through all endpoints
+			for _, s := range n.Subnets {
+				subnet := map[string]interface{}{}
+
+				// Get the associated (if any) security group
+				sg, err := secGroupClient.GetNetworkSecurityGroupForSubnet(s.Name, d.Id())
+				if err != nil && !management.IsResourceNotFoundError(err) {
+					return fmt.Errorf(
+						"Error retrieving Network Security Group associations of subnet %s: %s", s.Name, err)
+				}
+
+				// Update the values
+				subnet["name"] = s.Name
+				subnet["address_prefix"] = s.AddressPrefix
+				subnet["security_group"] = sg.Name
+
+				subnets.Add(subnet)
+			}
+
+			d.Set("subnet", subnets)
+
+			return nil
+		}
+	}
+
+	log.Printf("[DEBUG] Virtual Network %s does no longer exist", d.Id())
+	d.SetId("")
+
+	return nil
+}
+
+func resourceAzureVirtualNetworkUpdate(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	found := false
+	for i, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name == d.Id() {
+			network := createVirtualNetwork(d)
+			nc.Configuration.VirtualNetworkSites[i] = network
+
+			found = true
+		}
+	}
+
+	if !found {
+		return fmt.Errorf("Virtual Network %s does not exists!", d.Id())
+	}
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error updating Virtual Network %s: %s", d.Id(), err)
+	}
+
+	// Wait until the virtual network is updated
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be updated: %s", d.Id(), err)
+	}
+
+	if err := associateSecurityGroups(d, meta); err != nil {
+		return err
+	}
+
+	return resourceAzureVirtualNetworkRead(d, meta)
+}
+
+func resourceAzureVirtualNetworkDelete(d *schema.ResourceData, meta interface{}) error {
+	ac := meta.(*Client)
+	mc := ac.mgmtClient
+	vnetClient := ac.vnetClient
+
+	// Lock the client just before we get the virtual network configuration and immediately
+	// set an defer to unlock the client again whenever this function exits
+	ac.mutex.Lock()
+	defer ac.mutex.Unlock()
+
+	nc, err := vnetClient.GetVirtualNetworkConfiguration()
+	if err != nil {
+		return fmt.Errorf(virtualNetworkRetrievalError, err)
+	}
+
+	filtered := nc.Configuration.VirtualNetworkSites[:0]
+	for _, n := range nc.Configuration.VirtualNetworkSites {
+		if n.Name != d.Id() {
+			filtered = append(filtered, n)
+		}
+	}
+
+	nc.Configuration.VirtualNetworkSites = filtered
+
+	req, err := vnetClient.SetVirtualNetworkConfiguration(nc)
+	if err != nil {
+		return fmt.Errorf("Error deleting Virtual Network %s: %s", d.Id(), err)
+	}
+
+	// Wait until the virtual network is deleted
+	if err := mc.WaitForOperation(req, nil); err != nil {
+		return fmt.Errorf("Error waiting for Virtual Network %s to be deleted: %s", d.Id(), err)
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+func resourceAzureSubnetHash(v interface{}) int {
+	m := v.(map[string]interface{})
+	subnet := m["name"].(string) + m["address_prefix"].(string) + m["security_group"].(string)
+	return hashcode.String(subnet)
+}
+
+func createVirtualNetwork(d *schema.ResourceData) virtualnetwork.VirtualNetworkSite {
+	// fetch address spaces:
+	var prefixes []string
+	for _, prefix := range d.Get("address_space").([]interface{}) {
+		prefixes = append(prefixes, prefix.(string))
+	}
+
+	// fetch DNS references:
+	var dnsRefs []virtualnetwork.DNSServerRef
+	for _, dns := range d.Get("dns_servers_names").([]interface{}) {
+		dnsRefs = append(dnsRefs, virtualnetwork.DNSServerRef{
+			Name: dns.(string),
+		})
+	}
+
+	// Add all subnets that are configured
+	var subnets []virtualnetwork.Subnet
+	if rs := d.Get("subnet").(*schema.Set); rs.Len() > 0 {
+		for _, subnet := range rs.List() {
+			subnet := subnet.(map[string]interface{})
+			subnets = append(subnets, virtualnetwork.Subnet{
+				Name:          subnet["name"].(string),
+				AddressPrefix: subnet["address_prefix"].(string),
+			})
+		}
+	}
+
+	return virtualnetwork.VirtualNetworkSite{
+		Name:     d.Get("name").(string),
+		Location: d.Get("location").(string),
+		AddressSpace: virtualnetwork.AddressSpace{
+			AddressPrefix: prefixes,
+		},
+		DNSServersRef: dnsRefs,
+		Subnets:       subnets,
+	}
+}
+
+func associateSecurityGroups(d *schema.ResourceData, meta interface{}) error {
+	azureClient := meta.(*Client)
+	mc := azureClient.mgmtClient
+	secGroupClient := azureClient.secGroupClient
+
+	virtualNetwork := d.Get("name").(string)
+
+	if rs := d.Get("subnet").(*schema.Set); rs.Len() > 0 {
+		for _, subnet := range rs.List() {
+			subnet := subnet.(map[string]interface{})
+			securityGroup := subnet["security_group"].(string)
+			subnetName := subnet["name"].(string)
+
+			// Get the associated (if any) security group
+			sg, err := secGroupClient.GetNetworkSecurityGroupForSubnet(subnetName, d.Id())
+			if err != nil && !management.IsResourceNotFoundError(err) {
+				return fmt.Errorf(
+					"Error retrieving Network Security Group associations of subnet %s: %s", subnetName, err)
+			}
+
+			// If the desired and actual security group are the same, were done so can just continue
+			if sg.Name == securityGroup {
+				continue
+			}
+
+			// If there is an associated security group, make sure we first remove it from the subnet
+			if sg.Name != "" {
+				req, err := secGroupClient.RemoveNetworkSecurityGroupFromSubnet(sg.Name, subnetName, virtualNetwork)
+				if err != nil {
+					return fmt.Errorf("Error removing Network Security Group %s from subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+
+				// Wait until the security group is associated
+				if err := mc.WaitForOperation(req, nil); err != nil {
+					return fmt.Errorf(
+						"Error waiting for Network Security Group %s to be removed from subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+			}
+
+			// If the desired security group is not empty, assign the security group to the subnet
+			if securityGroup != "" {
+				req, err := secGroupClient.AddNetworkSecurityToSubnet(securityGroup, subnetName, virtualNetwork)
+				if err != nil {
+					return fmt.Errorf("Error associating Network Security Group %s to subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+
+				// Wait until the security group is associated
+				if err := mc.WaitForOperation(req, nil); err != nil {
+					return fmt.Errorf(
+						"Error waiting for Network Security Group %s to be associated with subnet %s: %s",
+						securityGroup, subnetName, err)
+				}
+			}
+
+		}
+	}
+
+	return nil
+}
diff --git a/builtin/providers/azure/resource_azure_virtual_network_test.go b/builtin/providers/azure/resource_azure_virtual_network_test.go
new file mode 100644
index 000000000..f6d637f16
--- /dev/null
+++ b/builtin/providers/azure/resource_azure_virtual_network_test.go
@@ -0,0 +1,278 @@
+package azure
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/Azure/azure-sdk-for-go/management/virtualnetwork"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAzureVirtualNetwork_basic(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.1787288781.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.1787288781.address_prefix", "10.1.2.0/25"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureVirtualNetwork_advanced(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.address_prefix", "10.1.2.0/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.security_group", "terraform-security-group1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureVirtualNetwork_update(t *testing.T) {
+	var network virtualnetwork.VirtualNetworkSite
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAzureVirtualNetworkDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_advanced,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.2.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.address_prefix", "10.1.2.0/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.33778499.security_group", "terraform-security-group1"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccAzureVirtualNetwork_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAzureVirtualNetworkExists(
+						"azure_virtual_network.foo", &network),
+					testAccCheckAzureVirtualNetworkAttributes(&network),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "name", "terraform-vnet"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "location", "West US"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "address_space.0", "10.1.3.0/24"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.name", "subnet1"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.address_prefix", "10.1.3.128/25"),
+					resource.TestCheckResourceAttr(
+						"azure_virtual_network.foo", "subnet.514595123.security_group", "terraform-security-group2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAzureVirtualNetworkExists(
+	n string,
+	network *virtualnetwork.VirtualNetworkSite) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Virtual Network ID is set")
+		}
+
+		vnetClient := testAccProvider.Meta().(*Client).vnetClient
+		nc, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return err
+		}
+
+		for _, n := range nc.Configuration.VirtualNetworkSites {
+			if n.Name == rs.Primary.ID {
+				*network = n
+
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Virtual Network not found")
+	}
+}
+
+func testAccCheckAzureVirtualNetworkAttributes(
+	network *virtualnetwork.VirtualNetworkSite) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if network.Name != "terraform-vnet" {
+			return fmt.Errorf("Bad name: %s", network.Name)
+		}
+
+		if network.Location != "West US" {
+			return fmt.Errorf("Bad location: %s", network.Location)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAzureVirtualNetworkDestroy(s *terraform.State) error {
+	vnetClient := testAccProvider.Meta().(*Client).vnetClient
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "azure_virtual_network" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Virtual Network ID is set")
+		}
+
+		nc, err := vnetClient.GetVirtualNetworkConfiguration()
+		if err != nil {
+			return fmt.Errorf("Error retrieving Virtual Network Configuration: %s", err)
+		}
+
+		for _, n := range nc.Configuration.VirtualNetworkSites {
+			if n.Name == rs.Primary.ID {
+				return fmt.Errorf("Virtual Network %s still exists", rs.Primary.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+const testAccAzureVirtualNetwork_basic = `
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+    }
+}`
+
+const testAccAzureVirtualNetwork_advanced = `
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+        security_group = "${azure_security_group.foo.name}"
+    }
+}`
+
+const testAccAzureVirtualNetwork_update = `
+resource "azure_security_group" "foo" {
+    name = "terraform-security-group1"
+    location = "West US"
+}
+
+resource "azure_security_group_rule" "foo" {
+	name = "terraform-secgroup-rule"
+	security_group_names = ["${azure_security_group.foo.name}"]
+	type = "Inbound"
+	action = "Deny"
+	priority = 200
+	source_address_prefix = "100.0.0.0/32"
+	source_port_range = "1000"
+	destination_address_prefix = "10.0.0.0/32"
+	destination_port_range = "1000"
+	protocol = "TCP"
+}
+
+resource "azure_security_group" "bar" {
+    name = "terraform-security-group2"
+    location = "West US"
+}
+
+resource "azure_virtual_network" "foo" {
+    name = "terraform-vnet"
+    address_space = ["10.1.3.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.3.128/25"
+        security_group = "${azure_security_group.bar.name}"
+    }
+}`
diff --git a/builtin/providers/azure/resources.go b/builtin/providers/azure/resources.go
new file mode 100644
index 000000000..6512f735e
--- /dev/null
+++ b/builtin/providers/azure/resources.go
@@ -0,0 +1 @@
+package azure
diff --git a/builtin/providers/azure/utils_test.go b/builtin/providers/azure/utils_test.go
new file mode 100644
index 000000000..3a3212263
--- /dev/null
+++ b/builtin/providers/azure/utils_test.go
@@ -0,0 +1,20 @@
+package azure
+
+import (
+	"fmt"
+
+	"github.com/Azure/azure-sdk-for-go/management"
+)
+
+// testAccResourceDestroyedErrorFilter tests whether the given error is an azure ResourceNotFound
+// error and properly annotates it if otherwise:
+func testAccResourceDestroyedErrorFilter(resource string, err error) error {
+	switch {
+	case err == nil:
+		return fmt.Errorf("Azure %s still exists.", resource)
+	case err != nil && management.IsResourceNotFoundError(err):
+		return nil
+	default:
+		return err
+	}
+}
diff --git a/builtin/providers/cloudflare/resource_cloudflare_record.go b/builtin/providers/cloudflare/resource_cloudflare_record.go
index 3ffcd01d7..03f3c00eb 100644
--- a/builtin/providers/cloudflare/resource_cloudflare_record.go
+++ b/builtin/providers/cloudflare/resource_cloudflare_record.go
@@ -3,6 +3,7 @@ package cloudflare
 import (
 	"fmt"
 	"log"
+	"strings"
 
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/pearkes/cloudflare"
@@ -91,7 +92,14 @@ func resourceCloudFlareRecordRead(d *schema.ResourceData, meta interface{}) erro
 
 	rec, err := client.RetrieveRecord(d.Get("domain").(string), d.Id())
 	if err != nil {
-		return fmt.Errorf("Couldn't find CloudFlare Record ID (%s) for domain (%s): %s", d.Id(), d.Get("domain").(string), err)
+		if strings.Contains(err.Error(), "not found") {
+			d.SetId("")
+			return nil
+		}
+
+		return fmt.Errorf(
+			"Couldn't find CloudFlare Record ID (%s) for domain (%s): %s",
+			d.Id(), d.Get("domain").(string), err)
 	}
 
 	d.Set("name", rec.Name)
diff --git a/builtin/providers/cloudstack/provider.go b/builtin/providers/cloudstack/provider.go
index 8cdafd1ab..73ce38b76 100644
--- a/builtin/providers/cloudstack/provider.go
+++ b/builtin/providers/cloudstack/provider.go
@@ -45,6 +45,7 @@ func Provider() terraform.ResourceProvider {
 			"cloudstack_network_acl_rule":     resourceCloudStackNetworkACLRule(),
 			"cloudstack_nic":                  resourceCloudStackNIC(),
 			"cloudstack_port_forward":         resourceCloudStackPortForward(),
+			"cloudstack_ssh_keypair":          resourceCloudStackSSHKeyPair(),
 			"cloudstack_template":             resourceCloudStackTemplate(),
 			"cloudstack_vpc":                  resourceCloudStackVPC(),
 			"cloudstack_vpn_connection":       resourceCloudStackVPNConnection(),
diff --git a/builtin/providers/cloudstack/provider_test.go b/builtin/providers/cloudstack/provider_test.go
index c9da7dc8a..76a60870e 100644
--- a/builtin/providers/cloudstack/provider_test.go
+++ b/builtin/providers/cloudstack/provider_test.go
@@ -39,7 +39,7 @@ func testSetValueOnResourceData(t *testing.T) {
 	}
 }
 
-func testSetUuidOnResourceData(t *testing.T) {
+func testSetUUIDOnResourceData(t *testing.T) {
 	d := schema.ResourceData{}
 	d.Set("id", "54711781-274e-41b2-83c0-17194d0108f7")
 
@@ -60,30 +60,116 @@ func testAccPreCheck(t *testing.T) {
 	if v := os.Getenv("CLOUDSTACK_SECRET_KEY"); v == "" {
 		t.Fatal("CLOUDSTACK_SECRET_KEY must be set for acceptance tests")
 	}
+	if v := os.Getenv("CLOUDSTACK_2ND_NIC_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_2ND_NIC_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_2ND_NIC_NETWORK"); v == "" {
+		t.Fatal("CLOUDSTACK_2ND_NIC_NETWORK must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_DISK_OFFERING_1"); v == "" {
+		t.Fatal("CLOUDSTACK_DISK_OFFERING_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_DISK_OFFERING_2"); v == "" {
+		t.Fatal("CLOUDSTACK_DISK_OFFERING_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_HYPERVISOR"); v == "" {
+		t.Fatal("CLOUDSTACK_HYPERVISOR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SERVICE_OFFERING_1"); v == "" {
+		t.Fatal("CLOUDSTACK_SERVICE_OFFERING_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SERVICE_OFFERING_2"); v == "" {
+		t.Fatal("CLOUDSTACK_SERVICE_OFFERING_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_1"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_1_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_1_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_CIDR"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_CIDR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_NETWORK_2_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_NETWORK_2_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_CIDR_1"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_CIDR_1 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_CIDR_2"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_CIDR_2 must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_NETWORK_CIDR"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_NETWORK_CIDR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_VPC_NETWORK_OFFERING"); v == "" {
+		t.Fatal("CLOUDSTACK_VPC_NETWORK_OFFERING must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PUBLIC_IPADDRESS"); v == "" {
+		t.Fatal("CLOUDSTACK_PUBLIC_IPADDRESS must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SSH_KEYPAIR"); v == "" {
+		t.Fatal("CLOUDSTACK_SSH_KEYPAIR must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_SSH_PUBLIC_KEY"); v == "" {
+		t.Fatal("CLOUDSTACK_SSH_PUBLIC_KEY must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_FORMAT"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_FORMAT must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_URL"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_URL must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_TEMPLATE_OS_TYPE"); v == "" {
+		t.Fatal("CLOUDSTACK_TEMPLATE_OS_TYPE must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PROJECT_NAME"); v == "" {
+		t.Fatal("CLOUDSTACK_PROJECT_NAME must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_PROJECT_NETWORK"); v == "" {
+		t.Fatal("CLOUDSTACK_PROJECT_NETWORK must be set for acceptance tests")
+	}
+	if v := os.Getenv("CLOUDSTACK_ZONE"); v == "" {
+		t.Fatal("CLOUDSTACK_ZONE must be set for acceptance tests")
+	}
 }
 
-// SET THESE VALUES IN ORDER TO RUN THE ACC TESTS!!
-var CLOUDSTACK_2ND_NIC_IPADDRESS = ""
-var CLOUDSTACK_2ND_NIC_NETWORK = ""
-var CLOUDSTACK_DISK_OFFERING_1 = ""
-var CLOUDSTACK_DISK_OFFERING_2 = ""
-var CLOUDSTACK_HYPERVISOR = ""
-var CLOUDSTACK_SERVICE_OFFERING_1 = ""
-var CLOUDSTACK_SERVICE_OFFERING_2 = ""
-var CLOUDSTACK_NETWORK_1 = ""
-var CLOUDSTACK_NETWORK_1_IPADDRESS = ""
-var CLOUDSTACK_NETWORK_2 = ""
-var CLOUDSTACK_NETWORK_2_CIDR = ""
-var CLOUDSTACK_NETWORK_2_OFFERING = ""
-var CLOUDSTACK_NETWORK_2_IPADDRESS = ""
-var CLOUDSTACK_VPC_CIDR_1 = ""
-var CLOUDSTACK_VPC_CIDR_2 = ""
-var CLOUDSTACK_VPC_OFFERING = ""
-var CLOUDSTACK_VPC_NETWORK_CIDR = ""
-var CLOUDSTACK_VPC_NETWORK_OFFERING = ""
-var CLOUDSTACK_PUBLIC_IPADDRESS = ""
-var CLOUDSTACK_TEMPLATE = ""
-var CLOUDSTACK_TEMPLATE_FORMAT = ""
-var CLOUDSTACK_TEMPLATE_URL = ""
-var CLOUDSTACK_TEMPLATE_OS_TYPE = ""
-var CLOUDSTACK_ZONE = ""
+var CLOUDSTACK_2ND_NIC_IPADDRESS = os.Getenv("CLOUDSTACK_2ND_NIC_IPADDRESS")
+var CLOUDSTACK_2ND_NIC_NETWORK = os.Getenv("CLOUDSTACK_2ND_NIC_NETWORK")
+var CLOUDSTACK_DISK_OFFERING_1 = os.Getenv("CLOUDSTACK_DISK_OFFERING_1")
+var CLOUDSTACK_DISK_OFFERING_2 = os.Getenv("CLOUDSTACK_DISK_OFFERING_2")
+var CLOUDSTACK_HYPERVISOR = os.Getenv("CLOUDSTACK_HYPERVISOR")
+var CLOUDSTACK_SERVICE_OFFERING_1 = os.Getenv("CLOUDSTACK_SERVICE_OFFERING_1")
+var CLOUDSTACK_SERVICE_OFFERING_2 = os.Getenv("CLOUDSTACK_SERVICE_OFFERING_2")
+var CLOUDSTACK_NETWORK_1 = os.Getenv("CLOUDSTACK_NETWORK_1")
+var CLOUDSTACK_NETWORK_1_IPADDRESS = os.Getenv("CLOUDSTACK_NETWORK_1_IPADDRESS")
+var CLOUDSTACK_NETWORK_2 = os.Getenv("CLOUDSTACK_NETWORK_2")
+var CLOUDSTACK_NETWORK_2_CIDR = os.Getenv("CLOUDSTACK_NETWORK_2_CIDR")
+var CLOUDSTACK_NETWORK_2_OFFERING = os.Getenv("CLOUDSTACK_NETWORK_2_OFFERING")
+var CLOUDSTACK_NETWORK_2_IPADDRESS = os.Getenv("CLOUDSTACK_NETWORK_2_IPADDRESS")
+var CLOUDSTACK_VPC_CIDR_1 = os.Getenv("CLOUDSTACK_VPC_CIDR_1")
+var CLOUDSTACK_VPC_CIDR_2 = os.Getenv("CLOUDSTACK_VPC_CIDR_2")
+var CLOUDSTACK_VPC_OFFERING = os.Getenv("CLOUDSTACK_VPC_OFFERING")
+var CLOUDSTACK_VPC_NETWORK_CIDR = os.Getenv("CLOUDSTACK_VPC_NETWORK_CIDR")
+var CLOUDSTACK_VPC_NETWORK_OFFERING = os.Getenv("CLOUDSTACK_VPC_NETWORK_OFFERING")
+var CLOUDSTACK_PUBLIC_IPADDRESS = os.Getenv("CLOUDSTACK_PUBLIC_IPADDRESS")
+var CLOUDSTACK_SSH_PUBLIC_KEY = os.Getenv("CLOUDSTACK_SSH_PUBLIC_KEY")
+var CLOUDSTACK_TEMPLATE = os.Getenv("CLOUDSTACK_TEMPLATE")
+var CLOUDSTACK_TEMPLATE_FORMAT = os.Getenv("CLOUDSTACK_TEMPLATE_FORMAT")
+var CLOUDSTACK_TEMPLATE_URL = os.Getenv("CLOUDSTACK_TEMPLATE_URL")
+var CLOUDSTACK_TEMPLATE_OS_TYPE = os.Getenv("CLOUDSTACK_TEMPLATE_OS_TYPE")
+var CLOUDSTACK_PROJECT_NAME = os.Getenv("CLOUDSTACK_PROJECT_NAME")
+var CLOUDSTACK_PROJECT_NETWORK = os.Getenv("CLOUDSTACK_PROJECT_NETWORK")
+var CLOUDSTACK_ZONE = os.Getenv("CLOUDSTACK_ZONE")
diff --git a/builtin/providers/cloudstack/resource_cloudstack_disk_test.go b/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
index 0f4b49c77..5eee8ed8d 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_disk_test.go
@@ -35,7 +35,7 @@ func TestAccCloudStackDisk_device(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckCloudStackDiskDestroyAdvanced,
+		CheckDestroy: testAccCheckCloudStackDiskDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccCloudStackDisk_device,
@@ -57,7 +57,7 @@ func TestAccCloudStackDisk_update(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckCloudStackDiskDestroyAdvanced,
+		CheckDestroy: testAccCheckCloudStackDiskDestroy,
 		Steps: []resource.TestStep{
 			resource.TestStep{
 				Config: testAccCloudStackDisk_update,
@@ -151,57 +151,9 @@ func testAccCheckCloudStackDiskDestroy(s *terraform.State) error {
 			return fmt.Errorf("No disk ID is set")
 		}
 
-		p := cs.Volume.NewDeleteVolumeParams(rs.Primary.ID)
-		_, err := cs.Volume.DeleteVolume(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting disk (%s): %s",
-				rs.Primary.ID, err)
-		}
-	}
-
-	return nil
-}
-
-func testAccCheckCloudStackDiskDestroyAdvanced(s *terraform.State) error {
-	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
-
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "cloudstack_disk" {
-			continue
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No disk ID is set")
-		}
-
-		p := cs.Volume.NewDeleteVolumeParams(rs.Primary.ID)
-		_, err := cs.Volume.DeleteVolume(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting disk (%s): %s",
-				rs.Primary.ID, err)
-		}
-	}
-
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "cloudstack_instance" {
-			continue
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No instance ID is set")
-		}
-
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Volume.GetVolumeByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Disk %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
index 9211ba34e..0fa5fbf25 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
@@ -154,11 +154,9 @@ func testAccCheckCloudStackEgressFirewallDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeleteEgressFirewallRuleParams(uuid)
-			_, err := cs.Firewall.DeleteEgressFirewallRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetEgressFirewallRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Egress rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
index bb629cfab..2be2cebea 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
@@ -148,11 +148,9 @@ func testAccCheckCloudStackFirewallDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeleteFirewallRuleParams(uuid)
-			_, err := cs.Firewall.DeleteFirewallRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetFirewallRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Firewall rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_instance.go b/builtin/providers/cloudstack/resource_cloudstack_instance.go
index c07678f3e..2c434f53c 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_instance.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_instance.go
@@ -56,12 +56,23 @@ func resourceCloudStackInstance() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"project": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"zone": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
 
+			"keypair": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
 			"user_data": &schema.Schema{
 				Type:     schema.TypeString,
 				Optional: true,
@@ -136,15 +147,35 @@ func resourceCloudStackInstanceCreate(d *schema.ResourceData, meta interface{})
 		p.SetIpaddress(ipaddres.(string))
 	}
 
+	// If there is a project supplied, we retreive and set the project id
+	if project, ok := d.GetOk("project"); ok {
+		// Retrieve the project UUID
+		projectid, e := retrieveUUID(cs, "project", project.(string))
+		if e != nil {
+			return e.Error()
+		}
+		// Set the default project ID
+		p.SetProjectid(projectid)
+	}
+
+	// If a keypair is supplied, add it to the parameter struct
+	if keypair, ok := d.GetOk("keypair"); ok {
+		p.SetKeypair(keypair.(string))
+	}
+
 	// If the user data contains any info, it needs to be base64 encoded and
 	// added to the parameter struct
 	if userData, ok := d.GetOk("user_data"); ok {
 		ud := base64.StdEncoding.EncodeToString([]byte(userData.(string)))
-		if len(ud) > 2048 {
+
+		// deployVirtualMachine uses POST, so max userdata is 32K
+		// https://github.com/xanzy/go-cloudstack/commit/c767de689df1faedfec69233763a7c5334bee1f6
+		if len(ud) > 32768 {
 			return fmt.Errorf(
 				"The supplied user_data contains %d bytes after encoding, "+
-					"this exeeds the limit of 2048 bytes", len(ud))
+					"this exeeds the limit of 32768 bytes", len(ud))
 		}
+
 		p.SetUserdata(ud)
 	}
 
@@ -186,10 +217,12 @@ func resourceCloudStackInstanceRead(d *schema.ResourceData, meta interface{}) er
 	d.Set("display_name", vm.Displayname)
 	d.Set("ipaddress", vm.Nic[0].Ipaddress)
 	d.Set("zone", vm.Zonename)
+	//NB cloudstack sometimes sends back the wrong keypair name, so dont update it
 
 	setValueOrUUID(d, "network", vm.Nic[0].Networkname, vm.Nic[0].Networkid)
 	setValueOrUUID(d, "service_offering", vm.Serviceofferingname, vm.Serviceofferingid)
 	setValueOrUUID(d, "template", vm.Templatename, vm.Templateid)
+	setValueOrUUID(d, "project", vm.Project, vm.Projectid)
 
 	return nil
 }
@@ -220,41 +253,58 @@ func resourceCloudStackInstanceUpdate(d *schema.ResourceData, meta interface{})
 		d.SetPartial("display_name")
 	}
 
-	// Check if the service offering is changed and if so, update the offering
-	if d.HasChange("service_offering") {
-		log.Printf("[DEBUG] Service offering changed for %s, starting update", name)
-
-		// Retrieve the service_offering UUID
-		serviceofferingid, e := retrieveUUID(cs, "service_offering", d.Get("service_offering").(string))
-		if e != nil {
-			return e.Error()
-		}
-
-		// Create a new parameter struct
-		p := cs.VirtualMachine.NewChangeServiceForVirtualMachineParams(d.Id(), serviceofferingid)
-
-		// Before we can actually change the service offering, the virtual machine must be stopped
+	// Attributes that require reboot to update
+	if d.HasChange("service_offering") || d.HasChange("keypair") {
+		// Before we can actually make these changes, the virtual machine must be stopped
 		_, err := cs.VirtualMachine.StopVirtualMachine(cs.VirtualMachine.NewStopVirtualMachineParams(d.Id()))
 		if err != nil {
 			return fmt.Errorf(
-				"Error stopping instance %s before changing service offering: %s", name, err)
+				"Error stopping instance %s before making changes: %s", name, err)
 		}
-		// Change the service offering
-		_, err = cs.VirtualMachine.ChangeServiceForVirtualMachine(p)
-		if err != nil {
-			return fmt.Errorf(
-				"Error changing the service offering for instance %s: %s", name, err)
+
+		// Check if the service offering is changed and if so, update the offering
+		if d.HasChange("service_offering") {
+			log.Printf("[DEBUG] Service offering changed for %s, starting update", name)
+
+			// Retrieve the service_offering UUID
+			serviceofferingid, e := retrieveUUID(cs, "service_offering", d.Get("service_offering").(string))
+			if e != nil {
+				return e.Error()
+			}
+
+			// Create a new parameter struct
+			p := cs.VirtualMachine.NewChangeServiceForVirtualMachineParams(d.Id(), serviceofferingid)
+
+			// Change the service offering
+			_, err = cs.VirtualMachine.ChangeServiceForVirtualMachine(p)
+			if err != nil {
+				return fmt.Errorf(
+					"Error changing the service offering for instance %s: %s", name, err)
+			}
+			d.SetPartial("service_offering")
 		}
+
+		if d.HasChange("keypair") {
+			log.Printf("[DEBUG] SSH keypair changed for %s, starting update", name)
+
+			p := cs.SSH.NewResetSSHKeyForVirtualMachineParams(d.Id(), d.Get("keypair").(string))
+
+			// Change the ssh keypair
+			_, err = cs.SSH.ResetSSHKeyForVirtualMachine(p)
+			if err != nil {
+				return fmt.Errorf(
+					"Error changing the SSH keypair for instance %s: %s", name, err)
+			}
+			d.SetPartial("keypair")
+		}
+
 		// Start the virtual machine again
 		_, err = cs.VirtualMachine.StartVirtualMachine(cs.VirtualMachine.NewStartVirtualMachineParams(d.Id()))
 		if err != nil {
 			return fmt.Errorf(
-				"Error starting instance %s after changing service offering: %s", name, err)
+				"Error starting instance %s after making changes", name)
 		}
-
-		d.SetPartial("service_offering")
 	}
-
 	d.Partial(false)
 	return resourceCloudStackInstanceRead(d, meta)
 }
diff --git a/builtin/providers/cloudstack/resource_cloudstack_instance_test.go b/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
index 2d1be9c53..b0f241a67 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_instance_test.go
@@ -24,9 +24,7 @@ func TestAccCloudStackInstance_basic(t *testing.T) {
 						"cloudstack_instance.foobar", &instance),
 					testAccCheckCloudStackInstanceAttributes(&instance),
 					resource.TestCheckResourceAttr(
-						"cloudstack_instance.foobar",
-						"user_data",
-						"0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
+						"cloudstack_instance.foobar", "user_data", "0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
 				),
 			},
 		},
@@ -47,6 +45,8 @@ func TestAccCloudStackInstance_update(t *testing.T) {
 					testAccCheckCloudStackInstanceExists(
 						"cloudstack_instance.foobar", &instance),
 					testAccCheckCloudStackInstanceAttributes(&instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "user_data", "0cf3dcdc356ec8369494cb3991985ecd5296cdd5"),
 				),
 			},
 
@@ -87,6 +87,48 @@ func TestAccCloudStackInstance_fixedIP(t *testing.T) {
 	})
 }
 
+func TestAccCloudStackInstance_keyPair(t *testing.T) {
+	var instance cloudstack.VirtualMachine
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackInstance_keyPair,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackInstanceExists(
+						"cloudstack_instance.foobar", &instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "keypair", "terraform-test-keypair"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackInstance_project(t *testing.T) {
+	var instance cloudstack.VirtualMachine
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackInstance_project,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackInstanceExists(
+						"cloudstack_instance.foobar", &instance),
+					resource.TestCheckResourceAttr(
+						"cloudstack_instance.foobar", "project", CLOUDSTACK_PROJECT_NAME),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudStackInstanceExists(
 	n string, instance *cloudstack.VirtualMachine) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -172,13 +214,9 @@ func testAccCheckCloudStackInstanceDestroy(s *terraform.State) error {
 			return fmt.Errorf("No instance ID is set")
 		}
 
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VirtualMachine.GetVirtualMachineByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Virtual Machine %s still exists", rs.Primary.ID)
 		}
 	}
 
@@ -233,3 +271,42 @@ resource "cloudstack_instance" "foobar" {
 	CLOUDSTACK_NETWORK_1_IPADDRESS,
 	CLOUDSTACK_TEMPLATE,
 	CLOUDSTACK_ZONE)
+
+var testAccCloudStackInstance_keyPair = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+}
+
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  display_name = "terraform"
+  service_offering= "%s"
+  network = "%s"
+  ipaddress = "%s"
+  template = "%s"
+  zone = "%s"
+	keypair = "${cloudstack_ssh_keypair.foo.name}"
+  expunge = true
+}`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_NETWORK_1_IPADDRESS,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_ZONE)
+
+var testAccCloudStackInstance_project = fmt.Sprintf(`
+resource "cloudstack_instance" "foobar" {
+  name = "terraform-test"
+  display_name = "terraform"
+  service_offering= "%s"
+	network = "%s"
+  template = "%s"
+	project = "%s"
+  zone = "%s"
+  expunge = true
+}`,
+	CLOUDSTACK_SERVICE_OFFERING_1,
+	CLOUDSTACK_PROJECT_NETWORK,
+	CLOUDSTACK_TEMPLATE,
+	CLOUDSTACK_PROJECT_NAME,
+	CLOUDSTACK_ZONE)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go b/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
index 59d942b63..ea2e440b0 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_ipaddress.go
@@ -136,7 +136,7 @@ func resourceCloudStackIPAddressDelete(d *schema.ResourceData, meta interface{})
 			return nil
 		}
 
-		return fmt.Errorf("Error deleting network ACL list %s: %s", d.Get("name").(string), err)
+		return fmt.Errorf("Error disassociating IP address %s: %s", d.Get("name").(string), err)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go b/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
index dfdeba209..edf120573 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go
@@ -103,13 +103,9 @@ func testAccCheckCloudStackIPAddressDestroy(s *terraform.State) error {
 			return fmt.Errorf("No IP address ID is set")
 		}
 
-		p := cs.Address.NewDisassociateIpAddressParams(rs.Primary.ID)
-		_, err := cs.Address.DisassociateIpAddress(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error disassociating IP address (%s): %s",
-				rs.Primary.ID, err)
+		ip, _, err := cs.Address.GetPublicIpAddressByID(rs.Primary.ID)
+		if err == nil && ip.Associatednetworkid != "" {
+			return fmt.Errorf("Public IP %s still associated", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
index 5b88b0254..5fc42d434 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
@@ -160,11 +160,9 @@ func testAccCheckCloudStackNetworkACLRuleDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.NetworkACL.NewDeleteNetworkACLParams(uuid)
-			_, err := cs.NetworkACL.DeleteNetworkACL(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.NetworkACL.GetNetworkACLByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Network ACL rule %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
index 9bf0bb0cf..c8a58a8fe 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go
@@ -86,13 +86,9 @@ func testAccCheckCloudStackNetworkACLDestroy(s *terraform.State) error {
 			return fmt.Errorf("No network ACL ID is set")
 		}
 
-		p := cs.NetworkACL.NewDeleteNetworkACLListParams(rs.Primary.ID)
-		_, err := cs.NetworkACL.DeleteNetworkACLList(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting network ACL (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.NetworkACL.GetNetworkACLListByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network ACl list %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_test.go
index 74e639ba2..2cc366c15 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_test.go
@@ -140,13 +140,9 @@ func testAccCheckCloudStackNetworkDestroy(s *terraform.State) error {
 			return fmt.Errorf("No network ID is set")
 		}
 
-		p := cs.Network.NewDeleteNetworkParams(rs.Primary.ID)
-		_, err := cs.Network.DeleteNetwork(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting network (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Network.GetNetworkByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Network %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_nic_test.go b/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
index 338c0848f..ef302cbd7 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_nic_test.go
@@ -140,13 +140,9 @@ func testAccCheckCloudStackNICDestroy(s *terraform.State) error {
 			return fmt.Errorf("No instance ID is set")
 		}
 
-		p := cs.VirtualMachine.NewDestroyVirtualMachineParams(rs.Primary.ID)
-		_, err := cs.VirtualMachine.DestroyVirtualMachine(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting instance (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VirtualMachine.GetVirtualMachineByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("Virtual Machine %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go b/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
index 6a99caf54..39ebfe8f6 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_port_forward_test.go
@@ -140,11 +140,9 @@ func testAccCheckCloudStackPortForwardDestroy(s *terraform.State) error {
 				continue
 			}
 
-			p := cs.Firewall.NewDeletePortForwardingRuleParams(uuid)
-			_, err := cs.Firewall.DeletePortForwardingRule(p)
-
-			if err != nil {
-				return err
+			_, _, err := cs.Firewall.GetPortForwardingRuleByID(uuid)
+			if err == nil {
+				return fmt.Errorf("Port forward %s still exists", rs.Primary.ID)
 			}
 		}
 	}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go
new file mode 100644
index 000000000..9fb859a22
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair.go
@@ -0,0 +1,129 @@
+package cloudstack
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/mitchellh/go-homedir"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackSSHKeyPair() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackSSHKeyPairCreate,
+		Read:   resourceCloudStackSSHKeyPairRead,
+		Delete: resourceCloudStackSSHKeyPairDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"public_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"private_key": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"fingerprint": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackSSHKeyPairCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	name := d.Get("name").(string)
+	publicKey := d.Get("public_key").(string)
+
+	if publicKey != "" {
+		// Register supplied key
+		keyPath, err := homedir.Expand(publicKey)
+		if err != nil {
+			return fmt.Errorf("Error expanding the public key path: %v", err)
+		}
+
+		key, err := ioutil.ReadFile(keyPath)
+		if err != nil {
+			return fmt.Errorf("Error reading the public key: %v", err)
+		}
+
+		p := cs.SSH.NewRegisterSSHKeyPairParams(name, string(key))
+		_, err = cs.SSH.RegisterSSHKeyPair(p)
+		if err != nil {
+			return err
+		}
+	} else {
+		// No key supplied, must create one and return the private key
+		p := cs.SSH.NewCreateSSHKeyPairParams(name)
+		r, err := cs.SSH.CreateSSHKeyPair(p)
+		if err != nil {
+			return err
+		}
+		d.Set("private_key", r.Privatekey)
+	}
+
+	log.Printf("[DEBUG] Key pair successfully generated at Cloudstack")
+	d.SetId(name)
+
+	return resourceCloudStackSSHKeyPairRead(d, meta)
+}
+
+func resourceCloudStackSSHKeyPairRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	log.Printf("[DEBUG] looking for key pair with name %s", d.Id())
+
+	p := cs.SSH.NewListSSHKeyPairsParams()
+	p.SetName(d.Id())
+
+	r, err := cs.SSH.ListSSHKeyPairs(p)
+	if err != nil {
+		return err
+	}
+	if r.Count == 0 {
+		log.Printf("[DEBUG] Key pair %s does not exist", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	//SSHKeyPair name is unique in a cloudstack account so dont need to check for multiple
+	d.Set("name", r.SSHKeyPairs[0].Name)
+	d.Set("fingerprint", r.SSHKeyPairs[0].Fingerprint)
+
+	return nil
+}
+
+func resourceCloudStackSSHKeyPairDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.SSH.NewDeleteSSHKeyPairParams(d.Id())
+
+	// Remove the SSH Keypair
+	_, err := cs.SSH.DeleteSSHKeyPair(p)
+	if err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"A key pair with name '%s' does not exist for account", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error deleting key pair: %s", err)
+	}
+
+	return nil
+}
diff --git a/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go
new file mode 100644
index 000000000..ba70518d5
--- /dev/null
+++ b/builtin/providers/cloudstack/resource_cloudstack_ssh_keypair_test.go
@@ -0,0 +1,170 @@
+package cloudstack
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackSSHKeyPair_basic(t *testing.T) {
+	var sshkey cloudstack.SSHKeyPair
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSSHKeyPairDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSSHKeyPair_create,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSSHKeyPairExists("cloudstack_ssh_keypair.foo", &sshkey),
+					testAccCheckCloudStackSSHKeyPairAttributes(&sshkey),
+					testAccCheckCloudStackSSHKeyPairCreateAttributes("terraform-test-keypair"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackSSHKeyPair_register(t *testing.T) {
+	var sshkey cloudstack.SSHKeyPair
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackSSHKeyPairDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackSSHKeyPair_register,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackSSHKeyPairExists("cloudstack_ssh_keypair.foo", &sshkey),
+					testAccCheckCloudStackSSHKeyPairAttributes(&sshkey),
+					resource.TestCheckResourceAttr(
+						"cloudstack_ssh_keypair.foo",
+						"public_key",
+						CLOUDSTACK_SSH_PUBLIC_KEY),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackSSHKeyPairExists(n string, sshkey *cloudstack.SSHKeyPair) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No key pair ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+		p := cs.SSH.NewListSSHKeyPairsParams()
+		p.SetName(rs.Primary.ID)
+
+		list, err := cs.SSH.ListSSHKeyPairs(p)
+		if err != nil {
+			return err
+		}
+
+		if list.Count != 1 || list.SSHKeyPairs[0].Name != rs.Primary.ID {
+			return fmt.Errorf("Key pair not found")
+		}
+
+		*sshkey = *list.SSHKeyPairs[0]
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairAttributes(
+	keypair *cloudstack.SSHKeyPair) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		fpLen := len(keypair.Fingerprint)
+		if fpLen != 47 {
+			return fmt.Errorf("SSH key: Attribute private_key expected length 47, got %d", fpLen)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairCreateAttributes(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		found := false
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "cloudstack_ssh_keypair" {
+				continue
+			}
+
+			if rs.Primary.ID != name {
+				continue
+			}
+
+			if !strings.Contains(rs.Primary.Attributes["private_key"], "PRIVATE KEY") {
+				return fmt.Errorf(
+					"SSH key: Attribute private_key expected 'PRIVATE KEY' to be present, got %s",
+					rs.Primary.Attributes["private_key"])
+			}
+
+			found = true
+			break
+		}
+
+		if !found {
+			return fmt.Errorf("Could not find key pair %s", name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackSSHKeyPairDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_ssh_keypair" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No key pair ID is set")
+		}
+
+		p := cs.SSH.NewListSSHKeyPairsParams()
+		p.SetName(rs.Primary.ID)
+
+		list, err := cs.SSH.ListSSHKeyPairs(p)
+		if err != nil {
+			return err
+		}
+		if list.Count != 1 {
+			return fmt.Errorf("Found more Key pair %s still exists", rs.Primary.ID)
+		}
+
+		if list.SSHKeyPairs[0].Name == rs.Primary.ID {
+			return fmt.Errorf("Key pair %s still exists", rs.Primary.ID)
+		}
+	}
+
+	return nil
+}
+
+var testAccCloudStackSSHKeyPair_create = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+}`)
+
+var testAccCloudStackSSHKeyPair_register = fmt.Sprintf(`
+resource "cloudstack_ssh_keypair" "foo" {
+  name = "terraform-test-keypair"
+  public_key = "%s"
+}`, CLOUDSTACK_SSH_PUBLIC_KEY)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_template.go b/builtin/providers/cloudstack/resource_cloudstack_template.go
index f50316027..15c6ebec4 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_template.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_template.go
@@ -292,9 +292,9 @@ func resourceCloudStackTemplateDelete(d *schema.ResourceData, meta interface{})
 
 func verifyTemplateParams(d *schema.ResourceData) error {
 	format := d.Get("format").(string)
-	if format != "QCOW2" && format != "RAW" && format != "VHD" && format != "VMDK" {
+	if format != "OVA" && format != "QCOW2" && format != "RAW" && format != "VHD" && format != "VMDK" {
 		return fmt.Errorf(
-			"%s is not a valid format. Valid options are 'QCOW2', 'RAW', 'VHD' and 'VMDK'", format)
+			"%s is not a valid format. Valid options are 'OVA','QCOW2', 'RAW', 'VHD' and 'VMDK'", format)
 	}
 
 	return nil
diff --git a/builtin/providers/cloudstack/resource_cloudstack_template_test.go b/builtin/providers/cloudstack/resource_cloudstack_template_test.go
index 3e78461dc..f98130661 100755
--- a/builtin/providers/cloudstack/resource_cloudstack_template_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_template_test.go
@@ -149,13 +149,9 @@ func testAccCheckCloudStackTemplateDestroy(s *terraform.State) error {
 			return fmt.Errorf("No template ID is set")
 		}
 
-		p := cs.Template.NewDeleteTemplateParams(rs.Primary.ID)
-		_, err := cs.Template.DeleteTemplate(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting template (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.Template.GetTemplateByID(rs.Primary.ID, "executable")
+		if err == nil {
+			return fmt.Errorf("Template %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
index 07861a091..011358a95 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpc_test.go
@@ -92,13 +92,9 @@ func testAccCheckCloudStackVPCDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPC ID is set")
 		}
 
-		p := cs.VPC.NewDeleteVPCParams(rs.Primary.ID)
-		_, err := cs.VPC.DeleteVPC(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPC (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPC.GetVPCByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPC %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
index 41a065725..7d09eea9b 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go
@@ -71,13 +71,9 @@ func testAccCheckCloudStackVPNConnectionDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Connection ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnConnectionParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnConnection(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Connection (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnConnectionByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Connection %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
index 459d95016..b24eb3567 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go
@@ -163,13 +163,9 @@ func testAccCheckCloudStackVPNCustomerGatewayDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Customer Gateway ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnCustomerGatewayParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnCustomerGateway(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Customer Gateway (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnCustomerGatewayByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Customer Gateway %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go b/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
index b017e6456..61fc15160 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go
@@ -71,13 +71,9 @@ func testAccCheckCloudStackVPNGatewayDestroy(s *terraform.State) error {
 			return fmt.Errorf("No VPN Gateway ID is set")
 		}
 
-		p := cs.VPN.NewDeleteVpnGatewayParams(rs.Primary.ID)
-		_, err := cs.VPN.DeleteVpnGateway(p)
-
-		if err != nil {
-			return fmt.Errorf(
-				"Error deleting VPN Gateway (%s): %s",
-				rs.Primary.ID, err)
+		_, _, err := cs.VPN.GetVpnGatewayByID(rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("VPN Gateway %s still exists", rs.Primary.ID)
 		}
 	}
 
diff --git a/builtin/providers/cloudstack/resources.go b/builtin/providers/cloudstack/resources.go
index 85fa0bd5a..5d0e5eb55 100644
--- a/builtin/providers/cloudstack/resources.go
+++ b/builtin/providers/cloudstack/resources.go
@@ -79,6 +79,8 @@ func retrieveUUID(cs *cloudstack.CloudStackClient, name, value string) (uuid str
 			break
 		}
 		err = fmt.Errorf("Could not find UUID of OS Type: %s", value)
+	case "project":
+		uuid, err = cs.Project.GetProjectID(value)
 	default:
 		return uuid, &retrieveError{name: name, value: value,
 			err: fmt.Errorf("Unknown request: %s", name)}
diff --git a/builtin/providers/consul/resource_consul_keys_test.go b/builtin/providers/consul/resource_consul_keys_test.go
index e1a959b7d..97890335c 100644
--- a/builtin/providers/consul/resource_consul_keys_test.go
+++ b/builtin/providers/consul/resource_consul_keys_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAccConsulKeys(t *testing.T) {
+func TestAccConsulKeys_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() {},
 		Providers:    testAccProviders,
diff --git a/builtin/providers/digitalocean/resource_digitalocean_droplet.go b/builtin/providers/digitalocean/resource_digitalocean_droplet.go
index f801eed67..88c0c6d07 100644
--- a/builtin/providers/digitalocean/resource_digitalocean_droplet.go
+++ b/builtin/providers/digitalocean/resource_digitalocean_droplet.go
@@ -165,6 +165,12 @@ func resourceDigitalOceanDropletRead(d *schema.ResourceData, meta interface{}) e
 	// Retrieve the droplet properties for updating the state
 	droplet, err := client.RetrieveDroplet(d.Id())
 	if err != nil {
+		// check if the droplet no longer exists.
+		if err.Error() == "Error retrieving droplet: API Error: 404 Not Found" {
+			d.SetId("")
+			return nil
+		}
+
 		return fmt.Errorf("Error retrieving droplet: %s", err)
 	}
 
diff --git a/builtin/providers/dme/resource_dme_record.go b/builtin/providers/dme/resource_dme_record.go
index 6c50523bf..8e078e420 100644
--- a/builtin/providers/dme/resource_dme_record.go
+++ b/builtin/providers/dme/resource_dme_record.go
@@ -110,6 +110,11 @@ func resourceDMERecordRead(d *schema.ResourceData, meta interface{}) error {
 
 	rec, err := client.ReadRecord(domainid, recordid)
 	if err != nil {
+		if strings.Contains(err.Error(), "Unable to find") {
+			d.SetId("")
+			return nil
+		}
+
 		return fmt.Errorf("Couldn't find record: %s", err)
 	}
 
diff --git a/builtin/providers/dme/resource_dme_record_test.go b/builtin/providers/dme/resource_dme_record_test.go
index 284ab0ad9..430afacb2 100644
--- a/builtin/providers/dme/resource_dme_record_test.go
+++ b/builtin/providers/dme/resource_dme_record_test.go
@@ -13,7 +13,7 @@ import (
 var _ = fmt.Sprintf("dummy") // dummy
 var _ = os.DevNull           // dummy
 
-func TestAccDMERecordA(t *testing.T) {
+func TestAccDMERecord_basic(t *testing.T) {
 	var record dnsmadeeasy.Record
 	domainid := os.Getenv("DME_DOMAINID")
 
diff --git a/builtin/providers/docker/resource_docker_container.go b/builtin/providers/docker/resource_docker_container.go
index 10481b268..59e65b9c1 100644
--- a/builtin/providers/docker/resource_docker_container.go
+++ b/builtin/providers/docker/resource_docker_container.go
@@ -136,6 +136,12 @@ func resourceDockerContainer() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+
+			"privileged": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
 		},
 	}
 }
diff --git a/builtin/providers/docker/resource_docker_container_funcs.go b/builtin/providers/docker/resource_docker_container_funcs.go
index c6bd9dea8..058a4411b 100644
--- a/builtin/providers/docker/resource_docker_container_funcs.go
+++ b/builtin/providers/docker/resource_docker_container_funcs.go
@@ -5,11 +5,16 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"time"
 
 	dc "github.com/fsouza/go-dockerclient"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
+var (
+	creationTime time.Time
+)
+
 func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) error {
 	var err error
 	client := meta.(*dc.Client)
@@ -23,9 +28,8 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 	if _, ok := data.DockerImages[image]; !ok {
 		if _, ok := data.DockerImages[image+":latest"]; !ok {
 			return fmt.Errorf("Unable to find image %s", image)
-		} else {
-			image = image + ":latest"
 		}
+		image = image + ":latest"
 	}
 
 	// The awesome, wonderful, splendiferous, sensical
@@ -85,6 +89,7 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 	d.SetId(retContainer.ID)
 
 	hostConfig := &dc.HostConfig{
+		Privileged:      d.Get("privileged").(bool),
 		PublishAllPorts: d.Get("publish_all_ports").(bool),
 	}
 
@@ -107,6 +112,7 @@ func resourceDockerContainerCreate(d *schema.ResourceData, meta interface{}) err
 		hostConfig.Links = stringSetToStringSlice(v.(*schema.Set))
 	}
 
+	creationTime = time.Now()
 	if err := client.StartContainer(retContainer.ID, hostConfig); err != nil {
 		return fmt.Errorf("Unable to start container: %s", err)
 	}
@@ -121,21 +127,49 @@ func resourceDockerContainerRead(d *schema.ResourceData, meta interface{}) error
 	if err != nil {
 		return err
 	}
-
 	if apiContainer == nil {
 		// This container doesn't exist anymore
 		d.SetId("")
-
 		return nil
 	}
 
-	container, err := client.InspectContainer(apiContainer.ID)
-	if err != nil {
-		return fmt.Errorf("Error inspecting container %s: %s", apiContainer.ID, err)
+	var container *dc.Container
+
+	loops := 1 // if it hasn't just been created, don't delay
+	if !creationTime.IsZero() {
+		loops = 30 // with 500ms spacing, 15 seconds; ought to be plenty
+	}
+	sleepTime := 500 * time.Millisecond
+
+	for i := loops; i > 0; i-- {
+		container, err = client.InspectContainer(apiContainer.ID)
+		if err != nil {
+			return fmt.Errorf("Error inspecting container %s: %s", apiContainer.ID, err)
+		}
+
+		if container.State.Running ||
+			(!container.State.Running && !d.Get("must_run").(bool)) {
+			break
+		}
+
+		if creationTime.IsZero() { // We didn't just create it, so don't wait around
+			return resourceDockerContainerDelete(d, meta)
+		}
+
+		if container.State.FinishedAt.After(creationTime) {
+			// It exited immediately, so error out so dependent containers
+			// aren't started
+			resourceDockerContainerDelete(d, meta)
+			return fmt.Errorf("Container %s exited after creation, error was: %s", apiContainer.ID, container.State.Error)
+		}
+
+		time.Sleep(sleepTime)
 	}
 
-	if d.Get("must_run").(bool) && !container.State.Running {
-		return resourceDockerContainerDelete(d, meta)
+	// Handle the case of the for loop above running its course
+	if !container.State.Running && d.Get("must_run").(bool) {
+		resourceDockerContainerDelete(d, meta)
+		return fmt.Errorf("Container %s failed to be in running state", apiContainer.ID)
 	}
 
 	// Read Network Settings
@@ -200,15 +234,17 @@ func fetchDockerContainer(name string, client *dc.Client) (*dc.APIContainers, er
 		// Sometimes the Docker API prefixes container names with /
 		// like it does in these commands. But if there's no
 		// set name, it just uses the ID without a /...ugh.
-		var dockerContainerName string
-		if len(apiContainer.Names) > 0 {
-			dockerContainerName = strings.TrimLeft(apiContainer.Names[0], "/")
-		} else {
-			dockerContainerName = apiContainer.ID
-		}
-
-		if dockerContainerName == name {
-			return &apiContainer, nil
+		switch len(apiContainer.Names) {
+		case 0:
+			if apiContainer.ID == name {
+				return &apiContainer, nil
+			}
+		default:
+			for _, containerName := range apiContainer.Names {
+				if strings.TrimLeft(containerName, "/") == name {
+					return &apiContainer, nil
+				}
+			}
 		}
 	}
 
diff --git a/builtin/providers/docker/resource_docker_container_test.go b/builtin/providers/docker/resource_docker_container_test.go
index 48302d096..29ecc4bb3 100644
--- a/builtin/providers/docker/resource_docker_container_test.go
+++ b/builtin/providers/docker/resource_docker_container_test.go
@@ -53,7 +53,7 @@ func testAccContainerRunning(n string) resource.TestCheckFunc {
 
 const testAccDockerContainerConfig = `
 resource "docker_image" "foo" {
-	name = "ubuntu:trusty-20150320"
+	name = "nginx:latest"
 }
 
 resource "docker_container" "foo" {
diff --git a/builtin/providers/docker/resource_docker_image_funcs.go b/builtin/providers/docker/resource_docker_image_funcs.go
index 8fb58ba28..f45dd2226 100644
--- a/builtin/providers/docker/resource_docker_image_funcs.go
+++ b/builtin/providers/docker/resource_docker_image_funcs.go
@@ -3,7 +3,6 @@ package docker
 import (
 	"fmt"
 	"strings"
-	"regexp"
 
 	dc "github.com/fsouza/go-dockerclient"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -76,28 +75,36 @@ func pullImage(data *Data, client *dc.Client, image string) error {
 
 	pullOpts := dc.PullImageOptions{}
 
-	// 
-	// Breaks apart an image string into host:port, repo, and tag components
-	regex := "^(?:(?P<host>(?:[\\w-]+(?:\\.[\\w-]+)+)(?::[\\d]+)?)/)?(?P<repo>[\\w.-]+(?:/[\\w.-]*)*)*(?::(?P<tag>[\\w.-]*))?"
-	r, _ := regexp.Compile(regex)
+	splitImageName := strings.Split(image, ":")
+	switch len(splitImageName) {
 
-	// Result is in form [[image, host, repo, tag]], so we get the head of the 
-	// outer list to pass the inner list to result
-	result := r.FindAllStringSubmatch(image, -1)[0]
+	// It's in registry:port/username/repo:tag or registry:port/repo:tag format
+	case 3:
+		splitPortRepo := strings.Split(splitImageName[1], "/")
+		pullOpts.Registry = splitImageName[0] + ":" + splitPortRepo[0]
+		pullOpts.Tag = splitImageName[2]
+		pullOpts.Repository = strings.Join(splitPortRepo[1:], "/")
 
-	// If the host is not an empty string, then the image is using a private registry
-	if (result[1] != "") {
-		pullOpts.Registry = result[1]
-		// The repository for a private registry should take the form of host/repo rather than just repo
-		pullOpts.Repository = result[1] + "/" + result[2]
-	} else if (result[2] != "") {
-		// Local registries, or the main docker registry will have an image named as just 'repo'
-		pullOpts.Repository = result[2]
-	}
+	// It's either registry:port/username/repo, registry:port/repo,
+	// or repo:tag with default registry
+	case 2:
+		splitPortRepo := strings.Split(splitImageName[1], "/")
+		switch len(splitPortRepo) {
+		// repo:tag
+		case 1:
+			pullOpts.Repository = splitImageName[0]
+			pullOpts.Tag = splitImageName[1]
 
-	// If there was a tag specified, then set it
-	if (result[3] != "") {
-		pullOpts.Tag = result[3]
+		// registry:port/username/repo or registry:port/repo
+		default:
+			pullOpts.Registry = splitImageName[0] + ":" + splitPortRepo[0]
+			pullOpts.Repository = strings.Join(splitPortRepo[1:], "/")
+			pullOpts.Tag = "latest"
+		}
+
+	// Plain username/repo or repo
+	default:
+		pullOpts.Repository = image
 	}
 
 	if err := client.PullImage(pullOpts, dc.AuthConfiguration{}); err != nil {
diff --git a/builtin/providers/google/config.go b/builtin/providers/google/config.go
index de97df603..dda16a032 100644
--- a/builtin/providers/google/config.go
+++ b/builtin/providers/google/config.go
@@ -13,8 +13,10 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 	"golang.org/x/oauth2/jwt"
+	computeBeta "google.golang.org/api/compute/v0.beta"
 	"google.golang.org/api/compute/v1"
 	"google.golang.org/api/dns/v1"
+	"google.golang.org/api/storage/v1"
 )
 
 // Config is the configuration structure used to instantiate the Google
@@ -24,8 +26,10 @@ type Config struct {
 	Project     string
 	Region      string
 
-	clientCompute *compute.Service
-	clientDns *dns.Service
+	clientCompute     *compute.Service
+	clientComputeBeta *computeBeta.Service
+	clientDns         *dns.Service
+	clientStorage     *storage.Service
 }
 
 func (c *Config) loadAndValidate() error {
@@ -55,6 +59,7 @@ func (c *Config) loadAndValidate() error {
 		clientScopes := []string{
 			"https://www.googleapis.com/auth/compute",
 			"https://www.googleapis.com/auth/ndev.clouddns.readwrite",
+			"https://www.googleapis.com/auth/devstorage.full_control",
 		}
 
 		// Get the token for use in our requests
@@ -107,6 +112,13 @@ func (c *Config) loadAndValidate() error {
 	}
 	c.clientCompute.UserAgent = userAgent
 
+	log.Printf("[INFO] Instantiating Beta GCE client...")
+	c.clientComputeBeta, err = computeBeta.New(client)
+	if err != nil {
+		return err
+	}
+	c.clientComputeBeta.UserAgent = userAgent
+
 	log.Printf("[INFO] Instantiating Google Cloud DNS client...")
 	c.clientDns, err = dns.New(client)
 	if err != nil {
@@ -114,6 +126,13 @@ func (c *Config) loadAndValidate() error {
 	}
 	c.clientDns.UserAgent = userAgent
 
+	log.Printf("[INFO] Instantiating Google Storage Client...")
+	c.clientStorage, err = storage.New(client)
+	if err != nil {
+		return err
+	}
+	c.clientStorage.UserAgent = userAgent
+
 	return nil
 }
 
diff --git a/builtin/providers/google/dns_change.go b/builtin/providers/google/dns_change.go
index d8cb73cdf..a1facdd99 100644
--- a/builtin/providers/google/dns_change.go
+++ b/builtin/providers/google/dns_change.go
@@ -7,9 +7,9 @@ import (
 )
 
 type DnsChangeWaiter struct {
-	Service *dns.Service
-	Change *dns.Change
-	Project string
+	Service     *dns.Service
+	Change      *dns.Change
+	Project     string
 	ManagedZone string
 }
 
diff --git a/builtin/providers/google/provider.go b/builtin/providers/google/provider.go
index 09687a770..1554d9154 100644
--- a/builtin/providers/google/provider.go
+++ b/builtin/providers/google/provider.go
@@ -41,6 +41,7 @@ func Provider() terraform.ResourceProvider {
 			"google_compute_target_pool":       resourceComputeTargetPool(),
 			"google_dns_managed_zone":          resourceDnsManagedZone(),
 			"google_dns_record_set":            resourceDnsRecordSet(),
+			"google_storage_bucket":            resourceStorageBucket(),
 		},
 
 		ConfigureFunc: providerConfigure,
diff --git a/builtin/providers/google/resource_compute_instance.go b/builtin/providers/google/resource_compute_instance.go
index 956f27457..380aac8da 100644
--- a/builtin/providers/google/resource_compute_instance.go
+++ b/builtin/providers/google/resource_compute_instance.go
@@ -101,7 +101,7 @@ func resourceComputeInstance() *schema.Resource {
 						},
 
 						"device_name": &schema.Schema{
-							Type: schema.TypeString,
+							Type:     schema.TypeString,
 							Optional: true,
 						},
 					},
@@ -148,9 +148,9 @@ func resourceComputeInstance() *schema.Resource {
 			},
 
 			"network": &schema.Schema{
-				Type:     schema.TypeList,
-				Optional: true,
-				ForceNew: true,
+				Type:       schema.TypeList,
+				Optional:   true,
+				ForceNew:   true,
 				Deprecated: "Please use network_interface",
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
@@ -229,7 +229,7 @@ func resourceComputeInstance() *schema.Resource {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set: stringHashcode,
+				Set:      stringHashcode,
 			},
 
 			"metadata_fingerprint": &schema.Schema{
@@ -327,7 +327,7 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 			disk.Source = diskData.SelfLink
 		} else {
 			// Create a new disk
-			disk.InitializeParams = &compute.AttachedDiskInitializeParams{ }
+			disk.InitializeParams = &compute.AttachedDiskInitializeParams{}
 		}
 
 		if v, ok := d.GetOk(prefix + ".scratch"); ok {
@@ -367,7 +367,7 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 			disk.InitializeParams.DiskSizeGb = int64(diskSizeGb)
 		}
 
-		if v, ok := d.GetOk(prefix  + ".device_name"); ok {
+		if v, ok := d.GetOk(prefix + ".device_name"); ok {
 			disk.DeviceName = v.(string)
 		}
 
diff --git a/builtin/providers/google/resource_compute_instance_migrate.go b/builtin/providers/google/resource_compute_instance_migrate.go
index 749839ad1..05dc6b572 100644
--- a/builtin/providers/google/resource_compute_instance_migrate.go
+++ b/builtin/providers/google/resource_compute_instance_migrate.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-    "github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -127,7 +127,6 @@ func migrateStateV1toV2(is *terraform.InstanceState) (*terraform.InstanceState,
 		delete(is.Attributes, k)
 	}
 
-
 	for service_acct_index, newScopes := range newScopesMap {
 		for _, newScope := range newScopes {
 			hash := hashcode.String(canonicalizeServiceScope(newScope))
diff --git a/builtin/providers/google/resource_compute_instance_migrate_test.go b/builtin/providers/google/resource_compute_instance_migrate_test.go
index 9272761ce..7f9857e48 100644
--- a/builtin/providers/google/resource_compute_instance_migrate_test.go
+++ b/builtin/providers/google/resource_compute_instance_migrate_test.go
@@ -30,8 +30,8 @@ func TestComputeInstanceMigrateState(t *testing.T) {
 		"change scope from list to set": {
 			StateVersion: 1,
 			Attributes: map[string]string{
-				"service_account.#": "1",
-				"service_account.0.email": "xxxxxx-compute@developer.gserviceaccount.com",
+				"service_account.#":          "1",
+				"service_account.0.email":    "xxxxxx-compute@developer.gserviceaccount.com",
 				"service_account.0.scopes.#": "4",
 				"service_account.0.scopes.0": "https://www.googleapis.com/auth/compute",
 				"service_account.0.scopes.1": "https://www.googleapis.com/auth/datastore",
@@ -39,12 +39,12 @@ func TestComputeInstanceMigrateState(t *testing.T) {
 				"service_account.0.scopes.3": "https://www.googleapis.com/auth/logging.write",
 			},
 			Expected: map[string]string{
-				"service_account.#": "1",
-				"service_account.0.email": "xxxxxx-compute@developer.gserviceaccount.com",
-				"service_account.0.scopes.#": "4",
+				"service_account.#":                   "1",
+				"service_account.0.email":             "xxxxxx-compute@developer.gserviceaccount.com",
+				"service_account.0.scopes.#":          "4",
 				"service_account.0.scopes.1693978638": "https://www.googleapis.com/auth/devstorage.full_control",
-				"service_account.0.scopes.172152165": "https://www.googleapis.com/auth/logging.write",
-				"service_account.0.scopes.299962681": "https://www.googleapis.com/auth/compute",
+				"service_account.0.scopes.172152165":  "https://www.googleapis.com/auth/logging.write",
+				"service_account.0.scopes.299962681":  "https://www.googleapis.com/auth/compute",
 				"service_account.0.scopes.3435931483": "https://www.googleapis.com/auth/datastore",
 			},
 		},
diff --git a/builtin/providers/google/resource_dns_managed_zone.go b/builtin/providers/google/resource_dns_managed_zone.go
index 0e10d3b0b..7253297e6 100644
--- a/builtin/providers/google/resource_dns_managed_zone.go
+++ b/builtin/providers/google/resource_dns_managed_zone.go
@@ -50,18 +50,18 @@ func resourceDnsManagedZone() *schema.Resource {
 func resourceDnsManagedZoneCreate(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*Config)
 
-    // Build the parameter
-    zone := &dns.ManagedZone{
-        Name: d.Get("name").(string),
+	// Build the parameter
+	zone := &dns.ManagedZone{
+		Name:    d.Get("name").(string),
 		DnsName: d.Get("dns_name").(string),
-    }
-    // Optional things
-    if v, ok := d.GetOk("description"); ok {
-        zone.Description = v.(string)
-    }
-    if v, ok := d.GetOk("dns_name"); ok {
-        zone.DnsName = v.(string)
-    }
+	}
+	// Optional things
+	if v, ok := d.GetOk("description"); ok {
+		zone.Description = v.(string)
+	}
+	if v, ok := d.GetOk("dns_name"); ok {
+		zone.DnsName = v.(string)
+	}
 
 	log.Printf("[DEBUG] DNS ManagedZone create request: %#v", zone)
 	zone, err := config.clientDns.ManagedZones.Create(config.Project, zone).Do()
@@ -90,7 +90,7 @@ func resourceDnsManagedZoneRead(d *schema.ResourceData, meta interface{}) error
 		return fmt.Errorf("Error reading DNS ManagedZone: %#v", err)
 	}
 
-    d.Set("name_servers", zone.NameServers)
+	d.Set("name_servers", zone.NameServers)
 
 	return nil
 }
diff --git a/builtin/providers/google/resource_dns_record_set.go b/builtin/providers/google/resource_dns_record_set.go
index 795d49985..05fa547f7 100644
--- a/builtin/providers/google/resource_dns_record_set.go
+++ b/builtin/providers/google/resource_dns_record_set.go
@@ -61,17 +61,17 @@ func resourceDnsRecordSetCreate(d *schema.ResourceData, meta interface{}) error
 
 	// Build the change
 	chg := &dns.Change{
-		Additions: []*dns.ResourceRecordSet {
-			&dns.ResourceRecordSet {
-				Name: d.Get("name").(string),
-				Type: d.Get("type").(string),
-				Ttl: int64(d.Get("ttl").(int)),
+		Additions: []*dns.ResourceRecordSet{
+			&dns.ResourceRecordSet{
+				Name:    d.Get("name").(string),
+				Type:    d.Get("type").(string),
+				Ttl:     int64(d.Get("ttl").(int)),
 				Rrdatas: make([]string, rrdatasCount),
 			},
 		},
 	}
 
-	for i := 0; i < rrdatasCount ; i++ {
+	for i := 0; i < rrdatasCount; i++ {
 		rrdata := fmt.Sprintf("rrdatas.%d", i)
 		chg.Additions[0].Rrdatas[i] = d.Get(rrdata).(string)
 	}
@@ -85,9 +85,9 @@ func resourceDnsRecordSetCreate(d *schema.ResourceData, meta interface{}) error
 	d.SetId(chg.Id)
 
 	w := &DnsChangeWaiter{
-		Service: config.clientDns,
-		Change: chg,
-		Project: config.Project,
+		Service:     config.clientDns,
+		Change:      chg,
+		Project:     config.Project,
 		ManagedZone: zone,
 	}
 	state := w.Conf()
@@ -126,7 +126,6 @@ func resourceDnsRecordSetRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("Only expected 1 record set, got %d", len(resp.Rrsets))
 	}
 
-
 	d.Set("ttl", resp.Rrsets[0].Ttl)
 	d.Set("rrdatas", resp.Rrsets[0].Rrdatas)
 
@@ -142,17 +141,17 @@ func resourceDnsRecordSetDelete(d *schema.ResourceData, meta interface{}) error
 
 	// Build the change
 	chg := &dns.Change{
-		Deletions: []*dns.ResourceRecordSet {
-			&dns.ResourceRecordSet {
-				Name: d.Get("name").(string),
-				Type: d.Get("type").(string),
-				Ttl: int64(d.Get("ttl").(int)),
+		Deletions: []*dns.ResourceRecordSet{
+			&dns.ResourceRecordSet{
+				Name:    d.Get("name").(string),
+				Type:    d.Get("type").(string),
+				Ttl:     int64(d.Get("ttl").(int)),
 				Rrdatas: make([]string, rrdatasCount),
 			},
 		},
 	}
 
-	for i := 0; i < rrdatasCount ; i++ {
+	for i := 0; i < rrdatasCount; i++ {
 		rrdata := fmt.Sprintf("rrdatas.%d", i)
 		chg.Deletions[0].Rrdatas[i] = d.Get(rrdata).(string)
 	}
@@ -163,9 +162,9 @@ func resourceDnsRecordSetDelete(d *schema.ResourceData, meta interface{}) error
 	}
 
 	w := &DnsChangeWaiter{
-		Service: config.clientDns,
-		Change: chg,
-		Project: config.Project,
+		Service:     config.clientDns,
+		Change:      chg,
+		Project:     config.Project,
 		ManagedZone: zone,
 	}
 	state := w.Conf()
diff --git a/builtin/providers/google/resource_storage_bucket.go b/builtin/providers/google/resource_storage_bucket.go
new file mode 100644
index 000000000..59370720e
--- /dev/null
+++ b/builtin/providers/google/resource_storage_bucket.go
@@ -0,0 +1,144 @@
+package google
+
+import (
+	"errors"
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+
+	"google.golang.org/api/storage/v1"
+)
+
+func resourceStorageBucket() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceStorageBucketCreate,
+		Read:   resourceStorageBucketRead,
+		Update: resourceStorageBucketUpdate,
+		Delete: resourceStorageBucketDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"predefined_acl": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "projectPrivate",
+				Optional: true,
+				ForceNew: true,
+			},
+			"location": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "US",
+				Optional: true,
+				ForceNew: true,
+			},
+			"force_destroy": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+		},
+	}
+}
+
+func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket and acl
+	bucket := d.Get("name").(string)
+	acl := d.Get("predefined_acl").(string)
+	location := d.Get("location").(string)
+
+	// Create a bucket, setting the acl, location and name.
+	sb := &storage.Bucket{Name: bucket, Location: location}
+	res, err := config.clientStorage.Buckets.Insert(config.Project, sb).PredefinedAcl(acl).Do()
+
+	if err != nil {
+		fmt.Printf("Error creating bucket %s: %v", bucket, err)
+		return err
+	}
+
+	log.Printf("[DEBUG] Created bucket %v at location %v\n\n", res.Name, res.SelfLink)
+
+	// Assign the bucket ID as the resource ID
+	d.SetId(res.Id)
+
+	return nil
+}
+
+func resourceStorageBucketUpdate(d *schema.ResourceData, meta interface{}) error {
+	// Only thing you can currently change is force_delete (all other properties have ForceNew)
+	// which is just terraform object state change, so nothing to do here
+	return nil
+}
+
+func resourceStorageBucketRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket and acl
+	bucket := d.Get("name").(string)
+	res, err := config.clientStorage.Buckets.Get(bucket).Do()
+
+	if err != nil {
+		fmt.Printf("Error reading bucket %s: %v", bucket, err)
+		return err
+	}
+
+	log.Printf("[DEBUG] Read bucket %v at location %v\n\n", res.Name, res.SelfLink)
+
+	// Update the bucket ID according to the resource ID
+	d.SetId(res.Id)
+
+	return nil
+}
+
+func resourceStorageBucketDelete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	// Get the bucket
+	bucket := d.Get("name").(string)
+
+	for {
+		res, err := config.clientStorage.Objects.List(bucket).Do()
+		if err != nil {
+			fmt.Printf("Error Objects.List failed: %v", err)
+			return err
+		}
+
+		if len(res.Items) != 0 {
+			if d.Get("force_destroy").(bool) {
+				// purge the bucket...
+				log.Printf("[DEBUG] GCS Bucket attempting to forceDestroy\n\n")
+
+				for _, object := range res.Items {
+					log.Printf("[DEBUG] Found %s", object.Name)
+					if err := config.clientStorage.Objects.Delete(bucket, object.Name).Do(); err != nil {
+						log.Fatalf("Error trying to delete object: %s %s\n\n", object.Name, err)
+					} else {
+						log.Printf("Object deleted: %s \n\n", object.Name)
+					}
+				}
+
+			} else {
+				delete_err := errors.New("Error trying to delete a bucket containing objects without `force_destroy` set to true")
+				log.Printf("Error! %s : %s\n\n", bucket, delete_err)
+				return delete_err
+			}
+		} else {
+			break // 0 items, bucket empty
+		}
+	}
+
+	// remove empty bucket
+	err := config.clientStorage.Buckets.Delete(bucket).Do()
+	if err != nil {
+		fmt.Printf("Error deleting bucket %s: %v\n\n", bucket, err)
+		return err
+	}
+	log.Printf("[DEBUG] Deleted bucket %v\n\n", bucket)
+
+	return nil
+}
diff --git a/builtin/providers/google/resource_storage_bucket_test.go b/builtin/providers/google/resource_storage_bucket_test.go
new file mode 100644
index 000000000..a7b59c61a
--- /dev/null
+++ b/builtin/providers/google/resource_storage_bucket_test.go
@@ -0,0 +1,231 @@
+package google
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"google.golang.org/api/googleapi"
+	storage "google.golang.org/api/storage/v1"
+)
+
+func TestAccStorage_basic(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderDefaults,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "projectPrivate"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "US"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "false"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageCustomAttributes(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "publicReadWrite"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "EU"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageBucketUpdate(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderDefaults,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "projectPrivate"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "US"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "false"),
+				),
+			},
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "predefined_acl", "publicReadWrite"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "location", "EU"),
+					resource.TestCheckResourceAttr(
+						"google_storage_bucket.bucket", "force_destroy", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccStorageForceDestroy(t *testing.T) {
+	var bucketName string
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccGoogleStorageDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketExists(
+						"google_storage_bucket.bucket", &bucketName),
+				),
+			},
+			resource.TestStep{
+				Config: testGoogleStorageBucketsReaderCustomAttributes,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketPutItem(&bucketName),
+				),
+			},
+			resource.TestStep{
+				Config: "",
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStorageBucketMissing(&bucketName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStorageBucketExists(n string, bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Project_ID is set")
+		}
+
+		config := testAccProvider.Meta().(*Config)
+
+		found, err := config.clientStorage.Buckets.Get(rs.Primary.ID).Do()
+		if err != nil {
+			return err
+		}
+
+		if found.Id != rs.Primary.ID {
+			return fmt.Errorf("Bucket not found")
+		}
+
+		*bucketName = found.Name
+		return nil
+	}
+}
+
+func testAccCheckCloudStorageBucketPutItem(bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := testAccProvider.Meta().(*Config)
+
+		data := bytes.NewBufferString("test")
+		dataReader := bytes.NewReader(data.Bytes())
+		object := &storage.Object{Name: "bucketDestroyTestFile"}
+
+		// This needs to use Media(io.Reader) call, otherwise it does not go to /upload API and fails
+		if res, err := config.clientStorage.Objects.Insert(*bucketName, object).Media(dataReader).Do(); err == nil {
+			fmt.Printf("Created object %v at location %v\n\n", res.Name, res.SelfLink)
+		} else {
+			return fmt.Errorf("Objects.Insert failed: %v", err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStorageBucketMissing(bucketName *string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := testAccProvider.Meta().(*Config)
+
+		_, err := config.clientStorage.Buckets.Get(*bucketName).Do()
+		if err == nil {
+			return fmt.Errorf("Found %s", *bucketName)
+		}
+
+		if gerr, ok := err.(*googleapi.Error); ok && gerr.Code == 404 {
+			return nil
+		} else {
+			return err
+		}
+	}
+}
+
+func testAccGoogleStorageDestroy(s *terraform.State) error {
+	config := testAccProvider.Meta().(*Config)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "google_storage_bucket" {
+			continue
+		}
+
+		_, err := config.clientStorage.Buckets.Get(rs.Primary.ID).Do()
+		if err == nil {
+			return fmt.Errorf("Bucket still exists")
+		}
+	}
+
+	return nil
+}
+
+var randInt = rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+
+var testGoogleStorageBucketsReaderDefaults = fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+	name = "tf-test-bucket-%d"
+}
+`, randInt)
+
+var testGoogleStorageBucketsReaderCustomAttributes = fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+	name = "tf-test-bucket-%d"
+	predefined_acl = "publicReadWrite"
+	location = "EU"
+	force_destroy = "true"
+}
+`, randInt)
diff --git a/builtin/providers/openstack/config.go b/builtin/providers/openstack/config.go
index 903345fb6..f18465538 100644
--- a/builtin/providers/openstack/config.go
+++ b/builtin/providers/openstack/config.go
@@ -2,6 +2,7 @@ package openstack
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
 
 	"github.com/rackspace/gophercloud"
@@ -19,11 +20,20 @@ type Config struct {
 	DomainID         string
 	DomainName       string
 	Insecure         bool
+	EndpointType     string
 
 	osClient *gophercloud.ProviderClient
 }
 
 func (c *Config) loadAndValidate() error {
+
+	if c.EndpointType != "internal" && c.EndpointType != "internalURL" &&
+		c.EndpointType != "admin" && c.EndpointType != "adminURL" &&
+		c.EndpointType != "public" && c.EndpointType != "publicURL" &&
+		c.EndpointType != "" {
+		return fmt.Errorf("Invalid endpoint type provided")
+	}
+
 	ao := gophercloud.AuthOptions{
 		Username:         c.Username,
 		UserID:           c.UserID,
@@ -60,24 +70,38 @@ func (c *Config) loadAndValidate() error {
 
 func (c *Config) blockStorageV1Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewBlockStorageV1(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) computeV2Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewComputeV2(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) networkingV2Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewNetworkV2(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
 
 func (c *Config) objectStorageV1Client(region string) (*gophercloud.ServiceClient, error) {
 	return openstack.NewObjectStorageV1(c.osClient, gophercloud.EndpointOpts{
-		Region: region,
+		Region:       region,
+		Availability: c.getEndpointType(),
 	})
 }
+
+func (c *Config) getEndpointType() gophercloud.Availability {
+	if c.EndpointType == "internal" || c.EndpointType == "internalURL" {
+		return gophercloud.AvailabilityInternal
+	}
+	if c.EndpointType == "admin" || c.EndpointType == "adminURL" {
+		return gophercloud.AvailabilityAdmin
+	}
+	return gophercloud.AvailabilityPublic
+}
diff --git a/builtin/providers/openstack/provider.go b/builtin/providers/openstack/provider.go
index 188beadd7..128e95c0a 100644
--- a/builtin/providers/openstack/provider.go
+++ b/builtin/providers/openstack/provider.go
@@ -42,9 +42,9 @@ func Provider() terraform.ResourceProvider {
 				DefaultFunc: envDefaultFunc("OS_PASSWORD"),
 			},
 			"api_key": &schema.Schema{
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  "",
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: envDefaultFunc("OS_AUTH_TOKEN"),
 			},
 			"domain_id": &schema.Schema{
 				Type:     schema.TypeString,
@@ -61,6 +61,11 @@ func Provider() terraform.ResourceProvider {
 				Optional: true,
 				Default:  false,
 			},
+			"endpoint_type": &schema.Schema{
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: envDefaultFunc("OS_ENDPOINT_TYPE"),
+			},
 		},
 
 		ResourcesMap: map[string]*schema.Resource{
@@ -68,6 +73,7 @@ func Provider() terraform.ResourceProvider {
 			"openstack_compute_instance_v2":            resourceComputeInstanceV2(),
 			"openstack_compute_keypair_v2":             resourceComputeKeypairV2(),
 			"openstack_compute_secgroup_v2":            resourceComputeSecGroupV2(),
+			"openstack_compute_servergroup_v2":         resourceComputeServerGroupV2(),
 			"openstack_compute_floatingip_v2":          resourceComputeFloatingIPV2(),
 			"openstack_fw_firewall_v1":                 resourceFWFirewallV1(),
 			"openstack_fw_policy_v1":                   resourceFWPolicyV1(),
@@ -99,6 +105,7 @@ func configureProvider(d *schema.ResourceData) (interface{}, error) {
 		DomainID:         d.Get("domain_id").(string),
 		DomainName:       d.Get("domain_name").(string),
 		Insecure:         d.Get("insecure").(bool),
+		EndpointType:     d.Get("endpoint_type").(string),
 	}
 
 	if err := config.loadAndValidate(); err != nil {
diff --git a/builtin/providers/openstack/resource_openstack_compute_instance_v2.go b/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
index 44fca923f..f08f94031 100644
--- a/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
+++ b/builtin/providers/openstack/resource_openstack_compute_instance_v2.go
@@ -15,6 +15,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/bootfromvolume"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/floatingip"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/keypairs"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/schedulerhints"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/secgroups"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/tenantnetworks"
 	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/volumeattach"
@@ -224,6 +225,48 @@ func resourceComputeInstanceV2() *schema.Resource {
 				},
 				Set: resourceComputeVolumeAttachmentHash,
 			},
+			"scheduler_hints": &schema.Schema{
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"group": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+						"different_host": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"same_host": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"query": &schema.Schema{
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"target_cell": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+						"build_near_host_ip": &schema.Schema{
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
+					},
+				},
+				Set: resourceComputeSchedulerHintsHash,
+			},
 		},
 	}
 }
@@ -289,6 +332,16 @@ func resourceComputeInstanceV2Create(d *schema.ResourceData, meta interface{}) e
 		}
 	}
 
+	schedulerHintsRaw := d.Get("scheduler_hints").(*schema.Set).List()
+	if len(schedulerHintsRaw) > 0 {
+		log.Printf("[DEBUG] schedulerhints: %+v", schedulerHintsRaw)
+		schedulerHints := resourceInstanceSchedulerHintsV2(d, schedulerHintsRaw[0].(map[string]interface{}))
+		createOpts = &schedulerhints.CreateOptsExt{
+			createOpts,
+			schedulerHints,
+		}
+	}
+
 	log.Printf("[DEBUG] Create Options: %#v", createOpts)
 	server, err := servers.Create(computeClient, createOpts).Extract()
 	if err != nil {
@@ -764,13 +817,19 @@ func resourceInstanceSecGroupsV2(d *schema.ResourceData) []string {
 
 func resourceInstanceNetworks(computeClient *gophercloud.ServiceClient, d *schema.ResourceData) ([]map[string]interface{}, error) {
 	rawNetworks := d.Get("network").([]interface{})
-	newNetworks := make([]map[string]interface{}, len(rawNetworks))
+	newNetworks := make([]map[string]interface{}, 0, len(rawNetworks))
 	var tenantnet tenantnetworks.Network
 
 	tenantNetworkExt := true
-	for i, raw := range rawNetworks {
-		rawMap := raw.(map[string]interface{})
+	for _, raw := range rawNetworks {
+		// Not sure what causes this, but it is a possibility (see GH-2323).
+		// Since we call this function to reconcile what we'll save in the
+		// state anyways, we just ignore it.
+		if raw == nil {
+			continue
+		}
 
+		rawMap := raw.(map[string]interface{})
 		allPages, err := tenantnetworks.List(computeClient).AllPages()
 		if err != nil {
 			errCode, ok := err.(*gophercloud.UnexpectedResponseCodeError)
@@ -809,16 +868,15 @@ func resourceInstanceNetworks(computeClient *gophercloud.ServiceClient, d *schem
 			networkName = rawMap["name"].(string)
 		}
 
-		newNetworks[i] = map[string]interface{}{
+		newNetworks = append(newNetworks, map[string]interface{}{
 			"uuid":        networkID,
 			"name":        networkName,
 			"port":        rawMap["port"].(string),
 			"fixed_ip_v4": rawMap["fixed_ip_v4"].(string),
-		}
+		})
 	}
 
 	log.Printf("[DEBUG] networks: %+v", newNetworks)
-
 	return newNetworks, nil
 }
 
@@ -872,6 +930,40 @@ func resourceInstanceBlockDeviceV2(d *schema.ResourceData, bd map[string]interfa
 	return bfvOpts
 }
 
+func resourceInstanceSchedulerHintsV2(d *schema.ResourceData, schedulerHintsRaw map[string]interface{}) schedulerhints.SchedulerHints {
+	differentHost := []string{}
+	if len(schedulerHintsRaw["different_host"].([]interface{})) > 0 {
+		for _, dh := range schedulerHintsRaw["different_host"].([]interface{}) {
+			differentHost = append(differentHost, dh.(string))
+		}
+	}
+
+	sameHost := []string{}
+	if len(schedulerHintsRaw["same_host"].([]interface{})) > 0 {
+		for _, sh := range schedulerHintsRaw["same_host"].([]interface{}) {
+			sameHost = append(sameHost, sh.(string))
+		}
+	}
+
+	query := make([]interface{}, len(schedulerHintsRaw["query"].([]interface{})))
+	if len(schedulerHintsRaw["query"].([]interface{})) > 0 {
+		for _, q := range schedulerHintsRaw["query"].([]interface{}) {
+			query = append(query, q.(string))
+		}
+	}
+
+	schedulerHints := schedulerhints.SchedulerHints{
+		Group:           schedulerHintsRaw["group"].(string),
+		DifferentHost:   differentHost,
+		SameHost:        sameHost,
+		Query:           query,
+		TargetCell:      schedulerHintsRaw["target_cell"].(string),
+		BuildNearHostIP: schedulerHintsRaw["build_near_host_ip"].(string),
+	}
+
+	return schedulerHints
+}
+
 func getImageID(client *gophercloud.ServiceClient, d *schema.ResourceData) (string, error) {
 	imageId := d.Get("image_id").(string)
 
@@ -957,6 +1049,29 @@ func resourceComputeVolumeAttachmentHash(v interface{}) int {
 	return hashcode.String(buf.String())
 }
 
+func resourceComputeSchedulerHintsHash(v interface{}) int {
+	var buf bytes.Buffer
+	m := v.(map[string]interface{})
+
+	if m["group"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["group"].(string)))
+	}
+
+	if m["target_cell"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["target_cell"].(string)))
+	}
+
+	if m["build_host_near_ip"] != nil {
+		buf.WriteString(fmt.Sprintf("%s-", m["build_host_near_ip"].(string)))
+	}
+
+	buf.WriteString(fmt.Sprintf("%s-", m["different_host"].([]interface{})))
+	buf.WriteString(fmt.Sprintf("%s-", m["same_host"].([]interface{})))
+	buf.WriteString(fmt.Sprintf("%s-", m["query"].([]interface{})))
+
+	return hashcode.String(buf.String())
+}
+
 func attachVolumesToInstance(computeClient *gophercloud.ServiceClient, blockClient *gophercloud.ServiceClient, serverId string, vols []interface{}) error {
 	if len(vols) > 0 {
 		for _, v := range vols {
diff --git a/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go
new file mode 100644
index 000000000..59fef25f7
--- /dev/null
+++ b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2.go
@@ -0,0 +1,123 @@
+package openstack
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/servergroups"
+)
+
+func resourceComputeServerGroupV2() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceComputeServerGroupV2Create,
+		Read:   resourceComputeServerGroupV2Read,
+		Update: nil,
+		Delete: resourceComputeServerGroupV2Delete,
+
+		Schema: map[string]*schema.Schema{
+			"region": &schema.Schema{
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				DefaultFunc: envDefaultFuncAllowMissing("OS_REGION_NAME"),
+			},
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"policies": &schema.Schema{
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"members": &schema.Schema{
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func resourceComputeServerGroupV2Create(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	createOpts := &servergroups.CreateOpts{
+		Name:     d.Get("name").(string),
+		Policies: resourceServerGroupPoliciesV2(d),
+	}
+	log.Printf("[DEBUG] Create Options: %#v", createOpts)
+	newSG, err := servergroups.Create(computeClient, createOpts).Extract()
+	if err != nil {
+		return fmt.Errorf("Error creating ServerGroup: %s", err)
+	}
+
+	d.SetId(newSG.ID)
+
+	return resourceComputeServerGroupV2Read(d, meta)
+}
+
+func resourceComputeServerGroupV2Read(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	sg, err := servergroups.Get(computeClient, d.Id()).Extract()
+	if err != nil {
+		return CheckDeleted(d, err, "server group")
+	}
+
+	log.Printf("[DEBUG] Retrieved ServerGroup %s: %+v", d.Id(), sg)
+
+	// Set the name
+	d.Set("name", sg.Name)
+
+	// Set the policies
+	policies := []string{}
+	for _, p := range sg.Policies {
+		policies = append(policies, p)
+	}
+	d.Set("policies", policies)
+
+	// Set the members
+	members := []string{}
+	for _, m := range sg.Members {
+		members = append(members, m)
+	}
+	d.Set("members", members)
+
+	return nil
+}
+
+func resourceComputeServerGroupV2Delete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+	computeClient, err := config.computeV2Client(d.Get("region").(string))
+	if err != nil {
+		return fmt.Errorf("Error creating OpenStack compute client: %s", err)
+	}
+
+	log.Printf("[DEBUG] Deleting ServerGroup %s", d.Id())
+	if err := servergroups.Delete(computeClient, d.Id()).ExtractErr(); err != nil {
+		return fmt.Errorf("Error deleting ServerGroup: %s", err)
+	}
+
+	return nil
+}
+
+func resourceServerGroupPoliciesV2(d *schema.ResourceData) []string {
+	rawPolicies := d.Get("policies").([]interface{})
+	policies := make([]string, len(rawPolicies))
+	for i, raw := range rawPolicies {
+		policies[i] = raw.(string)
+	}
+	return policies
+}
diff --git a/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go
new file mode 100644
index 000000000..3672820a4
--- /dev/null
+++ b/builtin/providers/openstack/resource_openstack_compute_servergroup_v2_test.go
@@ -0,0 +1,138 @@
+package openstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+
+	"github.com/rackspace/gophercloud/openstack/compute/v2/extensions/servergroups"
+	"github.com/rackspace/gophercloud/openstack/compute/v2/servers"
+)
+
+func TestAccComputeV2ServerGroup_basic(t *testing.T) {
+	var serverGroup servergroups.ServerGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeV2ServerGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccComputeV2ServerGroup_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeV2ServerGroupExists(t, "openstack_compute_servergroup_v2.mysg", &serverGroup),
+				),
+			},
+		},
+	})
+}
+
+func TestAccComputeV2ServerGroup_affinity(t *testing.T) {
+	var instance servers.Server
+	var sg servergroups.ServerGroup
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeV2ServerGroupDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccComputeV2ServerGroup_affinity,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeV2ServerGroupExists(t, "openstack_compute_servergroup_v2.mysg", &sg),
+					testAccCheckComputeV2InstanceExists(t, "openstack_compute_instance_v2.myinstance", &instance),
+					testAccCheckComputeV2InstanceInServerGroup(&instance, &sg),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckComputeV2ServerGroupDestroy(s *terraform.State) error {
+	config := testAccProvider.Meta().(*Config)
+	computeClient, err := config.computeV2Client(OS_REGION_NAME)
+	if err != nil {
+		return fmt.Errorf("(testAccCheckComputeV2ServerGroupDestroy) Error creating OpenStack compute client: %s", err)
+	}
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "openstack_compute_servergroup_v2" {
+			continue
+		}
+
+		_, err := servergroups.Get(computeClient, rs.Primary.ID).Extract()
+		if err == nil {
+			return fmt.Errorf("ServerGroup still exists")
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckComputeV2ServerGroupExists(t *testing.T, n string, kp *servergroups.ServerGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		config := testAccProvider.Meta().(*Config)
+		computeClient, err := config.computeV2Client(OS_REGION_NAME)
+		if err != nil {
+			return fmt.Errorf("(testAccCheckComputeV2ServerGroupExists) Error creating OpenStack compute client: %s", err)
+		}
+
+		found, err := servergroups.Get(computeClient, rs.Primary.ID).Extract()
+		if err != nil {
+			return err
+		}
+
+		if found.ID != rs.Primary.ID {
+			return fmt.Errorf("ServerGroup not found")
+		}
+
+		*kp = *found
+
+		return nil
+	}
+}
+
+func testAccCheckComputeV2InstanceInServerGroup(instance *servers.Server, sg *servergroups.ServerGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if len(sg.Members) > 0 {
+			for _, m := range sg.Members {
+				if m == instance.ID {
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Instance %s is not part of Server Group %s", instance.ID, sg.ID)
+	}
+}
+
+var testAccComputeV2ServerGroup_basic = `
+  resource "openstack_compute_servergroup_v2" "mysg" {
+		name = "mysg"
+		policies = ["affinity"]
+  }`
+
+var testAccComputeV2ServerGroup_affinity = `
+	resource "openstack_compute_servergroup_v2" "mysg" {
+		name = "mysg"
+		policies = ["affinity"]
+	}
+
+	resource "openstack_compute_instance_v2" "myinstance" {
+		name = "myinstance"
+		security_groups = ["default"]
+		scheduler_hints {
+			group = "${openstack_compute_servergroup_v2.mysg.id}"
+		}
+	}`
diff --git a/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go b/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
index 34112f778..43318db19 100644
--- a/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
+++ b/builtin/providers/openstack/resource_openstack_fw_firewall_v1_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/networking/v2/extensions/fwaas/firewalls"
 )
 
-func TestAccFWFirewallV1(t *testing.T) {
+func TestAccFWFirewallV1_basic(t *testing.T) {
 
 	var policyID *string
 
diff --git a/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go b/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
index ba96bb8b1..677e7cd01 100644
--- a/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
+++ b/builtin/providers/openstack/resource_openstack_fw_rule_v1_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/rackspace/gophercloud/openstack/networking/v2/extensions/fwaas/rules"
 )
 
-func TestAccFWRuleV1(t *testing.T) {
+func TestAccFWRuleV1_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
diff --git a/builtin/providers/openstack/resource_openstack_networking_router_v2.go b/builtin/providers/openstack/resource_openstack_networking_router_v2.go
index e30f220a6..9a370d7f3 100644
--- a/builtin/providers/openstack/resource_openstack_networking_router_v2.go
+++ b/builtin/providers/openstack/resource_openstack_networking_router_v2.go
@@ -3,7 +3,6 @@ package openstack
 import (
 	"fmt"
 	"log"
-	"strconv"
 
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/rackspace/gophercloud"
@@ -30,7 +29,7 @@ func resourceNetworkingRouterV2() *schema.Resource {
 				ForceNew: false,
 			},
 			"admin_state_up": &schema.Schema{
-				Type:     schema.TypeString,
+				Type:     schema.TypeBool,
 				Optional: true,
 				ForceNew: false,
 			},
@@ -61,12 +60,8 @@ func resourceNetworkingRouterV2Create(d *schema.ResourceData, meta interface{})
 		TenantID: d.Get("tenant_id").(string),
 	}
 
-	asuRaw := d.Get("admin_state_up").(string)
-	if asuRaw != "" {
-		asu, err := strconv.ParseBool(asuRaw)
-		if err != nil {
-			return fmt.Errorf("admin_state_up, if provided, must be either 'true' or 'false'")
-		}
+	if asuRaw, ok := d.GetOk("admin_state_up"); ok {
+		asu := asuRaw.(bool)
 		createOpts.AdminStateUp = &asu
 	}
 
@@ -114,7 +109,7 @@ func resourceNetworkingRouterV2Read(d *schema.ResourceData, meta interface{}) er
 	log.Printf("[DEBUG] Retreived Router %s: %+v", d.Id(), n)
 
 	d.Set("name", n.Name)
-	d.Set("admin_state_up", strconv.FormatBool(n.AdminStateUp))
+	d.Set("admin_state_up", n.AdminStateUp)
 	d.Set("tenant_id", n.TenantID)
 	d.Set("external_gateway", n.GatewayInfo.NetworkID)
 
@@ -133,14 +128,8 @@ func resourceNetworkingRouterV2Update(d *schema.ResourceData, meta interface{})
 		updateOpts.Name = d.Get("name").(string)
 	}
 	if d.HasChange("admin_state_up") {
-		asuRaw := d.Get("admin_state_up").(string)
-		if asuRaw != "" {
-			asu, err := strconv.ParseBool(asuRaw)
-			if err != nil {
-				return fmt.Errorf("admin_state_up, if provided, must be either 'true' or 'false'")
-			}
-			updateOpts.AdminStateUp = &asu
-		}
+		asu := d.Get("admin_state_up").(bool)
+		updateOpts.AdminStateUp = &asu
 	}
 
 	log.Printf("[DEBUG] Updating Router %s with options: %+v", d.Id(), updateOpts)
diff --git a/builtin/providers/template/resource.go b/builtin/providers/template/resource.go
index 8eb3ce9eb..9019dcfc9 100644
--- a/builtin/providers/template/resource.go
+++ b/builtin/providers/template/resource.go
@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io/ioutil"
+	"log"
 	"os"
 	"path/filepath"
 
@@ -75,7 +76,13 @@ func Delete(d *schema.ResourceData, meta interface{}) error {
 func Exists(d *schema.ResourceData, meta interface{}) (bool, error) {
 	rendered, err := render(d)
 	if err != nil {
-		return false, err
+		if _, ok := err.(templateRenderError); ok {
+			log.Printf("[DEBUG] Got error while rendering in Exists: %s", err)
+			log.Printf("[DEBUG] Returning false so the template re-renders using latest variables from config.")
+			return false, nil
+		} else {
+			return false, err
+		}
 	}
 	return hash(rendered) == d.Id(), nil
 }
@@ -87,6 +94,8 @@ func Read(d *schema.ResourceData, meta interface{}) error {
 	return nil
 }
 
+type templateRenderError error
+
 var readfile func(string) ([]byte, error) = ioutil.ReadFile // testing hook
 
 func render(d *schema.ResourceData) (string, error) {
@@ -105,7 +114,9 @@ func render(d *schema.ResourceData) (string, error) {
 
 	rendered, err := execute(string(buf), vars)
 	if err != nil {
-		return "", fmt.Errorf("failed to render %v: %v", filename, err)
+		return "", templateRenderError(
+			fmt.Errorf("failed to render %v: %v", filename, err),
+		)
 	}
 
 	return rendered, nil
diff --git a/builtin/providers/template/resource_test.go b/builtin/providers/template/resource_test.go
index 13b6cf052..7f461325a 100644
--- a/builtin/providers/template/resource_test.go
+++ b/builtin/providers/template/resource_test.go
@@ -34,15 +34,7 @@ func TestTemplateRendering(t *testing.T) {
 			Providers: testProviders,
 			Steps: []r.TestStep{
 				r.TestStep{
-					Config: `
-resource "template_file" "t0" {
-	filename = "mock"
-	vars = ` + tt.vars + `
-}
-output "rendered" {
-    value = "${template_file.t0.rendered}"
-}
-`,
+					Config: testTemplateConfig(tt.vars),
 					Check: func(s *terraform.State) error {
 						got := s.RootModule().Outputs["rendered"]
 						if tt.want != got {
@@ -55,3 +47,55 @@ output "rendered" {
 		})
 	}
 }
+
+// https://github.com/hashicorp/terraform/issues/2344
+func TestTemplateVariableChange(t *testing.T) {
+	steps := []struct {
+		vars     string
+		template string
+		want     string
+	}{
+		{`{a="foo"}`, `${a}`, `foo`},
+		{`{b="bar"}`, `${b}`, `bar`},
+	}
+
+	var testSteps []r.TestStep
+	for i, step := range steps {
+		testSteps = append(testSteps, r.TestStep{
+			PreConfig: func(template string) func() {
+				return func() {
+					readfile = func(string) ([]byte, error) {
+						return []byte(template), nil
+					}
+				}
+			}(step.template),
+			Config: testTemplateConfig(step.vars),
+			Check: func(i int, want string) r.TestCheckFunc {
+				return func(s *terraform.State) error {
+					got := s.RootModule().Outputs["rendered"]
+					if want != got {
+						return fmt.Errorf("[%d] got:\n%q\nwant:\n%q\n", i, got, want)
+					}
+					return nil
+				}
+			}(i, step.want),
+		})
+	}
+
+	r.Test(t, r.TestCase{
+		Providers: testProviders,
+		Steps:     testSteps,
+	})
+}
+
+func testTemplateConfig(vars string) string {
+	return `
+resource "template_file" "t0" {
+	filename = "mock"
+	vars = ` + vars + `
+}
+output "rendered" {
+    value = "${template_file.t0.rendered}"
+}
+	`
+}
diff --git a/builtin/provisioners/chef/ssh_provisioner.go b/builtin/provisioners/chef/linux_provisioner.go
similarity index 80%
rename from builtin/provisioners/chef/ssh_provisioner.go
rename to builtin/provisioners/chef/linux_provisioner.go
index c6d0fb011..e14288437 100644
--- a/builtin/provisioners/chef/ssh_provisioner.go
+++ b/builtin/provisioners/chef/linux_provisioner.go
@@ -2,6 +2,7 @@ package chef
 
 import (
 	"fmt"
+	"path"
 	"strings"
 
 	"github.com/hashicorp/terraform/communicator"
@@ -12,7 +13,7 @@ const (
 	installURL = "https://www.chef.io/chef/install.sh"
 )
 
-func (p *Provisioner) sshInstallChefClient(
+func (p *Provisioner) linuxInstallChefClient(
 	o terraform.UIOutput,
 	comm communicator.Communicator) error {
 
@@ -32,7 +33,7 @@ func (p *Provisioner) sshInstallChefClient(
 	}
 
 	// Then execute the install.sh scrip to download and install Chef Client
-	err = p.runCommand(o, comm, fmt.Sprintf("%sbash ./install.sh -v %s", prefix, p.Version))
+	err = p.runCommand(o, comm, fmt.Sprintf("%sbash ./install.sh -v %q", prefix, p.Version))
 	if err != nil {
 		return err
 	}
@@ -41,7 +42,7 @@ func (p *Provisioner) sshInstallChefClient(
 	return p.runCommand(o, comm, fmt.Sprintf("%srm -f install.sh", prefix))
 }
 
-func (p *Provisioner) sshCreateConfigFiles(
+func (p *Provisioner) linuxCreateConfigFiles(
 	o terraform.UIOutput,
 	comm communicator.Communicator) error {
 	// Make sure the config directory exists
@@ -60,6 +61,18 @@ func (p *Provisioner) sshCreateConfigFiles(
 		return err
 	}
 
+	if len(p.OhaiHints) > 0 {
+		// Make sure the hits directory exists
+		hintsDir := path.Join(linuxConfDir, "ohai/hints")
+		if err := p.runCommand(o, comm, "mkdir -p "+hintsDir); err != nil {
+			return err
+		}
+
+		if err := p.deployOhaiHints(o, comm, hintsDir); err != nil {
+			return err
+		}
+	}
+
 	// When done copying the files restore the rights and make sure root is owner
 	if p.useSudo {
 		if err := p.runCommand(o, comm, "chmod 755 "+linuxConfDir); err != nil {
diff --git a/builtin/provisioners/chef/ssh_provisioner_test.go b/builtin/provisioners/chef/linux_provisioner_test.go
similarity index 79%
rename from builtin/provisioners/chef/ssh_provisioner_test.go
rename to builtin/provisioners/chef/linux_provisioner_test.go
index 90e7b7d91..e41c5b8da 100644
--- a/builtin/provisioners/chef/ssh_provisioner_test.go
+++ b/builtin/provisioners/chef/linux_provisioner_test.go
@@ -1,13 +1,14 @@
 package chef
 
 import (
+	"path"
 	"testing"
 
 	"github.com/hashicorp/terraform/communicator"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestResourceProvider_sshInstallChefClient(t *testing.T) {
+func TestResourceProvider_linuxInstallChefClient(t *testing.T) {
 	cases := map[string]struct {
 		Config   *terraform.ResourceConfig
 		Commands map[string]bool
@@ -23,7 +24,7 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 
 			Commands: map[string]bool{
 				"sudo curl -LO https://www.chef.io/chef/install.sh": true,
-				"sudo bash ./install.sh -v ":                        true,
+				"sudo bash ./install.sh -v \"\"":                    true,
 				"sudo rm -f install.sh":                             true,
 			},
 		},
@@ -40,7 +41,7 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 
 			Commands: map[string]bool{
 				"curl -LO https://www.chef.io/chef/install.sh": true,
-				"bash ./install.sh -v ":                        true,
+				"bash ./install.sh -v \"\"":                    true,
 				"rm -f install.sh":                             true,
 			},
 		},
@@ -58,7 +59,7 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 
 			Commands: map[string]bool{
 				"proxy_http='http://proxy.local' curl -LO https://www.chef.io/chef/install.sh": true,
-				"proxy_http='http://proxy.local' bash ./install.sh -v ":                        true,
+				"proxy_http='http://proxy.local' bash ./install.sh -v \"\"":                    true,
 				"proxy_http='http://proxy.local' rm -f install.sh":                             true,
 			},
 		},
@@ -79,7 +80,7 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 				"proxy_http='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
 					"curl -LO https://www.chef.io/chef/install.sh": true,
 				"proxy_http='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
-					"bash ./install.sh -v ": true,
+					"bash ./install.sh -v \"\"": true,
 				"proxy_http='http://proxy.local' no_proxy='http://local.local,http://local.org' " +
 					"rm -f install.sh": true,
 			},
@@ -98,7 +99,7 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 
 			Commands: map[string]bool{
 				"curl -LO https://www.chef.io/chef/install.sh": true,
-				"bash ./install.sh -v 11.18.6":                 true,
+				"bash ./install.sh -v \"11.18.6\"":             true,
 				"rm -f install.sh":                             true,
 			},
 		},
@@ -118,14 +119,14 @@ func TestResourceProvider_sshInstallChefClient(t *testing.T) {
 
 		p.useSudo = !p.PreventSudo
 
-		err = p.sshInstallChefClient(o, c)
+		err = p.linuxInstallChefClient(o, c)
 		if err != nil {
 			t.Fatalf("Test %q failed: %v", k, err)
 		}
 	}
 }
 
-func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
+func TestResourceProvider_linuxCreateConfigFiles(t *testing.T) {
 	cases := map[string]struct {
 		Config   *terraform.ResourceConfig
 		Commands map[string]bool
@@ -133,6 +134,7 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 	}{
 		"Sudo": {
 			Config: testConfig(t, map[string]interface{}{
+				"ohai_hints":             []interface{}{"test-fixtures/ohaihint.json"},
 				"node_name":              "nodename1",
 				"run_list":               []interface{}{"cookbook::recipe"},
 				"server_url":             "https://chef.local",
@@ -141,16 +143,18 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 			}),
 
 			Commands: map[string]bool{
-				"sudo mkdir -p " + linuxConfDir:           true,
-				"sudo chmod 777 " + linuxConfDir:          true,
-				"sudo chmod 755 " + linuxConfDir:          true,
-				"sudo chown -R root.root " + linuxConfDir: true,
+				"sudo mkdir -p " + linuxConfDir:                          true,
+				"sudo chmod 777 " + linuxConfDir:                         true,
+				"sudo mkdir -p " + path.Join(linuxConfDir, "ohai/hints"): true,
+				"sudo chmod 755 " + linuxConfDir:                         true,
+				"sudo chown -R root.root " + linuxConfDir:                true,
 			},
 
 			Uploads: map[string]string{
-				"/etc/chef/validation.pem":  "VALIDATOR-PEM-FILE",
-				"/etc/chef/client.rb":       defaultSSHClientConf,
-				"/etc/chef/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/validation.pem":           "VALIDATOR-PEM-FILE",
+				linuxConfDir + "/ohai/hints/ohaihint.json": "OHAI-HINT-FILE",
+				linuxConfDir + "/client.rb":                defaultLinuxClientConf,
+				linuxConfDir + "/first-boot.json":          `{"run_list":["cookbook::recipe"]}`,
 			},
 		},
 
@@ -169,9 +173,9 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 			},
 
 			Uploads: map[string]string{
-				"/etc/chef/validation.pem":  "VALIDATOR-PEM-FILE",
-				"/etc/chef/client.rb":       defaultSSHClientConf,
-				"/etc/chef/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/validation.pem":  "VALIDATOR-PEM-FILE",
+				linuxConfDir + "/client.rb":       defaultLinuxClientConf,
+				linuxConfDir + "/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
 			},
 		},
 
@@ -193,9 +197,9 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 			},
 
 			Uploads: map[string]string{
-				"/etc/chef/validation.pem":  "VALIDATOR-PEM-FILE",
-				"/etc/chef/client.rb":       proxySSHClientConf,
-				"/etc/chef/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
+				linuxConfDir + "/validation.pem":  "VALIDATOR-PEM-FILE",
+				linuxConfDir + "/client.rb":       proxyLinuxClientConf,
+				linuxConfDir + "/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
 			},
 		},
 
@@ -235,9 +239,9 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 			},
 
 			Uploads: map[string]string{
-				"/etc/chef/validation.pem": "VALIDATOR-PEM-FILE",
-				"/etc/chef/client.rb":      defaultSSHClientConf,
-				"/etc/chef/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
+				linuxConfDir + "/validation.pem": "VALIDATOR-PEM-FILE",
+				linuxConfDir + "/client.rb":      defaultLinuxClientConf,
+				linuxConfDir + "/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
 					`"subkey2b":{"subkey3":"value3"}}},"key2":"value2","run_list":["cookbook::recipe"]}`,
 			},
 		},
@@ -258,19 +262,19 @@ func TestResourceProvider_sshCreateConfigFiles(t *testing.T) {
 
 		p.useSudo = !p.PreventSudo
 
-		err = p.sshCreateConfigFiles(o, c)
+		err = p.linuxCreateConfigFiles(o, c)
 		if err != nil {
 			t.Fatalf("Test %q failed: %v", k, err)
 		}
 	}
 }
 
-const defaultSSHClientConf = `log_location            STDOUT
+const defaultLinuxClientConf = `log_location            STDOUT
 chef_server_url         "https://chef.local"
 validation_client_name  "validator"
 node_name               "nodename1"`
 
-const proxySSHClientConf = `log_location            STDOUT
+const proxyLinuxClientConf = `log_location            STDOUT
 chef_server_url         "https://chef.local"
 validation_client_name  "validator"
 node_name               "nodename1"
diff --git a/builtin/provisioners/chef/resource_provisioner.go b/builtin/provisioners/chef/resource_provisioner.go
index e546588a5..3e3cb8abc 100644
--- a/builtin/provisioners/chef/resource_provisioner.go
+++ b/builtin/provisioners/chef/resource_provisioner.go
@@ -17,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform/communicator"
 	"github.com/hashicorp/terraform/communicator/remote"
 	"github.com/hashicorp/terraform/terraform"
+	"github.com/mitchellh/go-homedir"
 	"github.com/mitchellh/go-linereader"
 	"github.com/mitchellh/mapstructure"
 )
@@ -62,6 +63,8 @@ type Provisioner struct {
 	HTTPSProxy           string      `mapstructure:"https_proxy"`
 	NOProxy              []string    `mapstructure:"no_proxy"`
 	NodeName             string      `mapstructure:"node_name"`
+	OhaiHints            []string    `mapstructure:"ohai_hints"`
+	OSType               string      `mapstructure:"os_type"`
 	PreventSudo          bool        `mapstructure:"prevent_sudo"`
 	RunList              []string    `mapstructure:"run_list"`
 	ServerURL            string      `mapstructure:"server_url"`
@@ -91,20 +94,31 @@ func (r *ResourceProvisioner) Apply(
 		return err
 	}
 
+	if p.OSType == "" {
+		switch s.Ephemeral.ConnInfo["type"] {
+		case "ssh", "": // The default connection type is ssh, so if the type is empty assume ssh
+			p.OSType = "linux"
+		case "winrm":
+			p.OSType = "windows"
+		default:
+			return fmt.Errorf("Unsupported connection type: %s", s.Ephemeral.ConnInfo["type"])
+		}
+	}
+
 	// Set some values based on the targeted OS
-	switch s.Ephemeral.ConnInfo["type"] {
-	case "ssh", "": // The default connection type is ssh, so if the type is empty use ssh
-		p.installChefClient = p.sshInstallChefClient
-		p.createConfigFiles = p.sshCreateConfigFiles
+	switch p.OSType {
+	case "linux":
+		p.installChefClient = p.linuxInstallChefClient
+		p.createConfigFiles = p.linuxCreateConfigFiles
 		p.runChefClient = p.runChefClientFunc(linuxConfDir)
 		p.useSudo = !p.PreventSudo && s.Ephemeral.ConnInfo["user"] != "root"
-	case "winrm":
-		p.installChefClient = p.winrmInstallChefClient
-		p.createConfigFiles = p.winrmCreateConfigFiles
+	case "windows":
+		p.installChefClient = p.windowsInstallChefClient
+		p.createConfigFiles = p.windowsCreateConfigFiles
 		p.runChefClient = p.runChefClientFunc(windowsConfDir)
 		p.useSudo = false
 	default:
-		return fmt.Errorf("Unsupported connection type: %s", s.Ephemeral.ConnInfo["type"])
+		return fmt.Errorf("Unsupported os type: %s", p.OSType)
 	}
 
 	// Get a new communicator
@@ -182,15 +196,40 @@ func (r *ResourceProvisioner) decodeConfig(c *terraform.ResourceConfig) (*Provis
 		return nil, err
 	}
 
+	// We need to decode this twice. Once for the Raw config and once
+	// for the parsed Config. This makes sure that all values are there
+	// even if some still need to be interpolated later on.
+	// Without this the validation will fail when using a variable for
+	// a required parameter (the node_name for example).
 	if err := dec.Decode(c.Raw); err != nil {
 		return nil, err
 	}
 
+	if err := dec.Decode(c.Config); err != nil {
+		return nil, err
+	}
+
 	if p.Environment == "" {
 		p.Environment = defaultEnv
 	}
 
-	if attrs, ok := c.Raw["attributes"]; ok {
+	for i, hint := range p.OhaiHints {
+		hintPath, err := homedir.Expand(hint)
+		if err != nil {
+			return nil, fmt.Errorf("Error expanding the path %s: %v", hint, err)
+		}
+		p.OhaiHints[i] = hintPath
+	}
+
+	if p.ValidationKeyPath != "" {
+		keyPath, err := homedir.Expand(p.ValidationKeyPath)
+		if err != nil {
+			return nil, fmt.Errorf("Error expanding the validation key path: %v", err)
+		}
+		p.ValidationKeyPath = keyPath
+	}
+
+	if attrs, ok := c.Config["attributes"]; ok {
 		p.Attributes, err = rawToJSON(attrs)
 		if err != nil {
 			return nil, fmt.Errorf("Error parsing the attributes: %v", err)
@@ -356,6 +395,27 @@ func (p *Provisioner) deployConfigFiles(
 	return nil
 }
 
+func (p *Provisioner) deployOhaiHints(
+	o terraform.UIOutput,
+	comm communicator.Communicator,
+	hintDir string) error {
+	for _, hint := range p.OhaiHints {
+		// Open the hint file
+		f, err := os.Open(hint)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		// Copy the hint to the new instance
+		if err := comm.Upload(path.Join(hintDir, path.Base(hint)), f); err != nil {
+			return fmt.Errorf("Uploading %s failed: %v", path.Base(hint), err)
+		}
+	}
+
+	return nil
+}
+
 // runCommand is used to run already prepared commands
 func (p *Provisioner) runCommand(
 	o terraform.UIOutput,
diff --git a/builtin/provisioners/chef/resource_provisioner_test.go b/builtin/provisioners/chef/resource_provisioner_test.go
index 84a343513..45fc8a211 100644
--- a/builtin/provisioners/chef/resource_provisioner_test.go
+++ b/builtin/provisioners/chef/resource_provisioner_test.go
@@ -98,7 +98,7 @@ func TestResourceProvider_runChefClient(t *testing.T) {
 			Config: testConfig(t, map[string]interface{}{
 				"environment":            "production",
 				"node_name":              "nodename1",
-				"prevent_sudo":           true, // Needs to be set for ALL WinRM tests!
+				"prevent_sudo":           true,
 				"run_list":               []interface{}{"cookbook::recipe"},
 				"server_url":             "https://chef.local",
 				"validation_client_name": "validator",
diff --git a/builtin/provisioners/chef/test-fixtures/ohaihint.json b/builtin/provisioners/chef/test-fixtures/ohaihint.json
new file mode 100644
index 000000000..9aabc3287
--- /dev/null
+++ b/builtin/provisioners/chef/test-fixtures/ohaihint.json
@@ -0,0 +1 @@
+OHAI-HINT-FILE
diff --git a/builtin/provisioners/chef/winrm_provisioner.go b/builtin/provisioners/chef/windows_provisioner.go
similarity index 82%
rename from builtin/provisioners/chef/winrm_provisioner.go
rename to builtin/provisioners/chef/windows_provisioner.go
index 0b25c36d0..236bc6a9f 100644
--- a/builtin/provisioners/chef/winrm_provisioner.go
+++ b/builtin/provisioners/chef/windows_provisioner.go
@@ -46,7 +46,7 @@ Write-Host 'Installing Chef Client...'
 Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
 `
 
-func (p *Provisioner) winrmInstallChefClient(
+func (p *Provisioner) windowsInstallChefClient(
 	o terraform.UIOutput,
 	comm communicator.Communicator) error {
 	script := path.Join(path.Dir(comm.ScriptPath()), "ChefClient.ps1")
@@ -62,7 +62,7 @@ func (p *Provisioner) winrmInstallChefClient(
 	return p.runCommand(o, comm, installCmd)
 }
 
-func (p *Provisioner) winrmCreateConfigFiles(
+func (p *Provisioner) windowsCreateConfigFiles(
 	o terraform.UIOutput,
 	comm communicator.Communicator) error {
 	// Make sure the config directory exists
@@ -71,5 +71,18 @@ func (p *Provisioner) winrmCreateConfigFiles(
 		return err
 	}
 
+	if len(p.OhaiHints) > 0 {
+		// Make sure the hits directory exists
+		hintsDir := path.Join(windowsConfDir, "ohai/hints")
+		cmd := fmt.Sprintf("if not exist %q mkdir %q", hintsDir, hintsDir)
+		if err := p.runCommand(o, comm, cmd); err != nil {
+			return err
+		}
+
+		if err := p.deployOhaiHints(o, comm, hintsDir); err != nil {
+			return err
+		}
+	}
+
 	return p.deployConfigFiles(o, comm, windowsConfDir)
 }
diff --git a/builtin/provisioners/chef/winrm_provisioner_test.go b/builtin/provisioners/chef/windows_provisioner_test.go
similarity index 84%
rename from builtin/provisioners/chef/winrm_provisioner_test.go
rename to builtin/provisioners/chef/windows_provisioner_test.go
index 075e261bd..159e7be55 100644
--- a/builtin/provisioners/chef/winrm_provisioner_test.go
+++ b/builtin/provisioners/chef/windows_provisioner_test.go
@@ -2,13 +2,14 @@ package chef
 
 import (
 	"fmt"
+	"path"
 	"testing"
 
 	"github.com/hashicorp/terraform/communicator"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestResourceProvider_winrmInstallChefClient(t *testing.T) {
+func TestResourceProvider_windowsInstallChefClient(t *testing.T) {
 	cases := map[string]struct {
 		Config        *terraform.ResourceConfig
 		Commands      map[string]bool
@@ -28,7 +29,7 @@ func TestResourceProvider_winrmInstallChefClient(t *testing.T) {
 			},
 
 			UploadScripts: map[string]string{
-				"ChefClient.ps1": defaultWinRMInstallScript,
+				"ChefClient.ps1": defaultWindowsInstallScript,
 			},
 		},
 
@@ -48,7 +49,7 @@ func TestResourceProvider_winrmInstallChefClient(t *testing.T) {
 			},
 
 			UploadScripts: map[string]string{
-				"ChefClient.ps1": proxyWinRMInstallScript,
+				"ChefClient.ps1": proxyWindowsInstallScript,
 			},
 		},
 
@@ -67,7 +68,7 @@ func TestResourceProvider_winrmInstallChefClient(t *testing.T) {
 			},
 
 			UploadScripts: map[string]string{
-				"ChefClient.ps1": versionWinRMInstallScript,
+				"ChefClient.ps1": versionWindowsInstallScript,
 			},
 		},
 	}
@@ -87,14 +88,14 @@ func TestResourceProvider_winrmInstallChefClient(t *testing.T) {
 
 		p.useSudo = false
 
-		err = p.winrmInstallChefClient(o, c)
+		err = p.windowsInstallChefClient(o, c)
 		if err != nil {
 			t.Fatalf("Test %q failed: %v", k, err)
 		}
 	}
 }
 
-func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
+func TestResourceProvider_windowsCreateConfigFiles(t *testing.T) {
 	cases := map[string]struct {
 		Config   *terraform.ResourceConfig
 		Commands map[string]bool
@@ -102,6 +103,7 @@ func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
 	}{
 		"Default": {
 			Config: testConfig(t, map[string]interface{}{
+				"ohai_hints":             []interface{}{"test-fixtures/ohaihint.json"},
 				"node_name":              "nodename1",
 				"run_list":               []interface{}{"cookbook::recipe"},
 				"server_url":             "https://chef.local",
@@ -111,12 +113,16 @@ func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
 
 			Commands: map[string]bool{
 				fmt.Sprintf("if not exist %q mkdir %q", windowsConfDir, windowsConfDir): true,
+				fmt.Sprintf("if not exist %q mkdir %q",
+					path.Join(windowsConfDir, "ohai/hints"),
+					path.Join(windowsConfDir, "ohai/hints")): true,
 			},
 
 			Uploads: map[string]string{
-				"C:/chef/validation.pem":  "VALIDATOR-PEM-FILE",
-				"C:/chef/client.rb":       defaultWinRMClientConf,
-				"C:/chef/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
+				windowsConfDir + "/validation.pem":           "VALIDATOR-PEM-FILE",
+				windowsConfDir + "/ohai/hints/ohaihint.json": "OHAI-HINT-FILE",
+				windowsConfDir + "/client.rb":                defaultWindowsClientConf,
+				windowsConfDir + "/first-boot.json":          `{"run_list":["cookbook::recipe"]}`,
 			},
 		},
 
@@ -137,9 +143,9 @@ func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
 			},
 
 			Uploads: map[string]string{
-				"C:/chef/validation.pem":  "VALIDATOR-PEM-FILE",
-				"C:/chef/client.rb":       proxyWinRMClientConf,
-				"C:/chef/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
+				windowsConfDir + "/validation.pem":  "VALIDATOR-PEM-FILE",
+				windowsConfDir + "/client.rb":       proxyWindowsClientConf,
+				windowsConfDir + "/first-boot.json": `{"run_list":["cookbook::recipe"]}`,
 			},
 		},
 
@@ -178,9 +184,9 @@ func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
 			},
 
 			Uploads: map[string]string{
-				"C:/chef/validation.pem": "VALIDATOR-PEM-FILE",
-				"C:/chef/client.rb":      defaultWinRMClientConf,
-				"C:/chef/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
+				windowsConfDir + "/validation.pem": "VALIDATOR-PEM-FILE",
+				windowsConfDir + "/client.rb":      defaultWindowsClientConf,
+				windowsConfDir + "/first-boot.json": `{"key1":{"subkey1":{"subkey2a":["val1","val2","val3"],` +
 					`"subkey2b":{"subkey3":"value3"}}},"key2":"value2","run_list":["cookbook::recipe"]}`,
 			},
 		},
@@ -201,14 +207,14 @@ func TestResourceProvider_winrmCreateConfigFiles(t *testing.T) {
 
 		p.useSudo = false
 
-		err = p.winrmCreateConfigFiles(o, c)
+		err = p.windowsCreateConfigFiles(o, c)
 		if err != nil {
 			t.Fatalf("Test %q failed: %v", k, err)
 		}
 	}
 }
 
-const defaultWinRMInstallScript = `
+const defaultWindowsInstallScript = `
 $winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
 
 switch ($winver)
@@ -245,7 +251,7 @@ Write-Host 'Installing Chef Client...'
 Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
 `
 
-const proxyWinRMInstallScript = `
+const proxyWindowsInstallScript = `
 $winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
 
 switch ($winver)
@@ -282,7 +288,7 @@ Write-Host 'Installing Chef Client...'
 Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
 `
 
-const versionWinRMInstallScript = `
+const versionWindowsInstallScript = `
 $winver = [System.Environment]::OSVersion.Version | % {"{0}.{1}" -f $_.Major,$_.Minor}
 
 switch ($winver)
@@ -319,12 +325,12 @@ Write-Host 'Installing Chef Client...'
 Start-Process -FilePath msiexec -ArgumentList /qn, /i, $dest -Wait
 `
 
-const defaultWinRMClientConf = `log_location            STDOUT
+const defaultWindowsClientConf = `log_location            STDOUT
 chef_server_url         "https://chef.local"
 validation_client_name  "validator"
 node_name               "nodename1"`
 
-const proxyWinRMClientConf = `log_location            STDOUT
+const proxyWindowsClientConf = `log_location            STDOUT
 chef_server_url         "https://chef.local"
 validation_client_name  "validator"
 node_name               "nodename1"
diff --git a/builtin/provisioners/remote-exec/resource_provisioner.go b/builtin/provisioners/remote-exec/resource_provisioner.go
index f0905b4ef..39e5f9583 100644
--- a/builtin/provisioners/remote-exec/resource_provisioner.go
+++ b/builtin/provisioners/remote-exec/resource_provisioner.go
@@ -51,11 +51,7 @@ func (p *ResourceProvisioner) Validate(c *terraform.ResourceConfig) (ws []string
 	num := 0
 	for name := range c.Raw {
 		switch name {
-		case "scripts":
-			fallthrough
-		case "script":
-			fallthrough
-		case "inline":
+		case "scripts", "script", "inline":
 			num++
 		default:
 			es = append(es, fmt.Errorf("Unknown configuration '%s'", name))
diff --git a/command/apply.go b/command/apply.go
index 529d6e701..5c07e7140 100644
--- a/command/apply.go
+++ b/command/apply.go
@@ -7,6 +7,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform/config/module"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -207,7 +208,7 @@ func (c *ApplyCommand) Run(args []string) int {
 				"Instead, your Terraform state file has been partially updated with\n"+
 				"any resources that successfully completed. Please address the error\n"+
 				"above and apply again to incrementally change your infrastructure.",
-			applyErr))
+			multierror.Flatten(applyErr)))
 		return 1
 	}
 
@@ -229,38 +230,10 @@ func (c *ApplyCommand) Run(args []string) int {
 			c.Meta.StateOutPath())))
 	}
 
-	// If we have outputs, then output those at the end.
-	var outputs map[string]string
-	if !c.Destroy && state != nil {
-		outputs = state.RootModule().Outputs
-	}
-	if len(outputs) > 0 {
-		outputBuf := new(bytes.Buffer)
-		outputBuf.WriteString("[reset][bold][green]\nOutputs:\n\n")
-
-		// Output the outputs in alphabetical order
-		keyLen := 0
-		keys := make([]string, 0, len(outputs))
-		for key, _ := range outputs {
-			keys = append(keys, key)
-			if len(key) > keyLen {
-				keyLen = len(key)
-			}
+	if !c.Destroy {
+		if outputs := outputsAsString(state); outputs != "" {
+			c.Ui.Output(c.Colorize().Color(outputs))
 		}
-		sort.Strings(keys)
-
-		for _, k := range keys {
-			v := outputs[k]
-
-			outputBuf.WriteString(fmt.Sprintf(
-				"  %s%s = %s\n",
-				k,
-				strings.Repeat(" ", keyLen-len(k)),
-				v))
-		}
-
-		c.Ui.Output(c.Colorize().Color(
-			strings.TrimSpace(outputBuf.String())))
 	}
 
 	return 0
@@ -372,3 +345,38 @@ Options:
 `
 	return strings.TrimSpace(helpText)
 }
+
+func outputsAsString(state *terraform.State) string {
+	if state == nil {
+		return ""
+	}
+
+	outputs := state.RootModule().Outputs
+	outputBuf := new(bytes.Buffer)
+	if len(outputs) > 0 {
+		outputBuf.WriteString("[reset][bold][green]\nOutputs:\n\n")
+
+		// Output the outputs in alphabetical order
+		keyLen := 0
+		keys := make([]string, 0, len(outputs))
+		for key, _ := range outputs {
+			keys = append(keys, key)
+			if len(key) > keyLen {
+				keyLen = len(key)
+			}
+		}
+		sort.Strings(keys)
+
+		for _, k := range keys {
+			v := outputs[k]
+
+			outputBuf.WriteString(fmt.Sprintf(
+				"  %s%s = %s\n",
+				k,
+				strings.Repeat(" ", keyLen-len(k)),
+				v))
+		}
+	}
+
+	return strings.TrimSpace(outputBuf.String())
+}
diff --git a/command/counthookaction_string.go b/command/counthookaction_string.go
new file mode 100644
index 000000000..8b90dc50b
--- /dev/null
+++ b/command/counthookaction_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type=countHookAction hook_count_action.go; DO NOT EDIT
+
+package command
+
+import "fmt"
+
+const _countHookAction_name = "countHookActionAddcountHookActionChangecountHookActionRemove"
+
+var _countHookAction_index = [...]uint8{0, 18, 39, 60}
+
+func (i countHookAction) String() string {
+	if i >= countHookAction(len(_countHookAction_index)-1) {
+		return fmt.Sprintf("countHookAction(%d)", i)
+	}
+	return _countHookAction_name[_countHookAction_index[i]:_countHookAction_index[i+1]]
+}
diff --git a/command/flag_kv.go b/command/flag_kv.go
index 6e0198778..492cc66be 100644
--- a/command/flag_kv.go
+++ b/command/flag_kv.go
@@ -80,7 +80,11 @@ func loadKVFile(rawPath string) (map[string]string, error) {
 
 	var result map[string]string
 	if err := hcl.DecodeObject(&result, obj); err != nil {
-		return nil, err
+		return nil, fmt.Errorf(
+			"Error decoding Terraform vars file: %s\n\n"+
+				"The vars file should be in the format of `key = \"value\"`.\n"+
+				"Decoding errors are usually caused by an invalid format.",
+			err)
 	}
 
 	return result, nil
diff --git a/command/get.go b/command/get.go
index 1ca3b1305..91d13bbcd 100644
--- a/command/get.go
+++ b/command/get.go
@@ -77,6 +77,8 @@ Options:
   -update=false       If true, modules already downloaded will be checked
                       for updates and updated if necessary.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/graph.go b/command/graph.go
index 802c3c805..5719a8900 100644
--- a/command/graph.go
+++ b/command/graph.go
@@ -103,6 +103,9 @@ Options:
 
   -verbose             Generate a verbose, "worst-case" graph, with all nodes
                        for potential operations in place.
+
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/hook_count.go b/command/hook_count.go
index 21e1ea160..12fb229ab 100644
--- a/command/hook_count.go
+++ b/command/hook_count.go
@@ -13,20 +13,17 @@ type CountHook struct {
 	Changed int
 	Removed int
 
+	ToAdd          int
+	ToChange       int
+	ToRemove       int
+	ToRemoveAndAdd int
+
 	pending map[string]countHookAction
 
 	sync.Mutex
 	terraform.NilHook
 }
 
-type countHookAction byte
-
-const (
-	countHookActionAdd countHookAction = iota
-	countHookActionChange
-	countHookActionRemove
-)
-
 func (h *CountHook) Reset() {
 	h.Lock()
 	defer h.Unlock()
@@ -86,3 +83,23 @@ func (h *CountHook) PostApply(
 
 	return terraform.HookActionContinue, nil
 }
+
+func (h *CountHook) PostDiff(
+	n *terraform.InstanceInfo, d *terraform.InstanceDiff) (
+	terraform.HookAction, error) {
+	h.Lock()
+	defer h.Unlock()
+
+	switch d.ChangeType() {
+	case terraform.DiffDestroyCreate:
+		h.ToRemoveAndAdd += 1
+	case terraform.DiffCreate:
+		h.ToAdd += 1
+	case terraform.DiffDestroy:
+		h.ToRemove += 1
+	default:
+		h.ToChange += 1
+	}
+
+	return terraform.HookActionContinue, nil
+}
diff --git a/command/hook_count_action.go b/command/hook_count_action.go
new file mode 100644
index 000000000..344431dea
--- /dev/null
+++ b/command/hook_count_action.go
@@ -0,0 +1,11 @@
+package command
+
+//go:generate stringer -type=countHookAction hook_count_action.go
+
+type countHookAction byte
+
+const (
+	countHookActionAdd countHookAction = iota
+	countHookActionChange
+	countHookActionRemove
+)
diff --git a/command/init.go b/command/init.go
index 328c473d0..fb842d08d 100644
--- a/command/init.go
+++ b/command/init.go
@@ -149,6 +149,8 @@ Options:
   -backend-config="k=v"  Specifies configuration for the remote storage
                          backend. This can be specified multiple times.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/meta.go b/command/meta.go
index 7237a8d61..1a6ca47f4 100644
--- a/command/meta.go
+++ b/command/meta.go
@@ -190,7 +190,7 @@ func (m *Meta) InputMode() terraform.InputMode {
 
 	var mode terraform.InputMode
 	mode |= terraform.InputModeProvider
-	if len(m.variables) == 0 && m.autoKey == "" {
+	if len(m.variables) == 0 {
 		mode |= terraform.InputModeVar
 		mode |= terraform.InputModeVarUnset
 	}
@@ -351,6 +351,7 @@ func (m *Meta) process(args []string, vars bool) []string {
 	for i, v := range args {
 		if v == "-no-color" {
 			m.color = false
+			m.Color = false
 			args = append(args[:i], args[i+1:]...)
 			break
 		}
diff --git a/command/meta_test.go b/command/meta_test.go
index bb3b34107..23b817203 100644
--- a/command/meta_test.go
+++ b/command/meta_test.go
@@ -158,7 +158,7 @@ func TestMetaInputMode_defaultVars(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
-	if m.InputMode()&terraform.InputModeVar != 0 {
+	if m.InputMode()&terraform.InputModeVar == 0 {
 		t.Fatalf("bad: %#v", m.InputMode())
 	}
 }
diff --git a/command/output.go b/command/output.go
index 2e3c1bee0..63a6926f3 100644
--- a/command/output.go
+++ b/command/output.go
@@ -15,9 +15,12 @@ type OutputCommand struct {
 func (c *OutputCommand) Run(args []string) int {
 	args = c.Meta.process(args, false)
 
+	var module string
 	cmdFlags := flag.NewFlagSet("output", flag.ContinueOnError)
 	cmdFlags.StringVar(&c.Meta.statePath, "state", DefaultStateFilename, "path")
+	cmdFlags.StringVar(&module, "module", "", "module")
 	cmdFlags.Usage = func() { c.Ui.Error(c.Help()) }
+
 	if err := cmdFlags.Parse(args); err != nil {
 		return 1
 	}
@@ -38,15 +41,34 @@ func (c *OutputCommand) Run(args []string) int {
 		return 1
 	}
 
+	if module == "" {
+		module = "root"
+	} else {
+		module = "root." + module
+	}
+
+	// Get the proper module we want to get outputs for
+	modPath := strings.Split(module, ".")
+
 	state := stateStore.State()
-	if state.Empty() || len(state.RootModule().Outputs) == 0 {
+	mod := state.ModuleByPath(modPath)
+
+	if mod == nil {
+		c.Ui.Error(fmt.Sprintf(
+			"The module %s could not be found. There is nothing to output.",
+			module))
+		return 1
+	}
+
+	if state.Empty() || len(mod.Outputs) == 0 {
 		c.Ui.Error(fmt.Sprintf(
 			"The state file has no outputs defined. Define an output\n" +
 				"in your configuration with the `output` directive and re-run\n" +
 				"`terraform apply` for it to become available."))
 		return 1
 	}
-	v, ok := state.RootModule().Outputs[name]
+
+	v, ok := mod.Outputs[name]
 	if !ok {
 		c.Ui.Error(fmt.Sprintf(
 			"The output variable requested could not be found in the state\n" +
@@ -72,6 +94,8 @@ Options:
   -state=path      Path to the state file to read. Defaults to
                    "terraform.tfstate".
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/output_test.go b/command/output_test.go
index d3444c389..f84642269 100644
--- a/command/output_test.go
+++ b/command/output_test.go
@@ -47,6 +47,83 @@ func TestOutput(t *testing.T) {
 	}
 }
 
+func TestModuleOutput(t *testing.T) {
+	originalState := &terraform.State{
+		Modules: []*terraform.ModuleState{
+			&terraform.ModuleState{
+				Path: []string{"root"},
+				Outputs: map[string]string{
+					"foo": "bar",
+				},
+			},
+			&terraform.ModuleState{
+				Path: []string{"root", "my_module"},
+				Outputs: map[string]string{
+					"blah": "tastatur",
+				},
+			},
+		},
+	}
+
+	statePath := testStateFile(t, originalState)
+
+	ui := new(cli.MockUi)
+	c := &OutputCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		"-module", "my_module",
+		"blah",
+	}
+
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: \n%s", ui.ErrorWriter.String())
+	}
+
+	actual := strings.TrimSpace(ui.OutputWriter.String())
+	if actual != "tastatur" {
+		t.Fatalf("bad: %#v", actual)
+	}
+}
+
+func TestMissingModuleOutput(t *testing.T) {
+	originalState := &terraform.State{
+		Modules: []*terraform.ModuleState{
+			&terraform.ModuleState{
+				Path: []string{"root"},
+				Outputs: map[string]string{
+					"foo": "bar",
+				},
+			},
+		},
+	}
+
+	statePath := testStateFile(t, originalState)
+
+	ui := new(cli.MockUi)
+	c := &OutputCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		"-module", "not_existing_module",
+		"blah",
+	}
+
+	if code := c.Run(args); code != 1 {
+		t.Fatalf("bad: \n%s", ui.ErrorWriter.String())
+	}
+}
+
 func TestOutput_badVar(t *testing.T) {
 	originalState := &terraform.State{
 		Modules: []*terraform.ModuleState{
diff --git a/command/plan.go b/command/plan.go
index 083373c3a..f5a478873 100644
--- a/command/plan.go
+++ b/command/plan.go
@@ -53,6 +53,9 @@ func (c *PlanCommand) Run(args []string) int {
 		}
 	}
 
+	countHook := new(CountHook)
+	c.Meta.extraHooks = []terraform.Hook{countHook}
+
 	ctx, _, err := c.Context(contextOpts{
 		Destroy:   destroy,
 		Path:      path,
@@ -130,6 +133,13 @@ func (c *PlanCommand) Run(args []string) int {
 		ModuleDepth: moduleDepth,
 	}))
 
+	c.Ui.Output(c.Colorize().Color(fmt.Sprintf(
+		"[reset][bold]Plan:[reset] "+
+			"%d to add, %d to change, %d to destroy.",
+		countHook.ToAdd,
+		(countHook.ToChange + countHook.ToRemoveAndAdd),
+		countHook.ToRemove)))
+
 	if detailed {
 		return 2
 	}
@@ -189,7 +199,6 @@ Options:
   -var-file=foo       Set variables in the Terraform configuration from
                       a file. If "terraform.tfvars" is present, it will be
                       automatically loaded if this flag is not specified.
-
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/push.go b/command/push.go
index 80d72c4dc..7695adf21 100644
--- a/command/push.go
+++ b/command/push.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 
 	"github.com/hashicorp/atlas-go/archive"
@@ -24,6 +25,7 @@ func (c *PushCommand) Run(args []string) int {
 	var atlasAddress, atlasToken string
 	var archiveVCS, moduleUpload bool
 	var name string
+	var overwrite []string
 	args = c.Meta.process(args, true)
 	cmdFlags := c.Meta.flagSet("push")
 	cmdFlags.StringVar(&atlasAddress, "atlas-address", "", "")
@@ -32,11 +34,18 @@ func (c *PushCommand) Run(args []string) int {
 	cmdFlags.BoolVar(&moduleUpload, "upload-modules", true, "")
 	cmdFlags.StringVar(&name, "name", "", "")
 	cmdFlags.BoolVar(&archiveVCS, "vcs", true, "")
+	cmdFlags.Var((*FlagStringSlice)(&overwrite), "overwrite", "")
 	cmdFlags.Usage = func() { c.Ui.Error(c.Help()) }
 	if err := cmdFlags.Parse(args); err != nil {
 		return 1
 	}
 
+	// Make a map of the set values
+	overwriteMap := make(map[string]struct{}, len(overwrite))
+	for _, v := range overwrite {
+		overwriteMap[v] = struct{}{}
+	}
+
 	// The pwd is used for the configuration path if one is not given
 	pwd, err := os.Getwd()
 	if err != nil {
@@ -125,17 +134,17 @@ func (c *PushCommand) Run(args []string) int {
 	}
 
 	// Get the variables we might already have
-	vars, err := c.client.Get(name)
+	atlasVars, err := c.client.Get(name)
 	if err != nil {
 		c.Ui.Error(fmt.Sprintf(
 			"Error looking up previously pushed configuration: %s", err))
 		return 1
 	}
-	for k, v := range vars {
-		// Local variables override remote ones
-		if _, exists := ctx.Variables()[k]; exists {
+	for k, v := range atlasVars {
+		if _, ok := overwriteMap[k]; ok {
 			continue
 		}
+
 		ctx.SetVariable(k, v)
 	}
 
@@ -169,12 +178,41 @@ func (c *PushCommand) Run(args []string) int {
 		return 1
 	}
 
+	// Output to the user the variables that will be uploaded
+	var setVars []string
+	for k, _ := range ctx.Variables() {
+		if _, ok := overwriteMap[k]; !ok {
+			if _, ok := atlasVars[k]; ok {
+				// Atlas variable not within override, so it came from Atlas
+				continue
+			}
+		}
+
+		// This variable was set from the local value
+		setVars = append(setVars, k)
+	}
+	sort.Strings(setVars)
+	if len(setVars) > 0 {
+		c.Ui.Output(
+			"The following variables will be set or overwritten within Atlas from\n" +
+				"their local values. All other variables are already set within Atlas.\n" +
+				"If you want to modify the value of a variable, use the Atlas web\n" +
+				"interface or set it locally and use the -overwrite flag.\n\n")
+		for _, v := range setVars {
+			c.Ui.Output(fmt.Sprintf("  * %s", v))
+		}
+
+		// Newline
+		c.Ui.Output("")
+	}
+
 	// Upsert!
 	opts := &pushUpsertOptions{
 		Name:      name,
 		Archive:   archiveR,
 		Variables: ctx.Variables(),
 	}
+	c.Ui.Output("Uploading Terraform configuration...")
 	vsn, err := c.client.Upsert(opts)
 	if err != nil {
 		c.Ui.Error(fmt.Sprintf(
@@ -211,6 +249,10 @@ Options:
   -token=<token>       Access token to use to upload. If blank or unspecified,
                        the ATLAS_TOKEN environmental variable will be used.
 
+  -overwrite=foo       Variable keys that should overwrite values in Atlas.
+                       Otherwise, variables already set in Atlas will overwrite
+                       local values. This flag can be repeated.
+
   -var 'foo=bar'       Set a variable in the Terraform configuration. This
                        flag can be set multiple times.
 
@@ -221,6 +263,8 @@ Options:
   -vcs=true            If true (default), push will upload only files
                        comitted to your VCS, if detected.
 
+  -no-color           If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/push_test.go b/command/push_test.go
index ccb7bc222..a3d171a61 100644
--- a/command/push_test.go
+++ b/command/push_test.go
@@ -119,7 +119,7 @@ func TestPush_input(t *testing.T) {
 		"foo": "foo",
 	}
 	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
-		t.Fatalf("bad: %#v", client.UpsertOptions)
+		t.Fatalf("bad: %#v", client.UpsertOptions.Variables)
 	}
 }
 
@@ -179,7 +179,9 @@ func TestPush_inputPartial(t *testing.T) {
 	}
 }
 
-func TestPush_inputTfvars(t *testing.T) {
+// This tests that the push command will override Atlas variables
+// if requested.
+func TestPush_localOverride(t *testing.T) {
 	// Disable test mode so input would be asked and setup the
 	// input reader/writers.
 	test = false
@@ -219,6 +221,154 @@ func TestPush_inputTfvars(t *testing.T) {
 		client: client,
 	}
 
+	path := testFixturePath("push-tfvars")
+	args := []string{
+		"-var-file", path + "/terraform.tfvars",
+		"-vcs=false",
+		"-overwrite=foo",
+		path,
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	actual := testArchiveStr(t, archivePath)
+	expected := []string{
+		".terraform/",
+		".terraform/terraform.tfstate",
+		"main.tf",
+		"terraform.tfvars",
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	if client.UpsertOptions.Name != "foo" {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+
+	variables := map[string]string{
+		"foo": "bar",
+		"bar": "foo",
+	}
+	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+}
+
+// This tests that the push command prefers Atlas variables over
+// local ones.
+func TestPush_preferAtlas(t *testing.T) {
+	// Disable test mode so input would be asked and setup the
+	// input reader/writers.
+	test = false
+	defer func() { test = true }()
+	defaultInputReader = bytes.NewBufferString("nope\n")
+	defaultInputWriter = new(bytes.Buffer)
+
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Create remote state file, this should be pulled
+	conf, srv := testRemoteState(t, testState(), 200)
+	defer srv.Close()
+
+	// Persist local remote state
+	s := terraform.NewState()
+	s.Serial = 5
+	s.Remote = conf
+	testStateFileRemote(t, s)
+
+	// Path where the archive will be "uploaded" to
+	archivePath := testTempFile(t)
+	defer os.Remove(archivePath)
+
+	client := &mockPushClient{File: archivePath}
+	// Provided vars should override existing ones
+	client.GetResult = map[string]string{
+		"foo": "old",
+	}
+	ui := new(cli.MockUi)
+	c := &PushCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+
+		client: client,
+	}
+
+	path := testFixturePath("push-tfvars")
+	args := []string{
+		"-var-file", path + "/terraform.tfvars",
+		"-vcs=false",
+		path,
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	actual := testArchiveStr(t, archivePath)
+	expected := []string{
+		".terraform/",
+		".terraform/terraform.tfstate",
+		"main.tf",
+		"terraform.tfvars",
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("bad: %#v", actual)
+	}
+
+	if client.UpsertOptions.Name != "foo" {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+
+	variables := map[string]string{
+		"foo": "old",
+		"bar": "foo",
+	}
+	if !reflect.DeepEqual(client.UpsertOptions.Variables, variables) {
+		t.Fatalf("bad: %#v", client.UpsertOptions)
+	}
+}
+
+// This tests that the push command will send the variables in tfvars
+func TestPush_tfvars(t *testing.T) {
+	// Disable test mode so input would be asked and setup the
+	// input reader/writers.
+	test = false
+	defer func() { test = true }()
+	defaultInputReader = bytes.NewBufferString("nope\n")
+	defaultInputWriter = new(bytes.Buffer)
+
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Create remote state file, this should be pulled
+	conf, srv := testRemoteState(t, testState(), 200)
+	defer srv.Close()
+
+	// Persist local remote state
+	s := terraform.NewState()
+	s.Serial = 5
+	s.Remote = conf
+	testStateFileRemote(t, s)
+
+	// Path where the archive will be "uploaded" to
+	archivePath := testTempFile(t)
+	defer os.Remove(archivePath)
+
+	client := &mockPushClient{File: archivePath}
+	ui := new(cli.MockUi)
+	c := &PushCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+
+		client: client,
+	}
+
 	path := testFixturePath("push-tfvars")
 	args := []string{
 		"-var-file", path + "/terraform.tfvars",
diff --git a/command/refresh.go b/command/refresh.go
index 32e795047..ee3cd7007 100644
--- a/command/refresh.go
+++ b/command/refresh.go
@@ -105,6 +105,10 @@ func (c *RefreshCommand) Run(args []string) int {
 		return 1
 	}
 
+	if outputs := outputsAsString(newState); outputs != "" {
+		c.Ui.Output(c.Colorize().Color(outputs))
+	}
+
 	return 0
 }
 
diff --git a/command/refresh_test.go b/command/refresh_test.go
index 6ff99f9f1..530bde073 100644
--- a/command/refresh_test.go
+++ b/command/refresh_test.go
@@ -581,6 +581,35 @@ func TestRefresh_disableBackup(t *testing.T) {
 	}
 }
 
+func TestRefresh_displaysOutputs(t *testing.T) {
+	state := testState()
+	statePath := testStateFile(t, state)
+
+	p := testProvider()
+	ui := new(cli.MockUi)
+	c := &RefreshCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(p),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{
+		"-state", statePath,
+		testFixturePath("refresh-output"),
+	}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: %d\n\n%s", code, ui.ErrorWriter.String())
+	}
+
+	// Test that outputs were displayed
+	outputValue := "foo.example.com"
+	actual := ui.OutputWriter.String()
+	if !strings.Contains(actual, outputValue) {
+		t.Fatalf("Expected:\n%s\n\nTo include: %q", actual, outputValue)
+	}
+}
+
 const refreshVarFile = `
 foo = "bar"
 `
diff --git a/command/remote.go b/command/remote.go
index 3e9e05f1b..05d119341 100644
--- a/command/remote.go
+++ b/command/remote.go
@@ -42,6 +42,10 @@ Usage: terraform remote <subcommand> [options]
 
   Configure remote state storage with Terraform.
 
+Options:
+
+  -no-color   If specified, output won't contain any color.
+
 Available subcommands:
 
   config      Configure the remote storage settings.
diff --git a/command/remote_config.go b/command/remote_config.go
index 92017c484..265d1bff4 100644
--- a/command/remote_config.go
+++ b/command/remote_config.go
@@ -368,6 +368,8 @@ Options:
   -state=path            Path to read state. Defaults to "terraform.tfstate"
                          unless remote state is enabled.
 
+  -no-color              If specified, output won't contain any color.
+
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/remote_pull.go b/command/remote_pull.go
index bf757ccf1..b159d5a3b 100644
--- a/command/remote_pull.go
+++ b/command/remote_pull.go
@@ -74,6 +74,9 @@ Usage: terraform pull [options]
 
   Refreshes the cached state file from the remote server.
 
+Options:
+
+  -no-color           If specified, output won't contain any color.
 `
 	return strings.TrimSpace(helpText)
 }
diff --git a/command/remote_push.go b/command/remote_push.go
index 81e50c6ba..97ff8f951 100644
--- a/command/remote_push.go
+++ b/command/remote_push.go
@@ -81,6 +81,8 @@ Usage: terraform push [options]
 
 Options:
 
+  -no-color              If specified, output won't contain any color.
+
   -force                 Forces the upload of the local state, ignoring any
                          conflicts. This should be used carefully, as force pushing
 						 can cause remote state information to be lost.
diff --git a/command/show.go b/command/show.go
index cf7b6cfa6..624ee659d 100644
--- a/command/show.go
+++ b/command/show.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"strings"
 
-	statelib "github.com/hashicorp/terraform/state"
 	"github.com/hashicorp/terraform/terraform"
 )
 
@@ -66,16 +65,15 @@ func (c *ShowCommand) Run(args []string) int {
 				stateErr = err
 			}
 		}
-
 	} else {
-		// We should use the default state if it exists.
-		stateStore := &statelib.LocalState{Path: DefaultStateFilename}
-		if err := stateStore.RefreshState(); err != nil {
+		stateOpts := c.StateOpts()
+		stateOpts.RemoteCacheOnly = true
+		result, err := State(stateOpts)
+		if err != nil {
 			c.Ui.Error(fmt.Sprintf("Error reading state: %s", err))
 			return 1
 		}
-
-		state = stateStore.State()
+		state = result.State.State()
 		if state == nil {
 			c.Ui.Output("No state.")
 			return 0
diff --git a/command/show_test.go b/command/show_test.go
index 245b24def..eb73ebe2f 100644
--- a/command/show_test.go
+++ b/command/show_test.go
@@ -4,6 +4,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/hashicorp/terraform/config/module"
@@ -124,6 +125,45 @@ func TestShow_plan(t *testing.T) {
 	}
 }
 
+func TestShow_noArgsRemoteState(t *testing.T) {
+	tmp, cwd := testCwd(t)
+	defer testFixCwd(t, tmp, cwd)
+
+	// Pretend like we have a local cache of remote state
+	remoteStatePath := filepath.Join(tmp, DefaultDataDir, DefaultStateFilename)
+	if err := os.MkdirAll(filepath.Dir(remoteStatePath), 0755); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	f, err := os.Create(remoteStatePath)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	err = terraform.WriteState(testState(), f)
+	f.Close()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	ui := new(cli.MockUi)
+	c := &ShowCommand{
+		Meta: Meta{
+			ContextOpts: testCtxConfig(testProvider()),
+			Ui:          ui,
+		},
+	}
+
+	args := []string{}
+	if code := c.Run(args); code != 0 {
+		t.Fatalf("bad: \n%s", ui.OutputWriter.String())
+	}
+
+	expected := "test_instance.foo"
+	actual := ui.OutputWriter.String()
+	if !strings.Contains(actual, expected) {
+		t.Fatalf("expected:\n%s\n\nto include: %q", actual, expected)
+	}
+}
+
 func TestShow_state(t *testing.T) {
 	originalState := testState()
 	statePath := testStateFile(t, originalState)
diff --git a/command/test-fixtures/refresh-output/main.tf b/command/test-fixtures/refresh-output/main.tf
new file mode 100644
index 000000000..d7efff6e4
--- /dev/null
+++ b/command/test-fixtures/refresh-output/main.tf
@@ -0,0 +1,7 @@
+resource "test_instance" "foo" {
+    ami = "bar"
+}
+
+output "endpoint" {
+  value = "foo.example.com"
+}
diff --git a/communicator/ssh/communicator.go b/communicator/ssh/communicator.go
index 402331da1..672dc78af 100644
--- a/communicator/ssh/communicator.go
+++ b/communicator/ssh/communicator.go
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform/communicator/remote"
 	"github.com/hashicorp/terraform/terraform"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 )
 
 const (
@@ -47,9 +48,9 @@ type sshConfig struct {
 	// noPty, if true, will not request a pty from the remote end.
 	noPty bool
 
-	// sshAgentConn is a pointer to the UNIX connection for talking with the
-	// ssh-agent.
-	sshAgentConn net.Conn
+	// sshAgent is a struct surrounding the agent.Agent client and the net.Conn
+	// to the SSH Agent. It is nil if no SSH agent is configured
+	sshAgent *sshAgent
 }
 
 // New creates a new communicator implementation over SSH.
@@ -122,6 +123,26 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 
 	c.client = ssh.NewClient(sshConn, sshChan, req)
 
+	if c.config.sshAgent != nil {
+		log.Printf("[DEBUG] Telling SSH config to foward to agent")
+		if err := c.config.sshAgent.ForwardToAgent(c.client); err != nil {
+			return err
+		}
+
+		log.Printf("[DEBUG] Setting up a session to request agent forwarding")
+		session, err := c.newSession()
+		if err != nil {
+			return err
+		}
+		defer session.Close()
+
+		if err = agent.RequestAgentForwarding(session); err != nil {
+			return err
+		}
+
+		log.Printf("[INFO] agent forwarding enabled")
+	}
+
 	if o != nil {
 		o.Output("Connected!")
 	}
@@ -131,8 +152,8 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 
 // Disconnect implementation of communicator.Communicator interface
 func (c *Communicator) Disconnect() error {
-	if c.config.sshAgentConn != nil {
-		return c.config.sshAgentConn.Close()
+	if c.config.sshAgent != nil {
+		return c.config.sshAgent.Close()
 	}
 
 	return nil
@@ -563,3 +584,43 @@ func ConnectFunc(network, addr string) func() (net.Conn, error) {
 		return c, nil
 	}
 }
+
+// BastionConnectFunc is a convenience method for returning a function
+// that connects to a host over a bastion connection.
+func BastionConnectFunc(
+	bProto string,
+	bAddr string,
+	bConf *ssh.ClientConfig,
+	proto string,
+	addr string) func() (net.Conn, error) {
+	return func() (net.Conn, error) {
+		log.Printf("[DEBUG] Connecting to bastion: %s", bAddr)
+		bastion, err := ssh.Dial(bProto, bAddr, bConf)
+		if err != nil {
+			return nil, fmt.Errorf("Error connecting to bastion: %s", err)
+		}
+
+		log.Printf("[DEBUG] Connecting via bastion (%s) to host: %s", bAddr, addr)
+		conn, err := bastion.Dial(proto, addr)
+		if err != nil {
+			bastion.Close()
+			return nil, err
+		}
+
+		// Wrap it up so we close both things properly
+		return &bastionConn{
+			Conn:    conn,
+			Bastion: bastion,
+		}, nil
+	}
+}
+
+type bastionConn struct {
+	net.Conn
+	Bastion *ssh.Client
+}
+
+func (c *bastionConn) Close() error {
+	c.Conn.Close()
+	return c.Bastion.Close()
+}
diff --git a/communicator/ssh/provisioner.go b/communicator/ssh/provisioner.go
index 12d7048e7..cda7fc2f3 100644
--- a/communicator/ssh/provisioner.go
+++ b/communicator/ssh/provisioner.go
@@ -44,6 +44,12 @@ type connectionInfo struct {
 	Timeout    string
 	ScriptPath string        `mapstructure:"script_path"`
 	TimeoutVal time.Duration `mapstructure:"-"`
+
+	BastionUser     string `mapstructure:"bastion_user"`
+	BastionPassword string `mapstructure:"bastion_password"`
+	BastionKeyFile  string `mapstructure:"bastion_key_file"`
+	BastionHost     string `mapstructure:"bastion_host"`
+	BastionPort     int    `mapstructure:"bastion_port"`
 }
 
 // parseConnectionInfo is used to convert the ConnInfo of the InstanceState into
@@ -62,6 +68,15 @@ func parseConnectionInfo(s *terraform.InstanceState) (*connectionInfo, error) {
 		return nil, err
 	}
 
+	// To default Agent to true, we need to check the raw string, since the
+	// decoded boolean can't represent "absence of config".
+	//
+	// And if SSH_AUTH_SOCK is not set, there's no agent to connect to, so we
+	// shouldn't try.
+	if s.Ephemeral.ConnInfo["agent"] == "" && os.Getenv("SSH_AUTH_SOCK") != "" {
+		connInfo.Agent = true
+	}
+
 	if connInfo.User == "" {
 		connInfo.User = DefaultUser
 	}
@@ -77,6 +92,22 @@ func parseConnectionInfo(s *terraform.InstanceState) (*connectionInfo, error) {
 		connInfo.TimeoutVal = DefaultTimeout
 	}
 
+	// Default all bastion config attrs to their non-bastion counterparts
+	if connInfo.BastionHost != "" {
+		if connInfo.BastionUser == "" {
+			connInfo.BastionUser = connInfo.User
+		}
+		if connInfo.BastionPassword == "" {
+			connInfo.BastionPassword = connInfo.Password
+		}
+		if connInfo.BastionKeyFile == "" {
+			connInfo.BastionKeyFile = connInfo.KeyFile
+		}
+		if connInfo.BastionPort == 0 {
+			connInfo.BastionPort = connInfo.Port
+		}
+	}
+
 	return connInfo, nil
 }
 
@@ -93,73 +124,152 @@ func safeDuration(dur string, defaultDur time.Duration) time.Duration {
 // prepareSSHConfig is used to turn the *ConnectionInfo provided into a
 // usable *SSHConfig for client initialization.
 func prepareSSHConfig(connInfo *connectionInfo) (*sshConfig, error) {
-	var conn net.Conn
-	var err error
-
-	sshConf := &ssh.ClientConfig{
-		User: connInfo.User,
+	sshAgent, err := connectToAgent(connInfo)
+	if err != nil {
+		return nil, err
 	}
-	if connInfo.Agent {
-		sshAuthSock := os.Getenv("SSH_AUTH_SOCK")
 
-		if sshAuthSock == "" {
-			return nil, fmt.Errorf("SSH Requested but SSH_AUTH_SOCK not-specified")
-		}
-
-		conn, err = net.Dial("unix", sshAuthSock)
-		if err != nil {
-			return nil, fmt.Errorf("Error connecting to SSH_AUTH_SOCK: %v", err)
-		}
-		// I need to close this but, later after all connections have been made
-		// defer conn.Close()
-		signers, err := agent.NewClient(conn).Signers()
-		if err != nil {
-			return nil, fmt.Errorf("Error getting keys from ssh agent: %v", err)
-		}
-
-		sshConf.Auth = append(sshConf.Auth, ssh.PublicKeys(signers...))
+	sshConf, err := buildSSHClientConfig(sshClientConfigOpts{
+		user:     connInfo.User,
+		keyFile:  connInfo.KeyFile,
+		password: connInfo.Password,
+		sshAgent: sshAgent,
+	})
+	if err != nil {
+		return nil, err
 	}
-	if connInfo.KeyFile != "" {
-		fullPath, err := homedir.Expand(connInfo.KeyFile)
-		if err != nil {
-			return nil, fmt.Errorf("Failed to expand home directory: %v", err)
-		}
-		key, err := ioutil.ReadFile(fullPath)
-		if err != nil {
-			return nil, fmt.Errorf("Failed to read key file '%s': %v", connInfo.KeyFile, err)
-		}
 
-		// We parse the private key on our own first so that we can
-		// show a nicer error if the private key has a password.
-		block, _ := pem.Decode(key)
-		if block == nil {
-			return nil, fmt.Errorf(
-				"Failed to read key '%s': no key found", connInfo.KeyFile)
-		}
-		if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
-			return nil, fmt.Errorf(
-				"Failed to read key '%s': password protected keys are\n"+
-					"not supported. Please decrypt the key prior to use.", connInfo.KeyFile)
-		}
-
-		signer, err := ssh.ParsePrivateKey(key)
+	var bastionConf *ssh.ClientConfig
+	if connInfo.BastionHost != "" {
+		bastionConf, err = buildSSHClientConfig(sshClientConfigOpts{
+			user:     connInfo.BastionUser,
+			keyFile:  connInfo.BastionKeyFile,
+			password: connInfo.BastionPassword,
+			sshAgent: sshAgent,
+		})
 		if err != nil {
-			return nil, fmt.Errorf("Failed to parse key file '%s': %v", connInfo.KeyFile, err)
+			return nil, err
 		}
-
-		sshConf.Auth = append(sshConf.Auth, ssh.PublicKeys(signer))
-	}
-	if connInfo.Password != "" {
-		sshConf.Auth = append(sshConf.Auth,
-			ssh.Password(connInfo.Password))
-		sshConf.Auth = append(sshConf.Auth,
-			ssh.KeyboardInteractive(PasswordKeyboardInteractive(connInfo.Password)))
 	}
+
 	host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port)
+	connectFunc := ConnectFunc("tcp", host)
+
+	if bastionConf != nil {
+		bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort)
+		connectFunc = BastionConnectFunc("tcp", bastionHost, bastionConf, "tcp", host)
+	}
+
 	config := &sshConfig{
-		config:       sshConf,
-		connection:   ConnectFunc("tcp", host),
-		sshAgentConn: conn,
+		config:     sshConf,
+		connection: connectFunc,
+		sshAgent:   sshAgent,
 	}
 	return config, nil
 }
+
+type sshClientConfigOpts struct {
+	keyFile  string
+	password string
+	sshAgent *sshAgent
+	user     string
+}
+
+func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {
+	conf := &ssh.ClientConfig{
+		User: opts.user,
+	}
+
+	if opts.sshAgent != nil {
+		conf.Auth = append(conf.Auth, opts.sshAgent.Auth())
+	}
+
+	if opts.keyFile != "" {
+		pubKeyAuth, err := readPublicKeyFromPath(opts.keyFile)
+		if err != nil {
+			return nil, err
+		}
+		conf.Auth = append(conf.Auth, pubKeyAuth)
+	}
+
+	if opts.password != "" {
+		conf.Auth = append(conf.Auth, ssh.Password(opts.password))
+		conf.Auth = append(conf.Auth, ssh.KeyboardInteractive(
+			PasswordKeyboardInteractive(opts.password)))
+	}
+
+	return conf, nil
+}
+
+func readPublicKeyFromPath(path string) (ssh.AuthMethod, error) {
+	fullPath, err := homedir.Expand(path)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to expand home directory: %s", err)
+	}
+	key, err := ioutil.ReadFile(fullPath)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to read key file %q: %s", path, err)
+	}
+
+	// We parse the private key on our own first so that we can
+	// show a nicer error if the private key has a password.
+	block, _ := pem.Decode(key)
+	if block == nil {
+		return nil, fmt.Errorf("Failed to read key %q: no key found", path)
+	}
+	if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+		return nil, fmt.Errorf(
+			"Failed to read key %q: password protected keys are\n"+
+				"not supported. Please decrypt the key prior to use.", path)
+	}
+
+	signer, err := ssh.ParsePrivateKey(key)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to parse key file %q: %s", path, err)
+	}
+
+	return ssh.PublicKeys(signer), nil
+}
+
+func connectToAgent(connInfo *connectionInfo) (*sshAgent, error) {
+	if connInfo.Agent != true {
+		// No agent configured
+		return nil, nil
+	}
+
+	sshAuthSock := os.Getenv("SSH_AUTH_SOCK")
+
+	if sshAuthSock == "" {
+		return nil, fmt.Errorf("SSH Requested but SSH_AUTH_SOCK not-specified")
+	}
+
+	conn, err := net.Dial("unix", sshAuthSock)
+	if err != nil {
+		return nil, fmt.Errorf("Error connecting to SSH_AUTH_SOCK: %v", err)
+	}
+
+	// connection close is handled over in Communicator
+	return &sshAgent{
+		agent: agent.NewClient(conn),
+		conn:  conn,
+	}, nil
+}
+
+// A tiny wrapper around an agent.Agent to expose the ability to close its
+// associated connection on request.
+type sshAgent struct {
+	agent agent.Agent
+	conn  net.Conn
+}
+
+func (a *sshAgent) Close() error {
+	return a.conn.Close()
+}
+
+func (a *sshAgent) Auth() ssh.AuthMethod {
+	return ssh.PublicKeysCallback(a.agent.Signers)
+}
+
+func (a *sshAgent) ForwardToAgent(client *ssh.Client) error {
+	return agent.ForwardToAgent(client, a.agent)
+}
diff --git a/communicator/ssh/provisioner_test.go b/communicator/ssh/provisioner_test.go
index 33c2b7b7b..fc6b686fb 100644
--- a/communicator/ssh/provisioner_test.go
+++ b/communicator/ssh/provisioner_test.go
@@ -17,6 +17,8 @@ func TestProvisioner_connInfo(t *testing.T) {
 				"host":     "127.0.0.1",
 				"port":     "22",
 				"timeout":  "30s",
+
+				"bastion_host": "127.0.1.1",
 			},
 		},
 	}
@@ -47,4 +49,19 @@ func TestProvisioner_connInfo(t *testing.T) {
 	if conf.ScriptPath != DefaultScriptPath {
 		t.Fatalf("bad: %v", conf)
 	}
+	if conf.BastionHost != "127.0.1.1" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionPort != 22 {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionUser != "root" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionPassword != "supersecret" {
+		t.Fatalf("bad: %v", conf)
+	}
+	if conf.BastionKeyFile != "/my/key/file.pem" {
+		t.Fatalf("bad: %v", conf)
+	}
 }
diff --git a/config/config.go b/config/config.go
index c085e1f26..811b77ec7 100644
--- a/config/config.go
+++ b/config/config.go
@@ -84,8 +84,8 @@ type Resource struct {
 // ResourceLifecycle is used to store the lifecycle tuning parameters
 // to allow customized behavior
 type ResourceLifecycle struct {
-	CreateBeforeDestroy bool `hcl:"create_before_destroy"`
-	PreventDestroy      bool `hcl:"prevent_destroy"`
+	CreateBeforeDestroy bool `mapstructure:"create_before_destroy"`
+	PreventDestroy      bool `mapstructure:"prevent_destroy"`
 }
 
 // Provisioner is a configured provisioner step on a resource.
@@ -683,6 +683,10 @@ func (o *Output) mergerMerge(m merger) merger {
 	return &result
 }
 
+func (c *ProviderConfig) GoString() string {
+	return fmt.Sprintf("*%#v", *c)
+}
+
 func (c *ProviderConfig) FullName() string {
 	if c.Alias == "" {
 		return c.Name
diff --git a/config/config_test.go b/config/config_test.go
index 88dbdc6c5..2c9791877 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -450,7 +450,7 @@ func TestVariableDefaultsMap(t *testing.T) {
 }
 
 func testConfig(t *testing.T, name string) *Config {
-	c, err := Load(filepath.Join(fixtureDir, name, "main.tf"))
+	c, err := LoadFile(filepath.Join(fixtureDir, name, "main.tf"))
 	if err != nil {
 		t.Fatalf("file: %s\n\nerr: %s", name, err)
 	}
diff --git a/config/import_tree.go b/config/import_tree.go
index 829046c49..37ec11a15 100644
--- a/config/import_tree.go
+++ b/config/import_tree.go
@@ -33,9 +33,7 @@ type fileLoaderFunc func(path string) (configurable, []string, error)
 func loadTree(root string) (*importTree, error) {
 	var f fileLoaderFunc
 	switch ext(root) {
-	case ".tf":
-		fallthrough
-	case ".tf.json":
+	case ".tf", ".tf.json":
 		f = loadFileHcl
 	default:
 	}
diff --git a/config/interpolate_funcs.go b/config/interpolate_funcs.go
index 7c4d76619..9b26c24ff 100644
--- a/config/interpolate_funcs.go
+++ b/config/interpolate_funcs.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 
@@ -18,18 +19,15 @@ var Funcs map[string]ast.Function
 
 func init() {
 	Funcs = map[string]ast.Function{
+		"concat":     interpolationFuncConcat(),
+		"element":    interpolationFuncElement(),
 		"file":       interpolationFuncFile(),
 		"format":     interpolationFuncFormat(),
 		"formatlist": interpolationFuncFormatList(),
 		"join":       interpolationFuncJoin(),
-		"element":    interpolationFuncElement(),
+		"length":     interpolationFuncLength(),
 		"replace":    interpolationFuncReplace(),
 		"split":      interpolationFuncSplit(),
-		"length":     interpolationFuncLength(),
-
-		// Concat is a little useless now since we supported embeddded
-		// interpolations but we keep it around for backwards compat reasons.
-		"concat": interpolationFuncConcat(),
 	}
 }
 
@@ -45,11 +43,33 @@ func interpolationFuncConcat() ast.Function {
 		VariadicType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
 			var b bytes.Buffer
-			for _, v := range args {
-				b.WriteString(v.(string))
+			var finalList []string
+
+			var isDeprecated = true
+
+			for _, arg := range args {
+				argument := arg.(string)
+
+				if len(argument) == 0 {
+					continue
+				}
+
+				if IsStringList(argument) {
+					isDeprecated = false
+					finalList = append(finalList, StringList(argument).Slice()...)
+				} else {
+					finalList = append(finalList, argument)
+				}
+
+				// Deprecated concat behaviour
+				b.WriteString(argument)
 			}
 
-			return b.String(), nil
+			if isDeprecated {
+				return b.String(), nil
+			}
+
+			return NewStringList(finalList).String(), nil
 		},
 	}
 }
@@ -112,11 +132,16 @@ func interpolationFuncFormatList() ast.Function {
 				if !ok {
 					continue
 				}
-				parts := strings.Split(s, InterpSplitDelim)
-				if len(parts) == 1 {
+				if !IsStringList(s) {
 					continue
 				}
+
+				parts := StringList(s).Slice()
+
+				// otherwise the list is sent down to be indexed
 				varargs[i-1] = parts
+
+				// Check length
 				if n == 0 {
 					// first list we've seen
 					n = len(parts)
@@ -148,7 +173,7 @@ func interpolationFuncFormatList() ast.Function {
 				}
 				list[i] = fmt.Sprintf(format, fmtargs...)
 			}
-			return strings.Join(list, InterpSplitDelim), nil
+			return NewStringList(list).String(), nil
 		},
 	}
 }
@@ -162,7 +187,7 @@ func interpolationFuncJoin() ast.Function {
 		Callback: func(args []interface{}) (interface{}, error) {
 			var list []string
 			for _, arg := range args[1:] {
-				parts := strings.Split(arg.(string), InterpSplitDelim)
+				parts := StringList(arg.(string)).Slice()
 				list = append(list, parts...)
 			}
 
@@ -204,18 +229,15 @@ func interpolationFuncLength() ast.Function {
 		ReturnType: ast.TypeInt,
 		Variadic:   false,
 		Callback: func(args []interface{}) (interface{}, error) {
-			if !strings.Contains(args[0].(string), InterpSplitDelim) {
+			if !IsStringList(args[0].(string)) {
 				return len(args[0].(string)), nil
 			}
 
-			var list []string
+			length := 0
 			for _, arg := range args {
-				parts := strings.Split(arg.(string), InterpSplitDelim)
-				for _, part := range parts {
-					list = append(list, part)
-				}
+				length += StringList(arg.(string)).Length()
 			}
-			return len(list), nil
+			return length, nil
 		},
 	}
 }
@@ -227,7 +249,9 @@ func interpolationFuncSplit() ast.Function {
 		ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
 		ReturnType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
-			return strings.Replace(args[1].(string), args[0].(string), InterpSplitDelim, -1), nil
+			sep := args[0].(string)
+			s := args[1].(string)
+			return NewStringList(strings.Split(s, sep)).String(), nil
 		},
 	}
 }
@@ -265,7 +289,7 @@ func interpolationFuncElement() ast.Function {
 		ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
 		ReturnType: ast.TypeString,
 		Callback: func(args []interface{}) (interface{}, error) {
-			list := strings.Split(args[0].(string), InterpSplitDelim)
+			list := StringList(args[0].(string))
 
 			index, err := strconv.Atoi(args[1].(string))
 			if err != nil {
@@ -273,8 +297,78 @@ func interpolationFuncElement() ast.Function {
 					"invalid number for index, got %s", args[1])
 			}
 
-			v := list[index%len(list)]
+			v := list.Element(index)
 			return v, nil
 		},
 	}
 }
+
+// interpolationFuncKeys implements the "keys" function that yields a list of
+// keys of map types within a Terraform configuration.
+func interpolationFuncKeys(vs map[string]ast.Variable) ast.Function {
+	return ast.Function{
+		ArgTypes:   []ast.Type{ast.TypeString},
+		ReturnType: ast.TypeString,
+		Callback: func(args []interface{}) (interface{}, error) {
+			// Prefix must include ending dot to be a map
+			prefix := fmt.Sprintf("var.%s.", args[0].(string))
+			keys := make([]string, 0, len(vs))
+			for k, _ := range vs {
+				if !strings.HasPrefix(k, prefix) {
+					continue
+				}
+				keys = append(keys, k[len(prefix):])
+			}
+
+			if len(keys) <= 0 {
+				return "", fmt.Errorf(
+					"failed to find map '%s'",
+					args[0].(string))
+			}
+
+			sort.Strings(keys)
+
+			return NewStringList(keys).String(), nil
+		},
+	}
+}
+
+// interpolationFuncValues implements the "values" function that yields a list of
+// keys of map types within a Terraform configuration.
+func interpolationFuncValues(vs map[string]ast.Variable) ast.Function {
+	return ast.Function{
+		ArgTypes:   []ast.Type{ast.TypeString},
+		ReturnType: ast.TypeString,
+		Callback: func(args []interface{}) (interface{}, error) {
+			// Prefix must include ending dot to be a map
+			prefix := fmt.Sprintf("var.%s.", args[0].(string))
+			keys := make([]string, 0, len(vs))
+			for k, _ := range vs {
+				if !strings.HasPrefix(k, prefix) {
+					continue
+				}
+				keys = append(keys, k)
+			}
+
+			if len(keys) <= 0 {
+				return "", fmt.Errorf(
+					"failed to find map '%s'",
+					args[0].(string))
+			}
+
+			sort.Strings(keys)
+
+			vals := make([]string, 0, len(keys))
+
+			for _, k := range keys {
+				v := vs[k]
+				if v.Type != ast.TypeString {
+					return "", fmt.Errorf("values(): %q has bad type %s", k, v.Type)
+				}
+				vals = append(vals, vs[k].Value.(string))
+			}
+
+			return NewStringList(vals).String(), nil
+		},
+	}
+}
diff --git a/config/interpolate_funcs_test.go b/config/interpolate_funcs_test.go
index 5432cdbd7..3258bda5c 100644
--- a/config/interpolate_funcs_test.go
+++ b/config/interpolate_funcs_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/hashicorp/terraform/config/lang/ast"
 )
 
-func TestInterpolateFuncConcat(t *testing.T) {
+func TestInterpolateFuncDeprecatedConcat(t *testing.T) {
 	testFunction(t, testFunctionConfig{
 		Cases: []testFunctionCase{
 			{
@@ -35,6 +35,58 @@ func TestInterpolateFuncConcat(t *testing.T) {
 	})
 }
 
+func TestInterpolateFuncConcat(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Cases: []testFunctionCase{
+			// String + list
+			{
+				`${concat("a", split(",", "b,c"))}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// List + string
+			{
+				`${concat(split(",", "a,b"), "c")}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// Single list
+			{
+				`${concat(split(",", ",foo,"))}`,
+				NewStringList([]string{"", "foo", ""}).String(),
+				false,
+			},
+			{
+				`${concat(split(",", "a,b,c"))}`,
+				NewStringList([]string{"a", "b", "c"}).String(),
+				false,
+			},
+
+			// Two lists
+			{
+				`${concat(split(",", "a,b,c"), split(",", "d,e"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e"}).String(),
+				false,
+			},
+			// Two lists with different separators
+			{
+				`${concat(split(",", "a,b,c"), split(" ", "d e"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e"}).String(),
+				false,
+			},
+
+			// More lists
+			{
+				`${concat(split(",", "a,b"), split(",", "c,d"), split(",", "e,f"), split(",", "0,1"))}`,
+				NewStringList([]string{"a", "b", "c", "d", "e", "f", "0", "1"}).String(),
+				false,
+			},
+		},
+	})
+}
+
 func TestInterpolateFuncFile(t *testing.T) {
 	tf, err := ioutil.TempFile("", "tf")
 	if err != nil {
@@ -123,7 +175,7 @@ func TestInterpolateFuncFormatList(t *testing.T) {
 			// formatlist applies to each list element in turn
 			{
 				`${formatlist("<%s>", split(",", "A,B"))}`,
-				"<A>" + InterpSplitDelim + "<B>",
+				NewStringList([]string{"<A>", "<B>"}).String(),
 				false,
 			},
 			// formatlist repeats scalar elements
@@ -138,23 +190,18 @@ func TestInterpolateFuncFormatList(t *testing.T) {
 				"A=1, B=2, C=3",
 				false,
 			},
-			// formatlist of lists of length zero/one are repeated, just as scalars are
-			{
-				`${join(", ", formatlist("%s=%s", split(",", ""), split(",", "1,2,3")))}`,
-				"=1, =2, =3",
-				false,
-			},
-			{
-				`${join(", ", formatlist("%s=%s", split(",", "A"), split(",", "1,2,3")))}`,
-				"A=1, A=2, A=3",
-				false,
-			},
 			// Mismatched list lengths generate an error
 			{
 				`${formatlist("%s=%2s", split(",", "A,B,C,D"), split(",", "1,2,3"))}`,
 				nil,
 				true,
 			},
+			// Works with lists of length 1 [GH-2240]
+			{
+				`${formatlist("%s.id", split(",", "demo-rest-elb"))}`,
+				NewStringList([]string{"demo-rest-elb.id"}).String(),
+				false,
+			},
 		},
 	})
 }
@@ -169,7 +216,8 @@ func TestInterpolateFuncJoin(t *testing.T) {
 			},
 
 			{
-				`${join(",", "foo")}`,
+				fmt.Sprintf(`${join(",", "%s")}`,
+					NewStringList([]string{"foo"}).String()),
 				"foo",
 				false,
 			},
@@ -185,10 +233,7 @@ func TestInterpolateFuncJoin(t *testing.T) {
 
 			{
 				fmt.Sprintf(`${join(".", "%s")}`,
-					fmt.Sprintf(
-						"foo%sbar%sbaz",
-						InterpSplitDelim,
-						InterpSplitDelim)),
+					NewStringList([]string{"foo", "bar", "baz"}).String()),
 				"foo.bar.baz",
 				false,
 			},
@@ -305,47 +350,39 @@ func TestInterpolateFuncSplit(t *testing.T) {
 				true,
 			},
 
+			{
+				`${split(",", "")}`,
+				NewStringList([]string{""}).String(),
+				false,
+			},
+
 			{
 				`${split(",", "foo")}`,
-				"foo",
+				NewStringList([]string{"foo"}).String(),
 				false,
 			},
 
 			{
 				`${split(",", ",,,")}`,
-				fmt.Sprintf(
-					"%s%s%s",
-					InterpSplitDelim,
-					InterpSplitDelim,
-					InterpSplitDelim),
+				NewStringList([]string{"", "", "", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(",", "foo,")}`,
-				fmt.Sprintf(
-					"%s%s",
-					"foo",
-					InterpSplitDelim),
+				NewStringList([]string{"foo", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(",", ",foo,")}`,
-				fmt.Sprintf(
-					"%s%s%s",
-					InterpSplitDelim,
-					"foo",
-					InterpSplitDelim),
+				NewStringList([]string{"", "foo", ""}).String(),
 				false,
 			},
 
 			{
 				`${split(".", "foo.bar.baz")}`,
-				fmt.Sprintf(
-					"foo%sbar%sbaz",
-					InterpSplitDelim,
-					InterpSplitDelim),
+				NewStringList([]string{"foo", "bar", "baz"}).String(),
 				false,
 			},
 		},
@@ -384,18 +421,113 @@ func TestInterpolateFuncLookup(t *testing.T) {
 	})
 }
 
+func TestInterpolateFuncKeys(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Vars: map[string]ast.Variable{
+			"var.foo.bar": ast.Variable{
+				Value: "baz",
+				Type:  ast.TypeString,
+			},
+			"var.foo.qux": ast.Variable{
+				Value: "quack",
+				Type:  ast.TypeString,
+			},
+			"var.str": ast.Variable{
+				Value: "astring",
+				Type:  ast.TypeString,
+			},
+		},
+		Cases: []testFunctionCase{
+			{
+				`${keys("foo")}`,
+				NewStringList([]string{"bar", "qux"}).String(),
+				false,
+			},
+
+			// Invalid key
+			{
+				`${keys("not")}`,
+				nil,
+				true,
+			},
+
+			// Too many args
+			{
+				`${keys("foo", "bar")}`,
+				nil,
+				true,
+			},
+
+			// Not a map
+			{
+				`${keys("str")}`,
+				nil,
+				true,
+			},
+		},
+	})
+}
+
+func TestInterpolateFuncValues(t *testing.T) {
+	testFunction(t, testFunctionConfig{
+		Vars: map[string]ast.Variable{
+			"var.foo.bar": ast.Variable{
+				Value: "quack",
+				Type:  ast.TypeString,
+			},
+			"var.foo.qux": ast.Variable{
+				Value: "baz",
+				Type:  ast.TypeString,
+			},
+			"var.str": ast.Variable{
+				Value: "astring",
+				Type:  ast.TypeString,
+			},
+		},
+		Cases: []testFunctionCase{
+			{
+				`${values("foo")}`,
+				NewStringList([]string{"quack", "baz"}).String(),
+				false,
+			},
+
+			// Invalid key
+			{
+				`${values("not")}`,
+				nil,
+				true,
+			},
+
+			// Too many args
+			{
+				`${values("foo", "bar")}`,
+				nil,
+				true,
+			},
+
+			// Not a map
+			{
+				`${values("str")}`,
+				nil,
+				true,
+			},
+		},
+	})
+}
+
 func TestInterpolateFuncElement(t *testing.T) {
 	testFunction(t, testFunctionConfig{
 		Cases: []testFunctionCase{
 			{
 				fmt.Sprintf(`${element("%s", "1")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				"baz",
 				false,
 			},
 
 			{
-				`${element("foo", "0")}`,
+				fmt.Sprintf(`${element("%s", "0")}`,
+					NewStringList([]string{"foo"}).String()),
 				"foo",
 				false,
 			},
@@ -403,7 +535,7 @@ func TestInterpolateFuncElement(t *testing.T) {
 			// Invalid index should wrap vs. out-of-bounds
 			{
 				fmt.Sprintf(`${element("%s", "2")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				"foo",
 				false,
 			},
@@ -411,7 +543,7 @@ func TestInterpolateFuncElement(t *testing.T) {
 			// Too many args
 			{
 				fmt.Sprintf(`${element("%s", "0", "2")}`,
-					"foo"+InterpSplitDelim+"baz"),
+					NewStringList([]string{"foo", "baz"}).String()),
 				nil,
 				true,
 			},
@@ -434,12 +566,12 @@ func testFunction(t *testing.T, config testFunctionConfig) {
 	for i, tc := range config.Cases {
 		ast, err := lang.Parse(tc.Input)
 		if err != nil {
-			t.Fatalf("%d: err: %s", i, err)
+			t.Fatalf("Case #%d: input: %#v\nerr: %s", i, tc.Input, err)
 		}
 
 		out, _, err := lang.Eval(ast, langEvalConfig(config.Vars))
 		if (err != nil) != tc.Error {
-			t.Fatalf("%d: err: %s", i, err)
+			t.Fatalf("Case #%d:\ninput: %#v\nerr: %s", i, tc.Input, err)
 		}
 
 		if !reflect.DeepEqual(out, tc.Result) {
diff --git a/config/interpolate_walk.go b/config/interpolate_walk.go
index faacb5726..adcb5e32c 100644
--- a/config/interpolate_walk.go
+++ b/config/interpolate_walk.go
@@ -10,10 +10,6 @@ import (
 	"github.com/mitchellh/reflectwalk"
 )
 
-// InterpSplitDelim is the delimeter that is looked for to split when
-// it is returned.
-const InterpSplitDelim = `B780FFEC-B661-4EB8-9236-A01737AD98B6`
-
 // interpolationWalker implements interfaces for the reflectwalk package
 // (github.com/mitchellh/reflectwalk) that can be used to automatically
 // execute a callback for an interpolation.
@@ -148,8 +144,8 @@ func (w *interpolationWalker) Primitive(v reflect.Value) error {
 		// set if it is computed. This behavior is different if we're
 		// splitting (in a SliceElem) or not.
 		remove := false
-		if w.loc == reflectwalk.SliceElem {
-			parts := strings.Split(replaceVal, InterpSplitDelim)
+		if w.loc == reflectwalk.SliceElem && IsStringList(replaceVal) {
+			parts := StringList(replaceVal).Slice()
 			for _, p := range parts {
 				if p == UnknownVariableValue {
 					remove = true
@@ -247,7 +243,7 @@ func (w *interpolationWalker) splitSlice() {
 		if !ok {
 			continue
 		}
-		if idx := strings.Index(sv, InterpSplitDelim); idx >= 0 {
+		if IsStringList(sv) {
 			split = true
 			break
 		}
@@ -269,10 +265,15 @@ func (w *interpolationWalker) splitSlice() {
 			continue
 		}
 
-		// Split on the delimiter
-		for _, p := range strings.Split(sv, InterpSplitDelim) {
-			result = append(result, p)
+		if IsStringList(sv) {
+			for _, p := range StringList(sv).Slice() {
+				result = append(result, p)
+			}
+			continue
 		}
+
+		// Not a string list, so just set it
+		result = append(result, sv)
 	}
 
 	// Our slice is now done, we have to replace the slice now
diff --git a/config/interpolate_walk_test.go b/config/interpolate_walk_test.go
index 9b2c34133..fc7c8b549 100644
--- a/config/interpolate_walk_test.go
+++ b/config/interpolate_walk_test.go
@@ -157,7 +157,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 					"bing",
 				},
 			},
-			Value: "bar" + InterpSplitDelim + "baz",
+			Value: NewStringList([]string{"bar", "baz"}).String(),
 		},
 
 		{
@@ -168,7 +168,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 				},
 			},
 			Output: map[string]interface{}{},
-			Value:  UnknownVariableValue + InterpSplitDelim + "baz",
+			Value:  NewStringList([]string{UnknownVariableValue, "baz"}).String(),
 		},
 	}
 
@@ -183,7 +183,7 @@ func TestInterpolationWalker_replace(t *testing.T) {
 		}
 
 		if !reflect.DeepEqual(tc.Input, tc.Output) {
-			t.Fatalf("%d: bad:\n\n%#v", i, tc.Input)
+			t.Fatalf("%d: bad:\n\nexpected:%#v\ngot:%#v", i, tc.Output, tc.Input)
 		}
 	}
 }
diff --git a/config/lang/ast/call.go b/config/lang/ast/call.go
index ace1147a6..055701102 100644
--- a/config/lang/ast/call.go
+++ b/config/lang/ast/call.go
@@ -41,3 +41,7 @@ func (n *Call) Type(s Scope) (Type, error) {
 
 	return f.ReturnType, nil
 }
+
+func (n *Call) GoString() string {
+	return fmt.Sprintf("*%#v", *n)
+}
diff --git a/config/lang/lex.go b/config/lang/lex.go
index 6e70acfbc..0dbe16c9f 100644
--- a/config/lang/lex.go
+++ b/config/lang/lex.go
@@ -192,12 +192,20 @@ func (x *parserLex) lexModeInterpolation(yylval *parserSymType) int {
 
 func (x *parserLex) lexId(yylval *parserSymType) int {
 	var b bytes.Buffer
+	var last rune
 	for {
 		c := x.next()
 		if c == lexEOF {
 			break
 		}
 
+		// We only allow * after a '.' for resource splast: type.name.*.id
+		// Otherwise, its probably multiplication.
+		if c == '*' && last != '.' {
+			x.backup()
+			break
+		}
+
 		// If this isn't a character we want in an ID, return out.
 		// One day we should make this a regexp.
 		if c != '_' &&
@@ -214,6 +222,8 @@ func (x *parserLex) lexId(yylval *parserSymType) int {
 			x.Error(err.Error())
 			return lexEOF
 		}
+
+		last = c
 	}
 
 	yylval.token = &parserToken{Value: b.String()}
@@ -299,9 +309,7 @@ func (x *parserLex) lexString(yylval *parserSymType, quoted bool) (int, bool) {
 			// Let's check to see if we're escaping anything.
 			if c == '\\' {
 				switch n := x.next(); n {
-				case '\\':
-					fallthrough
-				case '"':
+				case '\\', '"':
 					c = n
 				case 'n':
 					c = '\n'
diff --git a/config/lang/parse_test.go b/config/lang/parse_test.go
index d2671e233..8d705dccb 100644
--- a/config/lang/parse_test.go
+++ b/config/lang/parse_test.go
@@ -183,6 +183,41 @@ func TestParse(t *testing.T) {
 			},
 		},
 
+		{
+			"foo ${var.bar*1} baz",
+			false,
+			&ast.Concat{
+				Posx: ast.Pos{Column: 1, Line: 1},
+				Exprs: []ast.Node{
+					&ast.LiteralNode{
+						Value: "foo ",
+						Typex: ast.TypeString,
+						Posx:  ast.Pos{Column: 1, Line: 1},
+					},
+					&ast.Arithmetic{
+						Op: ast.ArithmeticOpMul,
+						Exprs: []ast.Node{
+							&ast.VariableAccess{
+								Name: "var.bar",
+								Posx: ast.Pos{Column: 7, Line: 1},
+							},
+							&ast.LiteralNode{
+								Value: 1,
+								Typex: ast.TypeInt,
+								Posx:  ast.Pos{Column: 15, Line: 1},
+							},
+						},
+						Posx: ast.Pos{Column: 7, Line: 1},
+					},
+					&ast.LiteralNode{
+						Value: " baz",
+						Typex: ast.TypeString,
+						Posx:  ast.Pos{Column: 17, Line: 1},
+					},
+				},
+			},
+		},
+
 		{
 			"${foo()}",
 			false,
diff --git a/config/loader.go b/config/loader.go
index 1848f314d..4f5d8e765 100644
--- a/config/loader.go
+++ b/config/loader.go
@@ -1,19 +1,41 @@
 package config
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"sort"
 	"strings"
+
+	"github.com/hashicorp/hcl"
 )
 
-// Load loads the Terraform configuration from a given file.
+// LoadJSON loads a single Terraform configuration from a given JSON document.
+//
+// The document must be a complete Terraform configuration. This function will
+// NOT try to load any additional modules so only the given document is loaded.
+func LoadJSON(raw json.RawMessage) (*Config, error) {
+	obj, err := hcl.Parse(string(raw))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"Error parsing JSON document as HCL: %s", err)
+	}
+
+	// Start building the result
+	hclConfig := &hclConfigurable{
+		Object: obj,
+	}
+
+	return hclConfig.Config()
+}
+
+// LoadFile loads the Terraform configuration from a given file.
 //
 // This file can be any format that Terraform recognizes, and import any
 // other format that Terraform recognizes.
-func Load(path string) (*Config, error) {
+func LoadFile(path string) (*Config, error) {
 	importTree, err := loadTree(path)
 	if err != nil {
 		return nil, err
@@ -66,7 +88,7 @@ func LoadDir(root string) (*Config, error) {
 
 	// Load all the regular files, append them to each other.
 	for _, f := range files {
-		c, err := Load(f)
+		c, err := LoadFile(f)
 		if err != nil {
 			return nil, err
 		}
@@ -83,7 +105,7 @@ func LoadDir(root string) (*Config, error) {
 
 	// Load all the overrides, and merge them into the config
 	for _, f := range overrides {
-		c, err := Load(f)
+		c, err := LoadFile(f)
 		if err != nil {
 			return nil, err
 		}
diff --git a/config/loader_hcl.go b/config/loader_hcl.go
index 6f4fa8edd..b20900bfb 100644
--- a/config/loader_hcl.go
+++ b/config/loader_hcl.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/hashicorp/hcl"
 	hclobj "github.com/hashicorp/hcl/hcl"
+	"github.com/mitchellh/mapstructure"
 )
 
 // hclConfigurable is an implementation of configurable that knows
@@ -521,8 +522,16 @@ func loadResourcesHcl(os *hclobj.Object) ([]*Resource, error) {
 			// destroying the existing instance
 			var lifecycle ResourceLifecycle
 			if o := obj.Get("lifecycle", false); o != nil {
-				err = hcl.DecodeObject(&lifecycle, o)
-				if err != nil {
+				var raw map[string]interface{}
+				if err = hcl.DecodeObject(&raw, o); err != nil {
+					return nil, fmt.Errorf(
+						"Error parsing lifecycle for %s[%s]: %s",
+						t.Key,
+						k,
+						err)
+				}
+
+				if err := mapstructure.WeakDecode(raw, &lifecycle); err != nil {
 					return nil, fmt.Errorf(
 						"Error parsing lifecycle for %s[%s]: %s",
 						t.Key,
diff --git a/config/loader_test.go b/config/loader_test.go
index d487638e9..d239bd0b9 100644
--- a/config/loader_test.go
+++ b/config/loader_test.go
@@ -1,6 +1,7 @@
 package config
 
 import (
+	"io/ioutil"
 	"path/filepath"
 	"reflect"
 	"strings"
@@ -37,15 +38,15 @@ func TestIsEmptyDir_noConfigs(t *testing.T) {
 	}
 }
 
-func TestLoad_badType(t *testing.T) {
-	_, err := Load(filepath.Join(fixtureDir, "bad_type.tf.nope"))
+func TestLoadFile_badType(t *testing.T) {
+	_, err := LoadFile(filepath.Join(fixtureDir, "bad_type.tf.nope"))
 	if err == nil {
 		t.Fatal("should have error")
 	}
 }
 
-func TestLoadBasic(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "basic.tf"))
+func TestLoadFileBasic(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "basic.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -84,8 +85,8 @@ func TestLoadBasic(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_empty(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "empty.tf"))
+func TestLoadFileBasic_empty(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "empty.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -95,11 +96,11 @@ func TestLoadBasic_empty(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_import(t *testing.T) {
+func TestLoadFileBasic_import(t *testing.T) {
 	// Skip because we disabled importing
 	t.Skip()
 
-	c, err := Load(filepath.Join(fixtureDir, "import.tf"))
+	c, err := LoadFile(filepath.Join(fixtureDir, "import.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -124,8 +125,8 @@ func TestLoadBasic_import(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_json(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "basic.tf.json"))
+func TestLoadFileBasic_json(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "basic.tf.json"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -164,8 +165,8 @@ func TestLoadBasic_json(t *testing.T) {
 	}
 }
 
-func TestLoadBasic_modules(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "modules.tf"))
+func TestLoadFileBasic_modules(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "modules.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -184,8 +185,53 @@ func TestLoadBasic_modules(t *testing.T) {
 	}
 }
 
-func TestLoad_variables(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "variables.tf"))
+func TestLoadJSONBasic(t *testing.T) {
+	raw, err := ioutil.ReadFile(filepath.Join(fixtureDir, "basic.tf.json"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	c, err := LoadJSON(raw)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if c == nil {
+		t.Fatal("config should not be nil")
+	}
+
+	if c.Dir != "" {
+		t.Fatalf("bad: %#v", c.Dir)
+	}
+
+	expectedAtlas := &AtlasConfig{Name: "mitchellh/foo"}
+	if !reflect.DeepEqual(c.Atlas, expectedAtlas) {
+		t.Fatalf("bad: %#v", c.Atlas)
+	}
+
+	actual := variablesStr(c.Variables)
+	if actual != strings.TrimSpace(basicVariablesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = providerConfigsStr(c.ProviderConfigs)
+	if actual != strings.TrimSpace(basicProvidersStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = resourcesStr(c.Resources)
+	if actual != strings.TrimSpace(basicResourcesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	actual = outputsStr(c.Outputs)
+	if actual != strings.TrimSpace(basicOutputsStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
+func TestLoadFile_variables(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "variables.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -303,8 +349,8 @@ func TestLoadDir_override(t *testing.T) {
 	}
 }
 
-func TestLoad_provisioners(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "provisioners.tf"))
+func TestLoadFile_provisioners(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "provisioners.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -319,8 +365,8 @@ func TestLoad_provisioners(t *testing.T) {
 	}
 }
 
-func TestLoad_connections(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "connection.tf"))
+func TestLoadFile_connections(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "connection.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -357,8 +403,8 @@ func TestLoad_connections(t *testing.T) {
 	}
 }
 
-func TestLoad_createBeforeDestroy(t *testing.T) {
-	c, err := Load(filepath.Join(fixtureDir, "create-before-destroy.tf"))
+func TestLoadFile_createBeforeDestroy(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "create-before-destroy.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -394,6 +440,43 @@ func TestLoad_createBeforeDestroy(t *testing.T) {
 	}
 }
 
+func TestLoad_preventDestroyString(t *testing.T) {
+	c, err := LoadFile(filepath.Join(fixtureDir, "prevent-destroy-string.tf"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if c == nil {
+		t.Fatal("config should not be nil")
+	}
+
+	actual := resourcesStr(c.Resources)
+	if actual != strings.TrimSpace(createBeforeDestroyResourcesStr) {
+		t.Fatalf("bad:\n%s", actual)
+	}
+
+	// Check for the flag value
+	r := c.Resources[0]
+	if r.Name != "web" && r.Type != "aws_instance" {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	// Should enable create before destroy
+	if !r.Lifecycle.PreventDestroy {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	r = c.Resources[1]
+	if r.Name != "bar" && r.Type != "aws_instance" {
+		t.Fatalf("Bad: %#v", r)
+	}
+
+	// Should not enable create before destroy
+	if r.Lifecycle.PreventDestroy {
+		t.Fatalf("Bad: %#v", r)
+	}
+}
+
 func TestLoad_temporary_files(t *testing.T) {
 	_, err := LoadDir(filepath.Join(fixtureDir, "dir-temporary-files"))
 	if err == nil {
diff --git a/config/raw_config.go b/config/raw_config.go
index d51578e0b..ebb9f18dc 100644
--- a/config/raw_config.go
+++ b/config/raw_config.go
@@ -304,6 +304,8 @@ func langEvalConfig(vs map[string]ast.Variable) *lang.EvalConfig {
 		funcMap[k] = v
 	}
 	funcMap["lookup"] = interpolationFuncLookup(vs)
+	funcMap["keys"] = interpolationFuncKeys(vs)
+	funcMap["values"] = interpolationFuncValues(vs)
 
 	return &lang.EvalConfig{
 		GlobalScope: &ast.BasicScope{
diff --git a/config/string_list.go b/config/string_list.go
new file mode 100644
index 000000000..70d43d1e4
--- /dev/null
+++ b/config/string_list.go
@@ -0,0 +1,76 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+// StringList represents the "poor man's list" that terraform uses
+// internally
+type StringList string
+
+// This is the delimiter used to recognize and split StringLists
+//
+// It plays two semantic roles:
+//   * It introduces a list
+//   * It terminates each element
+//
+// Example representations:
+// []             => SLD
+// [""]           => SLDSLD
+// [" "]          => SLD SLD
+// ["foo"]        => SLDfooSLD
+// ["foo", "bar"] => SLDfooSLDbarSLD
+// ["", ""]       => SLDSLDSLD
+const stringListDelim = `B780FFEC-B661-4EB8-9236-A01737AD98B6`
+
+// Build a StringList from a slice
+func NewStringList(parts []string) StringList {
+	// We have to special case the empty list representation
+	if len(parts) == 0 {
+		return StringList(stringListDelim)
+	}
+	return StringList(fmt.Sprintf("%s%s%s",
+		stringListDelim,
+		strings.Join(parts, stringListDelim),
+		stringListDelim,
+	))
+}
+
+// Returns an element at the index, wrapping around the length of the string
+// when index > list length
+func (sl StringList) Element(index int) string {
+	if sl.Length() == 0 {
+		return ""
+	}
+	return sl.Slice()[index%sl.Length()]
+}
+
+// Returns the length of the StringList
+func (sl StringList) Length() int {
+	return len(sl.Slice())
+}
+
+// Returns a slice of strings as represented by this StringList
+func (sl StringList) Slice() []string {
+	parts := strings.Split(string(sl), stringListDelim)
+
+	switch len(parts) {
+	case 0, 1:
+		return []string{}
+	case 2:
+		return []string{""}
+	}
+
+	// strip empty elements generated by leading and trailing delimiters
+	return parts[1 : len(parts)-1]
+}
+
+func (sl StringList) String() string {
+	return string(sl)
+}
+
+// Determines if a given string represents a StringList
+func IsStringList(s string) bool {
+	return strings.Contains(s, stringListDelim)
+}
diff --git a/config/test-fixtures/prevent-destroy-string.tf b/config/test-fixtures/prevent-destroy-string.tf
new file mode 100644
index 000000000..c5e253a14
--- /dev/null
+++ b/config/test-fixtures/prevent-destroy-string.tf
@@ -0,0 +1,10 @@
+resource "aws_instance" "web" {
+    ami = "foo"
+    lifecycle {
+        prevent_destroy = "true"
+    }
+}
+
+resource "aws_instance" "bar" {
+    ami = "foo"
+}
diff --git a/contrib/zsh-completion/_terraform b/contrib/zsh-completion/_terraform
index 0b3fa55b0..1252bb961 100644
--- a/contrib/zsh-completion/_terraform
+++ b/contrib/zsh-completion/_terraform
@@ -13,7 +13,7 @@ _terraform_cmds=(
     'push:Uploads the local state to the remote server'
     'refresh:Update local state file against real resources'
     'remote:Configures remote state management'
-    'taint:Manualy forcing a destroy and recreate on the next plan/apply'
+    'taint:Manually forcing a destroy and recreate on the next plan/apply'
     'show:Inspect Terraform state or plan'
     'version:Prints the Terraform version'
 )
@@ -82,7 +82,7 @@ __plan() {
 
 __push() {
     _arguments \
-        '-force[Forces the upload of the local state, ignoring any conflits. This should be used carefully, as force pushing can cause remote state information to be lost.]'
+        '-force[Forces the upload of the local state, ignoring any conflicts. This should be used carefully, as force pushing can cause remote state information to be lost.]'
 }
 
 __refresh() {
diff --git a/deps/v0-5-3.json b/deps/v0-5-3.json
new file mode 100644
index 000000000..09fe5c60f
--- /dev/null
+++ b/deps/v0-5-3.json
@@ -0,0 +1,301 @@
+{
+	"ImportPath": "github.com/hashicorp/terraform",
+	"GoVersion": "go1.4.2",
+	"Deps": [
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/aws",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/apierr",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/endpoints",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/query",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/rest",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/restxml",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/protocol/xml/xmlutil",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/internal/signer/v4",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/awslabs/aws-sdk-go/service/s3",
+			"Rev": "43d7c58d0a71c01d98b7881cb9f90047f04f4acd"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/archive",
+			"Comment": "20141209094003-60-g6a87d5f",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go/v1",
+			"Comment": "20141209094003-60-g6a87d5f",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/consul/api",
+			"Comment": "v0.5.2-33-g0aea1f0",
+			"Rev": "0aea1f06a1662dd392d3c8e8240cb4cc662e2e65"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/errwrap",
+			"Rev": "7554cd9344cec97297fa6649b055a8c98c2a1e55"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-checkpoint",
+			"Rev": "88326f6851319068e7b34981032128c0b1a6524d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-multierror",
+			"Rev": "fcdddc395df1ddf4247c69bd436e84cfa0733f7e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-version",
+			"Rev": "999359b6b7a041ce16e695d51e92145b83f01087"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/hcl",
+			"Rev": "513e04c400ee2e81e97f5e011c08fb42c6f69b84"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/yamux",
+			"Rev": "b2e55852ddaf823a85c67f798080eb7d08acd71d"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/cli",
+			"Rev": "76e2780bc4f71797e1ce037ac0b43b7c99b31749"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/colorstring",
+			"Rev": "61164e49940b423ba1f12ddbdf01632ac793e5e9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/copystructure",
+			"Rev": "6fc66267e9da7d155a9d3bd489e00dad02666dc6"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-homedir",
+			"Rev": "1f6da4a72e57d4e7edd4a7295a585e0a3999a2d4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "bb4fbaf540ca2f7057d3adb5765784d24d9fd801"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/panicwrap",
+			"Rev": "45cbfd3bae250c7676c077fb275be1a2968e066a"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/prefixedio",
+			"Rev": "89d9b535996bf0a185f85b59578f2e245f9e1724"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/reflectwalk",
+			"Rev": "eecf4c70c626c7cfbb95c90195bc34d386c74ac6"
+		},
+		{
+			"ImportPath": "github.com/vaughan0/go-ini",
+			"Rev": "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/ssh/terminal",
+			"Rev": "c10c31b5e94b6f7a0283272dc2bb27163dcea24b"
+		},
+		{
+			"ImportPath": "github.com/Sirupsen/logrus",
+			"Rev": "52919f182f9c314f8a38c5afe96506f73d02b4b2"
+		},
+		{
+			"ImportPath": "github.com/armon/circbuf",
+			"Rev": "f092b4f207b6e5cce0569056fba9e1a2735cb6cf"
+		},
+		{
+			"ImportPath": "github.com/cyberdelia/heroku-go",
+			"Rev": "594d483b9b6a8ddc7cd2f1e3e7d1de92fa2de665"
+		},
+		{
+			"ImportPath": "github.com/docker/docker",
+			"Rev": "42cfc95549728014811cc9aa2c5b07bdf5553a54"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/iso8601",
+			"Rev": "2075bf119b58e5576c6ed9f867b8f3d17f2e54d4"
+		},
+		{
+			"ImportPath": "github.com/dylanmei/winrmtest",
+			"Rev": "3e9661c52c45dab9a8528966a23d421922fca9b9"
+		},
+		{
+			"ImportPath": "github.com/fsouza/go-dockerclient",
+			"Rev": "f90594a4da6a7cbdaedd29ee5495ddd6b39fe5d3"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/atlas-go",
+			"Rev": "6a87d5f443991e9916104392cd5fc77678843e1d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/aws-sdk-go",
+			"Rev": "e6ea0192eee4640f32ec73c0cbb71f63e4f2b65a"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/consul",
+			"Rev": "9417fd37686241d65918208874a7faa4d0cd92d2"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/errwrap",
+			"Rev": "7554cd9344cec97297fa6649b055a8c98c2a1e55"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-checkpoint",
+			"Rev": "88326f6851319068e7b34981032128c0b1a6524d"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-multierror",
+			"Rev": "fcdddc395df1ddf4247c69bd436e84cfa0733f7e"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/go-version",
+			"Rev": "999359b6b7a041ce16e695d51e92145b83f01087"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/hcl",
+			"Rev": "513e04c400ee2e81e97f5e011c08fb42c6f69b84"
+		},
+		{
+			"ImportPath": "github.com/hashicorp/yamux",
+			"Rev": "b2e55852ddaf823a85c67f798080eb7d08acd71d"
+		},
+		{
+			"ImportPath": "github.com/imdario/mergo",
+			"Rev": "2fcac9923693d66dc0e03988a31b21da05cdea84"
+		},
+		{
+			"ImportPath": "github.com/masterzen/simplexml",
+			"Rev": "95ba30457eb1121fa27753627c774c7cd4e90083"
+		},
+		{
+			"ImportPath": "github.com/masterzen/winrm",
+			"Rev": "132339029dfa67fd39ff8edeed2af78f2cca4fbb"
+		},
+		{
+			"ImportPath": "github.com/masterzen/xmlpath",
+			"Rev": "13f4951698adc0fa9c1dda3e275d489a24201161"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/cli",
+			"Rev": "6cc8bc522243675a2882b81662b0b0d2e04b99c9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/colorstring",
+			"Rev": "61164e49940b423ba1f12ddbdf01632ac793e5e9"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/copystructure",
+			"Rev": "6fc66267e9da7d155a9d3bd489e00dad02666dc6"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-homedir",
+			"Rev": "1f6da4a72e57d4e7edd4a7295a585e0a3999a2d4"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/gox",
+			"Rev": "e8e6fd4fe12510cc46893dff18c5188a6a6dc549"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/iochan",
+			"Rev": "b584a329b193e206025682ae6c10cdbe03b0cd77"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/go-linereader",
+			"Rev": "07bab5fdd9580500aea6ada0e09df4aa28e68abd"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "442e588f213303bec7936deba67901f8fc8f18b1"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/packer",
+			"Rev": "350a5f8cad6a0e4c2b24c3049a84c4f294416e16"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/panicwrap",
+			"Rev": "45cbfd3bae250c7676c077fb275be1a2968e066a"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/prefixedio",
+			"Rev": "89d9b535996bf0a185f85b59578f2e245f9e1724"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/reflectwalk",
+			"Rev": "242be0c275dedfba00a616563e6db75ab8f279ec"
+		},
+		{
+			"ImportPath": "github.com/nu7hatch/gouuid",
+			"Rev": "179d4d0c4d8d407a32af483c2354df1d2c91e6c3"
+		},
+		{
+			"ImportPath": "github.com/packer-community/winrmcp",
+			"Rev": "650a91d1da6dc3fefa8f052289ffce648924a304"
+		},
+		{
+			"ImportPath": "github.com/pearkes/cloudflare",
+			"Rev": "19e280b056f3742e535ea12ae92a37ea7767ea82"
+		},
+		{
+			"ImportPath": "github.com/pearkes/digitalocean",
+			"Rev": "e966f00c2d9de5743e87697ab77c7278f5998914"
+		},
+		{
+			"ImportPath": "github.com/pearkes/dnsimple",
+			"Rev": "1e0c2b0eb33ca7b5632a130d6d34376a1ea46c84"
+		},
+		{
+			"ImportPath": "github.com/pearkes/mailgun",
+			"Rev": "5b02e7e9ffee9869f81393e80db138f6ff726260"
+		},
+		{
+			"ImportPath": "github.com/rackspace/gophercloud",
+			"Rev": "9ad4137a6b3e786b9c1e161b8d354b44482ab6d7"
+		},
+		{
+			"ImportPath": "github.com/satori/go.uuid",
+			"Rev": "7c7f2020c4c9491594b85767967f4619c2fa75f9"
+		},
+		{
+			"ImportPath": "github.com/soniah/dnsmadeeasy",
+			"Rev": "5578a8c15e33958c61cf7db720b6181af65f4a9e"
+		},
+		{
+			"ImportPath": "github.com/vaughan0/go-ini",
+			"Rev": "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1"
+		},
+		{
+			"ImportPath": "github.com/xanzy/go-cloudstack",
+			"Rev": "f73f6ff1b843dbdac0a01da7b7f39883adfe2bdb"
+		}
+	]
+}
diff --git a/examples/aws-asg/README.md b/examples/aws-asg/README.md
new file mode 100644
index 000000000..3dda05a87
--- /dev/null
+++ b/examples/aws-asg/README.md
@@ -0,0 +1,28 @@
+# ASG example
+
+This example shows how to launch instances using Auto Scaling Groups.
+
+This creates a security group, launch configuration, auto scaling group and an ELB. The user data for launch configuration installs nginx and it listnes on port 80.
+
+The example uses latest Ubuntu AMIs. 
+
+Make sure you change the list of availability zones that is applicable to your account and region.
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+For planning phase 
+
+terraform plan  -var 'key_name={your_key_name}}'
+
+For apply phase 
+
+terraform apply  -var 'key_name={your_key_name}}'
+
+Once the stack is created, wait for few minsutes and test the stack by launching a browser with ELB url. 
+
+To remove the stack
+
+terraform apply  -var 'key_name={your_key_name}}'
+
diff --git a/examples/aws-asg/main.tf b/examples/aws-asg/main.tf
new file mode 100644
index 000000000..6ced0aa78
--- /dev/null
+++ b/examples/aws-asg/main.tf
@@ -0,0 +1,84 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+resource "aws_elb" "web-elb" {
+  name = "terraform-example-elb"
+
+  # The same availability zone as our instances
+  availability_zones = ["${split(",", var.availability_zones)}"]
+  listener {
+    instance_port = 80
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+
+  health_check {
+    healthy_threshold = 2
+    unhealthy_threshold = 2
+    timeout = 3
+    target = "HTTP:80/"
+    interval = 30
+  }
+
+}
+
+resource "aws_autoscaling_group" "web-asg" {
+  availability_zones = ["${split(",", var.availability_zones)}"]
+  name = "terraform-example-asg"
+  max_size = "${var.asg_max}"
+  min_size = "${var.asg_min}"
+  desired_capacity = "${var.asg_desired}"
+  force_delete = true
+  launch_configuration = "${aws_launch_configuration.web-lc.name}"
+  load_balancers = ["${aws_elb.web-elb.name}"]
+  #vpc_zone_identifier = ["${split(",", var.availability_zones)}"]
+  tag {
+        key = "Name"
+        value = "web-asg"
+        propagate_at_launch = "true"
+    }
+  }
+
+resource "aws_launch_configuration" "web-lc" {
+    name = "terraform-example-lc"
+    image_id = "${lookup(var.aws_amis, var.aws_region)}"
+    instance_type = "${var.instance_type}"
+    # Security group
+    security_groups = ["${aws_security_group.default.name}"]
+    user_data = "${file("userdata.sh")}"
+    key_name = "${var.key_name}"
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "terraform_example_sg"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
diff --git a/examples/aws-asg/outputs.tf b/examples/aws-asg/outputs.tf
new file mode 100644
index 000000000..afd78f134
--- /dev/null
+++ b/examples/aws-asg/outputs.tf
@@ -0,0 +1,12 @@
+output "security_group" {
+    value = "${aws_security_group.default.id}"
+}
+output "launch_configuration" {
+    value = "${aws_launch_configuration.web-lc.id}"
+}
+output "asg_name" {
+    value = "${aws_autoscaling_group.web-asg.id}"
+}
+output "elb_name" {
+    value = "${aws_elb.web-elb.dns_name}"
+}
\ No newline at end of file
diff --git a/examples/aws-asg/userdata.sh b/examples/aws-asg/userdata.sh
new file mode 100644
index 000000000..77e340b3a
--- /dev/null
+++ b/examples/aws-asg/userdata.sh
@@ -0,0 +1,3 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
diff --git a/examples/aws-asg/variables.tf b/examples/aws-asg/variables.tf
new file mode 100644
index 000000000..b51450911
--- /dev/null
+++ b/examples/aws-asg/variables.tf
@@ -0,0 +1,42 @@
+variable "aws_region" {
+    description = "The AWS region to create things in."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
+variable "availability_zones" {
+	default = "us-east-1b,us-east-1c,us-east-1d,us-east-1e"
+    description = "List of availability zones, use AWS CLI to find your "
+}
+
+variable "key_name" {
+    description = "Name of AWS key pair"
+}
+
+variable "instance_type" {
+    default = "t2.micro"
+    description = "AWS instance type"
+}
+
+variable "asg_min" {
+    description = "Min numbers of servers in ASG"
+    default = "1"
+}
+
+variable "asg_max" {
+    description = "Max numbers of servers in ASG"
+    default = "2"
+}
+
+variable "asg_desired" {
+    description = "Desired numbers of servers in ASG"
+    default = "1"
+}
+
diff --git a/examples/aws-count/README.md b/examples/aws-count/README.md
index a2703f59d..102841b94 100644
--- a/examples/aws-count/README.md
+++ b/examples/aws-count/README.md
@@ -6,5 +6,8 @@ and let you scale resources by simply incrementing a number.
 Additionally, variables can be used to expand a list of resources
 for use elsewhere.
 
-As with all examples, just copy and paste the example and run
-`terraform apply` to see it work.
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply` to see it work.
diff --git a/examples/aws-eip/README.md b/examples/aws-eip/README.md
new file mode 100644
index 000000000..7839f019c
--- /dev/null
+++ b/examples/aws-eip/README.md
@@ -0,0 +1,11 @@
+# Elastic IP Example
+
+The eip example launches a web server, installs nginx. It also creates security group 
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply -var 'key_name={your_key_name}}'` 
+
+Give couple of mins for userdata to insatll nginx, and then type the Elastic IP from outputs in your browser and see the nginx welcome page
diff --git a/examples/aws-eip/main.tf b/examples/aws-eip/main.tf
new file mode 100644
index 000000000..62757a6fe
--- /dev/null
+++ b/examples/aws-eip/main.tf
@@ -0,0 +1,69 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+resource "aws_eip" "default" {
+    instance = "${aws_instance.web.id}"
+    vpc = true
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "eip_example"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
+
+
+resource "aws_instance" "web" {
+  instance_type = "t2.micro"
+
+  # Lookup the correct AMI based on the region
+  # we specified
+  ami = "${lookup(var.aws_amis, var.aws_region)}"
+
+  # The name of our SSH keypair you've created and downloaded
+  # from the AWS console.
+  #
+  # https://console.aws.amazon.com/ec2/v2/home?region=us-west-2#KeyPairs:
+  #
+  key_name = "${var.key_name}"
+
+  # Our Security group to allow HTTP and SSH access
+  security_groups = ["${aws_security_group.default.name}"]
+
+  # We run a remote provisioner on the instance after creating it.
+  # In this case, we just install nginx and start it. By default,
+  # this should be on port 80
+  user_data = "${file("userdata.sh")}"
+  #Instance tags
+    tags {
+        Name = "eip-example"
+    }
+}
+
diff --git a/examples/aws-eip/outputs.tf b/examples/aws-eip/outputs.tf
new file mode 100644
index 000000000..1660431b6
--- /dev/null
+++ b/examples/aws-eip/outputs.tf
@@ -0,0 +1,6 @@
+output "address" {
+  value = "${aws_instance.web.private_ip}"
+}
+output "elastic ip" {
+  value = "${aws_eip.default.public_ip}"
+}
diff --git a/examples/aws-eip/userdata.sh b/examples/aws-eip/userdata.sh
new file mode 100644
index 000000000..8a058c786
--- /dev/null
+++ b/examples/aws-eip/userdata.sh
@@ -0,0 +1,4 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
+
diff --git a/examples/aws-eip/variables.tf b/examples/aws-eip/variables.tf
new file mode 100644
index 000000000..d1f0d0d6c
--- /dev/null
+++ b/examples/aws-eip/variables.tf
@@ -0,0 +1,17 @@
+variable "aws_region" {
+    description = "The AWS region to create things in."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
+variable "key_name" {
+    description = "Name of the SSH keypair to use in AWS."
+}
+
diff --git a/examples/aws-elb/README.md b/examples/aws-elb/README.md
new file mode 100644
index 000000000..0f7db18cc
--- /dev/null
+++ b/examples/aws-elb/README.md
@@ -0,0 +1,11 @@
+# ELB with stickiness Example
+
+The example launches a web server, installs nginx, creates an ELB for isnatnce. It also creates security groups for elb/instance 
+
+To run, configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+Running the example
+
+run `terraform apply -var 'key_name={your_key_name}}'` 
+
+Give couple of mins for userdata to insatll nginx, and then type the ELB DNS Name from outputs in your browser and see the nginx welcome page
diff --git a/examples/aws-elb/main.tf b/examples/aws-elb/main.tf
new file mode 100644
index 000000000..6542a91ef
--- /dev/null
+++ b/examples/aws-elb/main.tf
@@ -0,0 +1,123 @@
+# Specify the provider and access details
+provider "aws" {
+    region = "${var.aws_region}"
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+    name = "instance_sg"
+    description = "Used in the terraform"
+
+    # SSH access from anywhere
+    ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+}
+
+# Our elb security group to access
+# the ELB over HTTP
+resource "aws_security_group" "elb" {
+    name = "elb_sg"
+    description = "Used in the terraform"
+
+    # HTTP access from anywhere
+    ingress {
+        from_port = 80
+        to_port = 80
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
+  
+}
+
+
+resource "aws_elb" "web" {
+  name = "example-elb"
+
+  # The same availability zone as our instance
+  availability_zones = ["${aws_instance.web.availability_zone}"]
+  security_groups = ["${aws_security_group.elb.id}"]
+  listener {
+    instance_port = 80
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+
+  health_check {
+    healthy_threshold = 2
+    unhealthy_threshold = 2
+    timeout = 3
+    target = "HTTP:80/"
+    interval = 30
+  }  
+
+  # The instance is registered automatically
+  instances = ["${aws_instance.web.id}"]
+
+  cross_zone_load_balancing = true
+  idle_timeout = 400
+  connection_draining = true
+  connection_draining_timeout = 400
+
+}
+
+resource "aws_lb_cookie_stickiness_policy" "default" {
+      name = "lbpolicy"
+      load_balancer = "${aws_elb.web.id}"
+      lb_port = 80
+      cookie_expiration_period = 600
+}
+
+resource "aws_instance" "web" {
+  
+  instance_type = "t2.micro"
+
+  # Lookup the correct AMI based on the region
+  # we specified
+  ami = "${lookup(var.aws_amis, var.aws_region)}"
+
+  # The name of our SSH keypair you've created and downloaded
+  # from the AWS console.
+  #
+  # https://console.aws.amazon.com/ec2/v2/home?region=us-west-2#KeyPairs:
+  #
+  key_name = "${var.key_name}"
+
+  # Our Security group to allow HTTP and SSH access
+  security_groups = ["${aws_security_group.default.name}"]
+
+  user_data = "${file("userdata.sh")}"
+  #Instance tags
+    tags {
+        Name = "elb-example"
+    }
+}
diff --git a/examples/aws-elb/outputs.tf b/examples/aws-elb/outputs.tf
new file mode 100644
index 000000000..5977837f3
--- /dev/null
+++ b/examples/aws-elb/outputs.tf
@@ -0,0 +1,3 @@
+output "address" {
+  value = "${aws_elb.web.dns_name}"
+}
diff --git a/examples/aws-elb/userdata.sh b/examples/aws-elb/userdata.sh
new file mode 100644
index 000000000..8a058c786
--- /dev/null
+++ b/examples/aws-elb/userdata.sh
@@ -0,0 +1,4 @@
+#!/bin/bash -v
+apt-get update -y
+apt-get install -y nginx > /tmp/nginx.log
+
diff --git a/examples/aws-elb/variables.tf b/examples/aws-elb/variables.tf
new file mode 100644
index 000000000..150ffa36c
--- /dev/null
+++ b/examples/aws-elb/variables.tf
@@ -0,0 +1,17 @@
+variable "key_name" {
+    description = "Name of the SSH keypair to use in AWS."
+}
+
+variable "aws_region" {
+    description = "AWS region to launch servers."
+    default = "us-east-1"
+}
+
+# ubuntu-trusty-14.04 (x64)
+variable "aws_amis" {
+    default = {
+        "us-east-1" = "ami-5f709f34"
+        "us-west-2" = "ami-7f675e4f"
+    }
+}
+
diff --git a/examples/aws-rds/README.md b/examples/aws-rds/README.md
new file mode 100644
index 000000000..dfc8e3746
--- /dev/null
+++ b/examples/aws-rds/README.md
@@ -0,0 +1,17 @@
+## Creating an RDS instance in AWS
+
+This example provides sample configuration for creating a mysql or postgres insatnce. For Oracle/SQL Servers, replace default values with appropriate values, they are not included in sample since the number of options are high.
+
+The example creates db subnet groups and a VPC security group as inputs to the instance creation
+
+For AWS provider, set up your AWS environment as outlined in https://www.terraform.io/docs/providers/aws/index.html
+
+If you need to use existing security groups and subnets, remove the sg.tf and subnets.tf files and replace the corresponidng sections in main.tf under aws_db_instance
+
+Pass the password variable through your ENV variable.
+
+Several paraneters are externalized, review the different variables.tf files and change them to fit your needs. Carefully review the CIDR blocks, egress/ingress rules, availability zones that are very specific to your account.
+
+Once ready run 'terraform plan' to review. At the minimum, provide the vpc_id as input variable.
+
+Once satisfied with plan, run 'terraform apply'  
diff --git a/examples/aws-rds/main.tf b/examples/aws-rds/main.tf
new file mode 100644
index 000000000..d292a38af
--- /dev/null
+++ b/examples/aws-rds/main.tf
@@ -0,0 +1,19 @@
+resource "aws_db_instance" "default" {
+    depends_on = "aws_security_group.default"
+    identifier = "${var.identifier}"
+    allocated_storage = "${var.storage}"
+    engine = "${var.engine}"
+    engine_version = "${lookup(var.engine_version, var.engine)}"
+    instance_class = "${var.instance_class}"
+    name = "${var.db_name}"
+    username = "${var.username}"
+    password = "${var.password}"
+    vpc_security_group_ids = ["${aws_security_group.default.id}"]
+    db_subnet_group_name = "${aws_db_subnet_group.default.id}"
+}
+
+resource "aws_db_subnet_group" "default" {
+    name = "main_subnet_group"
+    description = "Our main group of subnets"
+    subnet_ids = ["${aws_subnet.subnet_1.id}", "${aws_subnet.subnet_2.id}"]
+}
diff --git a/examples/aws-rds/outputs.tf b/examples/aws-rds/outputs.tf
new file mode 100644
index 000000000..1bf2b0cb8
--- /dev/null
+++ b/examples/aws-rds/outputs.tf
@@ -0,0 +1,10 @@
+output "subnet_group" {
+    value = "${aws_db_subnet_group.default.name}"
+}
+output "db_instance_id" {
+    value = "${aws_db_instance.default.id}"
+}
+output "db_instance_address" {
+    value = "${aws_db_instance.default.address}"
+}
+
diff --git a/examples/aws-rds/sg-variables.tf b/examples/aws-rds/sg-variables.tf
new file mode 100644
index 000000000..a1fefe413
--- /dev/null
+++ b/examples/aws-rds/sg-variables.tf
@@ -0,0 +1,10 @@
+variable "cidr_blocks" {
+	default = "0.0.0.0/0"
+    description = "CIDR for sg"
+}
+
+variable "sg_name" {
+	default = "rds_sg"
+    description = "Tag Name for sg"
+}
+
diff --git a/examples/aws-rds/sg.tf b/examples/aws-rds/sg.tf
new file mode 100644
index 000000000..c55b0799d
--- /dev/null
+++ b/examples/aws-rds/sg.tf
@@ -0,0 +1,23 @@
+resource "aws_security_group" "default" {
+  name = "main_rds_sg"
+  description = "Allow all inbound traffic"
+  vpc_id = "${var.vpc_id}"
+
+  ingress {
+      from_port = 0
+      to_port = 65535
+      protocol = "TCP"
+      cidr_blocks = ["${var.cidr_blocks}"]
+  }
+
+  egress {
+      from_port = 0
+      to_port = 0
+      protocol = "-1"
+      cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags {
+    Name = "${var.sg_name}"
+  }
+}
diff --git a/examples/aws-rds/subnet-variables.tf b/examples/aws-rds/subnet-variables.tf
new file mode 100644
index 000000000..35c695088
--- /dev/null
+++ b/examples/aws-rds/subnet-variables.tf
@@ -0,0 +1,24 @@
+variable "subnet_1_cidr" {
+	default = "10.0.1.0/24"
+    description = "Your AZ"
+}
+
+variable "subnet_2_cidr" {
+	default = "10.0.2.0/24"
+    description = "Your AZ"
+}
+
+variable "az_1" {
+	default = "us-east-1b"
+    description = "Your Az1, use AWS CLI to find your account specific"
+}
+
+variable "az_2" {
+	default = "us-east-1c"
+    description = "Your Az2, use AWS CLI to find your account specific"
+}
+
+variable "vpc_id" {
+    description = "Your VPC ID"
+}
+
diff --git a/examples/aws-rds/subnets.tf b/examples/aws-rds/subnets.tf
new file mode 100644
index 000000000..5de7d0d82
--- /dev/null
+++ b/examples/aws-rds/subnets.tf
@@ -0,0 +1,19 @@
+resource "aws_subnet" "subnet_1" {
+    vpc_id = "${var.vpc_id}"
+    cidr_block = "${var.subnet_1_cidr}"
+    availability_zone = "${var.az_1}"
+
+    tags {
+        Name = "main_subnet1"
+    }
+}
+
+resource "aws_subnet" "subnet_2" {
+    vpc_id = "${var.vpc_id}"
+    cidr_block = "${var.subnet_2_cidr}"
+    availability_zone = "${var.az_2}"
+
+    tags {
+        Name = "main_subnet2"
+    }
+}
diff --git a/examples/aws-rds/variables.tf b/examples/aws-rds/variables.tf
new file mode 100644
index 000000000..ad3156b1b
--- /dev/null
+++ b/examples/aws-rds/variables.tf
@@ -0,0 +1,41 @@
+variable "identifier" {
+	default = "mydb-rds"
+    description = "Identifier for your DB"
+}
+
+variable "storage" {
+	default = "10"
+    description = "Storage size in GB"
+}
+
+variable "engine" {
+	default = "postgres"
+    description = "Engine type, example values mysql, postgres"
+}
+
+variable "engine_version" {
+    description = "Engine version"
+    default = {
+        mysql = "5.6.22"
+        postgres = "9.4.1"
+    }
+}
+
+variable "instance_class" {
+	default = "db.t2.micro"
+    description = "Instance class"
+}
+
+variable "db_name" {
+	default = "mydb"
+    description = "db name"
+}
+
+variable "username" {
+	default = "myuser"
+    description = "User name"
+}
+
+variable "password" {
+    description = "password, provide through your ENV variables"
+}
diff --git a/examples/aws-two-tier/README.md b/examples/aws-two-tier/README.md
index 8a5ad61a3..dcdf7d1c4 100644
--- a/examples/aws-two-tier/README.md
+++ b/examples/aws-two-tier/README.md
@@ -14,5 +14,19 @@ After you run `terraform apply` on this configuration, it will
 automatically output the DNS address of the ELB. After your instance
 registers, this should respond with the default nginx web page.
 
-As with all examples, just copy and paste the example and run
-`terraform apply` to see it work.
+To run, configure your AWS provider as described in 
+
+https://www.terraform.io/docs/providers/aws/index.html
+
+Run with a command like this:
+
+```
+terraform apply -var 'key_name={your_aws_key_name}' \
+   -var 'key_path={location_of_your_key_in_your_local_machine}'` 
+```
+
+For example:
+
+```
+terraform apply -var 'key_name=terraform' -var 'key_path=/Users/jsmith/.ssh/terraform.pem'
+```
diff --git a/examples/aws-two-tier/main.tf b/examples/aws-two-tier/main.tf
index b06bf8f80..2a8957e66 100644
--- a/examples/aws-two-tier/main.tf
+++ b/examples/aws-two-tier/main.tf
@@ -24,6 +24,14 @@ resource "aws_security_group" "default" {
         protocol = "tcp"
         cidr_blocks = ["0.0.0.0/0"]
     }
+
+    # outbound internet access
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = "-1"
+        cidr_blocks = ["0.0.0.0/0"]
+    }
 }
 
 
diff --git a/helper/resource/testing.go b/helper/resource/testing.go
index 6832146b2..3835e8639 100644
--- a/helper/resource/testing.go
+++ b/helper/resource/testing.go
@@ -60,6 +60,10 @@ type TestCase struct {
 // potentially complex update logic. In general, simply create/destroy
 // tests will only need one step.
 type TestStep struct {
+	// PreConfig is called before the Config is applied to perform any per-step
+	// setup that needs to happen
+	PreConfig func()
+
 	// Config a string of the configuration to give to Terraform.
 	Config string
 
@@ -160,6 +164,10 @@ func testStep(
 	opts terraform.ContextOpts,
 	state *terraform.State,
 	step TestStep) (*terraform.State, error) {
+	if step.PreConfig != nil {
+		step.PreConfig()
+	}
+
 	cfgPath, err := ioutil.TempDir("", "tf-test")
 	if err != nil {
 		return state, fmt.Errorf(
diff --git a/helper/schema/field_reader.go b/helper/schema/field_reader.go
index cc4a1d186..fc2a1e090 100644
--- a/helper/schema/field_reader.go
+++ b/helper/schema/field_reader.go
@@ -78,19 +78,11 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
 		}
 
 		switch t := current.Type; t {
-		case TypeBool:
-			fallthrough
-		case TypeInt:
-			fallthrough
-		case TypeFloat:
-			fallthrough
-		case TypeString:
+		case TypeBool, TypeInt, TypeFloat, TypeString:
 			if len(addr) > 0 {
 				return nil
 			}
-		case TypeList:
-			fallthrough
-		case TypeSet:
+		case TypeList, TypeSet:
 			switch v := current.Elem.(type) {
 			case *Resource:
 				current = &Schema{
diff --git a/helper/schema/field_reader_config.go b/helper/schema/field_reader_config.go
index a6edef099..69b63eac7 100644
--- a/helper/schema/field_reader_config.go
+++ b/helper/schema/field_reader_config.go
@@ -80,13 +80,7 @@ func (r *ConfigFieldReader) readField(
 	k := strings.Join(address, ".")
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeFloat, TypeInt, TypeString:
 		return r.readPrimitive(k, schema)
 	case TypeList:
 		return readListField(&nestedConfigFieldReader{r}, address, schema)
diff --git a/helper/schema/field_reader_diff.go b/helper/schema/field_reader_diff.go
index bfac2a0b0..e17a6685e 100644
--- a/helper/schema/field_reader_diff.go
+++ b/helper/schema/field_reader_diff.go
@@ -39,13 +39,7 @@ func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return r.readPrimitive(address, schema)
 	case TypeList:
 		return readListField(r, address, schema)
@@ -150,7 +144,11 @@ func (r *DiffFieldReader) readSet(
 	set := &Set{F: schema.Set}
 
 	// Go through the map and find all the set items
-	for k, _ := range r.Diff.Attributes {
+	for k, d := range r.Diff.Attributes {
+		if d.NewRemoved {
+			// If the field is removed, we always ignore it
+			continue
+		}
 		if !strings.HasPrefix(k, prefix) {
 			continue
 		}
diff --git a/helper/schema/field_reader_map.go b/helper/schema/field_reader_map.go
index a4345cbcd..6dc76c474 100644
--- a/helper/schema/field_reader_map.go
+++ b/helper/schema/field_reader_map.go
@@ -21,13 +21,7 @@ func (r *MapFieldReader) ReadField(address []string) (FieldReadResult, error) {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return r.readPrimitive(address, schema)
 	case TypeList:
 		return readListField(r, address, schema)
diff --git a/helper/schema/field_writer_map.go b/helper/schema/field_writer_map.go
index 53e467650..3e9b04719 100644
--- a/helper/schema/field_writer_map.go
+++ b/helper/schema/field_writer_map.go
@@ -74,13 +74,7 @@ func (w *MapFieldWriter) set(addr []string, value interface{}) error {
 
 	schema := schemaList[len(schemaList)-1]
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		return w.setPrimitive(addr, value, schema)
 	case TypeList:
 		return w.setList(addr, value, schema)
diff --git a/helper/schema/provider.go b/helper/schema/provider.go
index 6b364e5a1..aa35d32d0 100644
--- a/helper/schema/provider.go
+++ b/helper/schema/provider.go
@@ -97,6 +97,13 @@ func (p *Provider) Input(
 
 // Validate implementation of terraform.ResourceProvider interface.
 func (p *Provider) Validate(c *terraform.ResourceConfig) ([]string, []error) {
+	if err := p.InternalValidate(); err != nil {
+		return nil, []error{fmt.Errorf(
+			"Internal validation of the provider failed! This is always a bug\n"+
+				"with the provider itself, and not a user issue. Please report\n"+
+				"this bug:\n\n%s", err)}
+	}
+
 	return schemaMap(p.Schema).Validate(c)
 }
 
diff --git a/helper/schema/provider_test.go b/helper/schema/provider_test.go
index 85eb126db..e1f4b93b0 100644
--- a/helper/schema/provider_test.go
+++ b/helper/schema/provider_test.go
@@ -117,6 +117,36 @@ func TestProviderResources(t *testing.T) {
 	}
 }
 
+func TestProviderValidate(t *testing.T) {
+	cases := []struct {
+		P      *Provider
+		Config map[string]interface{}
+		Err    bool
+	}{
+		{
+			P: &Provider{
+				Schema: map[string]*Schema{
+					"foo": &Schema{},
+				},
+			},
+			Config: nil,
+			Err:    true,
+		},
+	}
+
+	for i, tc := range cases {
+		c, err := config.NewRawConfig(tc.Config)
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		_, es := tc.P.Validate(terraform.NewResourceConfig(c))
+		if (len(es) > 0) != tc.Err {
+			t.Fatalf("%d: %#v", i, es)
+		}
+	}
+}
+
 func TestProviderValidateResource(t *testing.T) {
 	cases := []struct {
 		P      *Provider
diff --git a/helper/schema/resource_data_test.go b/helper/schema/resource_data_test.go
index e2b895b9a..95479cfbf 100644
--- a/helper/schema/resource_data_test.go
+++ b/helper/schema/resource_data_test.go
@@ -688,6 +688,50 @@ func TestResourceDataGet(t *testing.T) {
 
 			Value: 33.0,
 		},
+
+		// #23 Sets with removed elements
+		{
+			Schema: map[string]*Schema{
+				"ports": &Schema{
+					Type:     TypeSet,
+					Optional: true,
+					Computed: true,
+					Elem:     &Schema{Type: TypeInt},
+					Set: func(a interface{}) int {
+						return a.(int)
+					},
+				},
+			},
+
+			State: &terraform.InstanceState{
+				Attributes: map[string]string{
+					"ports.#":  "1",
+					"ports.80": "80",
+				},
+			},
+
+			Diff: &terraform.InstanceDiff{
+				Attributes: map[string]*terraform.ResourceAttrDiff{
+					"ports.#": &terraform.ResourceAttrDiff{
+						Old: "2",
+						New: "1",
+					},
+					"ports.80": &terraform.ResourceAttrDiff{
+						Old: "80",
+						New: "80",
+					},
+					"ports.8080": &terraform.ResourceAttrDiff{
+						Old:        "8080",
+						New:        "0",
+						NewRemoved: true,
+					},
+				},
+			},
+
+			Key: "ports",
+
+			Value: []interface{}{80},
+		},
 	}
 
 	for i, tc := range cases {
diff --git a/helper/schema/schema.go b/helper/schema/schema.go
index 67b7ba78b..ec0c8dd51 100644
--- a/helper/schema/schema.go
+++ b/helper/schema/schema.go
@@ -131,6 +131,14 @@ type Schema struct {
 	// This string is the message shown to the user with instructions on
 	// what do to about the removed attribute.
 	Removed string
+
+	// ValidateFunc allows individual fields to define arbitrary validation
+	// logic. It is yielded the provided config value as an interface{} that is
+	// guaranteed to be of the proper Schema type, and it can yield warnings or
+	// errors based on inspection of that value.
+	//
+	// ValidateFunc currently only works for primitive types.
+	ValidateFunc SchemaValidateFunc
 }
 
 // SchemaDefaultFunc is a function called to return a default value for
@@ -173,6 +181,10 @@ type SchemaSetFunc func(interface{}) int
 // to be stored in the state.
 type SchemaStateFunc func(interface{}) string
 
+// SchemaValidateFunc is a function used to validate a single field in the
+// schema.
+type SchemaValidateFunc func(interface{}, string) ([]string, []error)
+
 func (s *Schema) GoString() string {
 	return fmt.Sprintf("*%#v", *s)
 }
@@ -378,13 +390,7 @@ func (m schemaMap) Input(
 
 		var value interface{}
 		switch v.Type {
-		case TypeBool:
-			fallthrough
-		case TypeInt:
-			fallthrough
-		case TypeFloat:
-			fallthrough
-		case TypeSet:
+		case TypeBool, TypeInt, TypeFloat, TypeSet:
 			continue
 		case TypeString:
 			value, err = m.inputString(input, k, v)
@@ -509,6 +515,13 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 				}
 			}
 		}
+
+		if v.ValidateFunc != nil {
+			switch v.Type {
+			case TypeList, TypeSet, TypeMap:
+				return fmt.Errorf("ValidateFunc is only supported on primitives.")
+			}
+		}
 	}
 
 	return nil
@@ -522,13 +535,7 @@ func (m schemaMap) diff(
 	all bool) error {
 	var err error
 	switch schema.Type {
-	case TypeBool:
-		fallthrough
-	case TypeInt:
-		fallthrough
-	case TypeFloat:
-		fallthrough
-	case TypeString:
+	case TypeBool, TypeInt, TypeFloat, TypeString:
 		err = m.diffString(k, schema, diff, d, all)
 	case TypeList:
 		err = m.diffList(k, schema, diff, d, all)
@@ -835,39 +842,46 @@ func (m schemaMap) diffSet(
 		})
 	}
 
-	for _, code := range ns.listCode() {
-		// If the code is negative (first character is -) then
-		// replace it with "~" for our computed set stuff.
-		codeStr := strconv.Itoa(code)
-		if codeStr[0] == '-' {
-			codeStr = string('~') + codeStr[1:]
-		}
+	// Build the list of codes that will make up our set. This is the
+	// removed codes as well as all the codes in the new codes.
+	codes := make([][]int, 2)
+	codes[0] = os.Difference(ns).listCode()
+	codes[1] = ns.listCode()
+	for _, list := range codes {
+		for _, code := range list {
+			// If the code is negative (first character is -) then
+			// replace it with "~" for our computed set stuff.
+			codeStr := strconv.Itoa(code)
+			if codeStr[0] == '-' {
+				codeStr = string('~') + codeStr[1:]
+			}
 
-		switch t := schema.Elem.(type) {
-		case *Resource:
-			// This is a complex resource
-			for k2, schema := range t.Schema {
-				subK := fmt.Sprintf("%s.%s.%s", k, codeStr, k2)
-				err := m.diff(subK, schema, diff, d, true)
+			switch t := schema.Elem.(type) {
+			case *Resource:
+				// This is a complex resource
+				for k2, schema := range t.Schema {
+					subK := fmt.Sprintf("%s.%s.%s", k, codeStr, k2)
+					err := m.diff(subK, schema, diff, d, true)
+					if err != nil {
+						return err
+					}
+				}
+			case *Schema:
+				// Copy the schema so that we can set Computed/ForceNew from
+				// the parent schema (the TypeSet).
+				t2 := *t
+				t2.ForceNew = schema.ForceNew
+
+				// This is just a primitive element, so go through each and
+				// just diff each.
+				subK := fmt.Sprintf("%s.%s", k, codeStr)
+				err := m.diff(subK, &t2, diff, d, true)
 				if err != nil {
 					return err
 				}
+			default:
+				return fmt.Errorf("%s: unknown element type (internal)", k)
 			}
-		case *Schema:
-			// Copy the schema so that we can set Computed/ForceNew from
-			// the parent schema (the TypeSet).
-			t2 := *t
-			t2.ForceNew = schema.ForceNew
-
-			// This is just a primitive element, so go through each and
-			// just diff each.
-			subK := fmt.Sprintf("%s.%s", k, codeStr)
-			err := m.diff(subK, &t2, diff, d, true)
-			if err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("%s: unknown element type (internal)", k)
 		}
 	}
 
@@ -1089,6 +1103,13 @@ func (m schemaMap) validateObject(
 	k string,
 	schema map[string]*Schema,
 	c *terraform.ResourceConfig) ([]string, []error) {
+	raw, _ := c.GetRaw(k)
+	if _, ok := raw.(map[string]interface{}); !ok {
+		return nil, []error{fmt.Errorf(
+			"%s: expected object, got %s",
+			k, reflect.ValueOf(raw).Kind())}
+	}
+
 	var ws []string
 	var es []error
 	for subK, s := range schema {
@@ -1107,7 +1128,6 @@ func (m schemaMap) validateObject(
 	}
 
 	// Detect any extra/unknown keys and report those as errors.
-	raw, _ := c.GetRaw(k)
 	if m, ok := raw.(map[string]interface{}); ok {
 		for subk, _ := range m {
 			if _, ok := schema[subk]; !ok {
@@ -1130,6 +1150,7 @@ func (m schemaMap) validatePrimitive(
 		return nil, nil
 	}
 
+	var decoded interface{}
 	switch schema.Type {
 	case TypeBool:
 		// Verify that we can parse this as the correct type
@@ -1137,28 +1158,36 @@ func (m schemaMap) validatePrimitive(
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeInt:
 		// Verify that we can parse this as an int
 		var n int
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeFloat:
 		// Verify that we can parse this as an int
 		var n float64
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	case TypeString:
 		// Verify that we can parse this as a string
 		var n string
 		if err := mapstructure.WeakDecode(raw, &n); err != nil {
 			return nil, []error{err}
 		}
+		decoded = n
 	default:
 		panic(fmt.Sprintf("Unknown validation type: %#v", schema.Type))
 	}
 
+	if schema.ValidateFunc != nil {
+		return schema.ValidateFunc(decoded, k)
+	}
+
 	return nil, nil
 }
 
@@ -1170,9 +1199,7 @@ func (m schemaMap) validateType(
 	var ws []string
 	var es []error
 	switch schema.Type {
-	case TypeSet:
-		fallthrough
-	case TypeList:
+	case TypeSet, TypeList:
 		ws, es = m.validateList(k, raw, schema, c)
 	case TypeMap:
 		ws, es = m.validateMap(k, raw, schema, c)
diff --git a/helper/schema/schema_test.go b/helper/schema/schema_test.go
index 9a77cda2f..3f1dce669 100644
--- a/helper/schema/schema_test.go
+++ b/helper/schema/schema_test.go
@@ -582,7 +582,7 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": "2" + config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{"2", "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -626,8 +626,8 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": config.UnknownVariableValue +
-					config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{
+					config.UnknownVariableValue, "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -905,7 +905,7 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": "2" + config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{"2", "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -952,8 +952,8 @@ func TestSchemaMap_Diff(t *testing.T) {
 			},
 
 			ConfigVariables: map[string]string{
-				"var.foo": config.UnknownVariableValue +
-					config.InterpSplitDelim + "5",
+				"var.foo": config.NewStringList([]string{
+					config.UnknownVariableValue, "5"}).String(),
 			},
 
 			Diff: &terraform.InstanceDiff{
@@ -1047,6 +1047,16 @@ func TestSchemaMap_Diff(t *testing.T) {
 						Old: "2",
 						New: "0",
 					},
+					"ports.1": &terraform.ResourceAttrDiff{
+						Old:        "1",
+						New:        "0",
+						NewRemoved: true,
+					},
+					"ports.2": &terraform.ResourceAttrDiff{
+						Old:        "2",
+						New:        "0",
+						NewRemoved: true,
+					},
 				},
 			},
 
@@ -2064,6 +2074,11 @@ func TestSchemaMap_Diff(t *testing.T) {
 						New:         "0",
 						RequiresNew: true,
 					},
+					"instances.3": &terraform.ResourceAttrDiff{
+						Old:        "foo",
+						New:        "",
+						NewRemoved: true,
+					},
 				},
 			},
 
@@ -2348,6 +2363,59 @@ func TestSchemaMap_Diff(t *testing.T) {
 
 			Err: false,
 		},
+
+		// #60 - Removing set elements
+		{
+			Schema: map[string]*Schema{
+				"instances": &Schema{
+					Type:     TypeSet,
+					Elem:     &Schema{Type: TypeString},
+					Optional: true,
+					ForceNew: true,
+					Set: func(v interface{}) int {
+						return len(v.(string))
+					},
+				},
+			},
+
+			State: &terraform.InstanceState{
+				Attributes: map[string]string{
+					"instances.#": "2",
+					"instances.3": "333",
+					"instances.2": "22",
+				},
+			},
+
+			Config: map[string]interface{}{
+				"instances": []interface{}{"333", "4444"},
+			},
+
+			Diff: &terraform.InstanceDiff{
+				Attributes: map[string]*terraform.ResourceAttrDiff{
+					"instances.#": &terraform.ResourceAttrDiff{
+						Old: "2",
+						New: "2",
+					},
+					"instances.2": &terraform.ResourceAttrDiff{
+						Old:        "22",
+						New:        "",
+						NewRemoved: true,
+					},
+					"instances.3": &terraform.ResourceAttrDiff{
+						Old:         "333",
+						New:         "333",
+						RequiresNew: true,
+					},
+					"instances.4": &terraform.ResourceAttrDiff{
+						Old:         "",
+						New:         "4444",
+						RequiresNew: true,
+					},
+				},
+			},
+
+			Err: false,
+		},
 	}
 
 	for i, tc := range cases {
@@ -2796,6 +2864,20 @@ func TestSchemaMap_InternalValidate(t *testing.T) {
 			},
 			false,
 		},
+
+		// ValidateFunc on non-primitive
+		{
+			map[string]*Schema{
+				"foo": &Schema{
+					Type:     TypeMap,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						return
+					},
+				},
+			},
+			true,
+		},
 	}
 
 	for i, tc := range cases {
@@ -2967,6 +3049,29 @@ func TestSchemaMap_Validate(t *testing.T) {
 			Err: false,
 		},
 
+		"Sub-resource is the wrong type": {
+			Schema: map[string]*Schema{
+				"ingress": &Schema{
+					Type:     TypeList,
+					Required: true,
+					Elem: &Resource{
+						Schema: map[string]*Schema{
+							"from": &Schema{
+								Type:     TypeInt,
+								Required: true,
+							},
+						},
+					},
+				},
+			},
+
+			Config: map[string]interface{}{
+				"ingress": []interface{}{"foo"},
+			},
+
+			Err: true,
+		},
+
 		"Not a list": {
 			Schema: map[string]*Schema{
 				"ingress": &Schema{
@@ -3399,9 +3504,101 @@ func TestSchemaMap_Validate(t *testing.T) {
 
 			Err: true,
 			Errors: []error{
-				fmt.Errorf("\"optional_att\": conflicts with required_att (\"required-val\")"),
+				fmt.Errorf(`"optional_att": conflicts with required_att ("required-val")`),
 			},
 		},
+
+		"Good with ValidateFunc": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "valid",
+			},
+			Err: false,
+		},
+
+		"Bad with ValidateFunc": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						es = append(es, fmt.Errorf("something is not right here"))
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "invalid",
+			},
+			Err: true,
+			Errors: []error{
+				fmt.Errorf(`something is not right here`),
+			},
+		},
+
+		"ValidateFunc not called when type does not match": {
+			Schema: map[string]*Schema{
+				"number": &Schema{
+					Type:     TypeInt,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						t.Fatalf("Should not have gotten validate call")
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"number": "NaN",
+			},
+			Err: true,
+		},
+
+		"ValidateFunc gets decoded type": {
+			Schema: map[string]*Schema{
+				"maybe": &Schema{
+					Type:     TypeBool,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						if _, ok := v.(bool); !ok {
+							t.Fatalf("Expected bool, got: %#v", v)
+						}
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"maybe": "true",
+			},
+		},
+
+		"ValidateFunc is not called with a computed value": {
+			Schema: map[string]*Schema{
+				"validate_me": &Schema{
+					Type:     TypeString,
+					Required: true,
+					ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
+						es = append(es, fmt.Errorf("something is not right here"))
+						return
+					},
+				},
+			},
+			Config: map[string]interface{}{
+				"validate_me": "${var.foo}",
+			},
+			Vars: map[string]string{
+				"var.foo": config.UnknownVariableValue,
+			},
+
+			Err: false,
+		},
 	}
 
 	for tn, tc := range cases {
diff --git a/helper/schema/set.go b/helper/schema/set.go
index 7176b8630..8d21866df 100644
--- a/helper/schema/set.go
+++ b/helper/schema/set.go
@@ -74,7 +74,7 @@ func (s *Set) List() []interface{} {
 	return result
 }
 
-// Differences performs a set difference of the two sets, returning
+// Difference performs a set difference of the two sets, returning
 // a new third set that has only the elements unique to this set.
 func (s *Set) Difference(other *Set) *Set {
 	result := &Set{F: s.F}
diff --git a/helper/schema/valuetype_string.go b/helper/schema/valuetype_string.go
index fec00944e..42442a46b 100644
--- a/helper/schema/valuetype_string.go
+++ b/helper/schema/valuetype_string.go
@@ -9,7 +9,7 @@ const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTy
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
-	if i < 0 || i+1 >= ValueType(len(_ValueType_index)) {
+	if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
 		return fmt.Sprintf("ValueType(%d)", i)
 	}
 	return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
diff --git a/main.go b/main.go
index abd0e18e3..168583107 100644
--- a/main.go
+++ b/main.go
@@ -101,10 +101,6 @@ func wrappedMain() int {
 	// Make sure we clean up any managed plugins at the end of this
 	defer plugin.CleanupClients()
 
-	// Initialize the TFConfig settings for the commands...
-	ContextOpts.Providers = config.ProviderFactories()
-	ContextOpts.Provisioners = config.ProvisionerFactories()
-
 	// Get the command line args. We shortcut "--version" and "-v" to
 	// just show the version.
 	args := os.Args[1:]
diff --git a/rpc/resource_provider.go b/rpc/resource_provider.go
index e3fa4241c..3fe6927de 100644
--- a/rpc/resource_provider.go
+++ b/rpc/resource_provider.go
@@ -174,6 +174,10 @@ func (p *ResourceProvider) Resources() []terraform.ResourceType {
 	return result
 }
 
+func (p *ResourceProvider) Close() error {
+	return p.Client.Close()
+}
+
 // ResourceProviderServer is a net/rpc compatible structure for serving
 // a ResourceProvider. This should not be used directly.
 type ResourceProviderServer struct {
diff --git a/rpc/resource_provider_test.go b/rpc/resource_provider_test.go
index 91cf38bfe..3efdbce25 100644
--- a/rpc/resource_provider_test.go
+++ b/rpc/resource_provider_test.go
@@ -488,3 +488,31 @@ func TestResourceProvider_validateResource_warns(t *testing.T) {
 		t.Fatalf("bad: %#v", w)
 	}
 }
+
+func TestResourceProvider_close(t *testing.T) {
+	client, _ := testNewClientServer(t)
+	defer client.Close()
+
+	provider, err := client.ResourceProvider()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	var p interface{}
+	p = provider
+	pCloser, ok := p.(terraform.ResourceProviderCloser)
+	if !ok {
+		t.Fatal("should be a ResourceProviderCloser")
+	}
+
+	if err := pCloser.Close(); err != nil {
+		t.Fatalf("failed to close provider: %s", err)
+	}
+
+	// The connection should be closed now, so if we to make a
+	// new call we should get an error.
+	err = provider.Configure(&terraform.ResourceConfig{})
+	if err == nil {
+		t.Fatal("should have error")
+	}
+}
diff --git a/rpc/resource_provisioner.go b/rpc/resource_provisioner.go
index cf8c00812..715704d02 100644
--- a/rpc/resource_provisioner.go
+++ b/rpc/resource_provisioner.go
@@ -63,6 +63,10 @@ func (p *ResourceProvisioner) Apply(
 	return err
 }
 
+func (p *ResourceProvisioner) Close() error {
+	return p.Client.Close()
+}
+
 type ResourceProvisionerValidateArgs struct {
 	Config *terraform.ResourceConfig
 }
diff --git a/rpc/resource_provisioner_test.go b/rpc/resource_provisioner_test.go
index 32b6c06f3..6fabdb6d4 100644
--- a/rpc/resource_provisioner_test.go
+++ b/rpc/resource_provisioner_test.go
@@ -132,3 +132,34 @@ func TestResourceProvisioner_validate_warns(t *testing.T) {
 		t.Fatalf("bad: %#v", w)
 	}
 }
+
+func TestResourceProvisioner_close(t *testing.T) {
+	client, _ := testNewClientServer(t)
+	defer client.Close()
+
+	provisioner, err := client.ResourceProvisioner()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	var p interface{}
+	p = provisioner
+	pCloser, ok := p.(terraform.ResourceProvisionerCloser)
+	if !ok {
+		t.Fatal("should be a ResourceProvisionerCloser")
+	}
+
+	if err := pCloser.Close(); err != nil {
+		t.Fatalf("failed to close provisioner: %s", err)
+	}
+
+	// The connection should be closed now, so if we to make a
+	// new call we should get an error.
+	o := &terraform.MockUIOutput{}
+	s := &terraform.InstanceState{}
+	c := &terraform.ResourceConfig{}
+	err = provisioner.Apply(o, s, c)
+	if err == nil {
+		t.Fatal("should have error")
+	}
+}
diff --git a/scripts/build.sh b/scripts/build.sh
index 01d6025cd..2553f5b6f 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This script builds the application from source for multiple platforms.
 
diff --git a/scripts/dist.sh b/scripts/dist.sh
index fdd531dce..00038e3ac 100755
--- a/scripts/dist.sh
+++ b/scripts/dist.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 # Get the version from the command line
diff --git a/scripts/website_push.sh b/scripts/website_push.sh
index fafcbd70c..03017e87a 100755
--- a/scripts/website_push.sh
+++ b/scripts/website_push.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Get the parent directory of where this script is.
 SOURCE="${BASH_SOURCE[0]}"
diff --git a/state/remote/http.go b/state/remote/http.go
index 8b410fb3d..1aca7652f 100644
--- a/state/remote/http.go
+++ b/state/remote/http.go
@@ -3,11 +3,13 @@ package remote
 import (
 	"bytes"
 	"crypto/md5"
+	"crypto/tls"
 	"encoding/base64"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 )
 
 func httpFactory(conf map[string]string) (Client, error) {
@@ -24,18 +26,38 @@ func httpFactory(conf map[string]string) (Client, error) {
 		return nil, fmt.Errorf("address must be HTTP or HTTPS")
 	}
 
+	client := &http.Client{}
+	if skipRaw, ok := conf["skip_cert_verification"]; ok {
+		skip, err := strconv.ParseBool(skipRaw)
+		if err != nil {
+			return nil, fmt.Errorf("skip_cert_verification must be boolean")
+		}
+		if skip {
+			// Replace the client with one that ignores TLS verification
+			client = &http.Client{
+				Transport: &http.Transport{
+					TLSClientConfig: &tls.Config{
+						InsecureSkipVerify: true,
+					},
+				},
+			}
+		}
+	}
+
 	return &HTTPClient{
-		URL: url,
+		URL:    url,
+		Client: client,
 	}, nil
 }
 
-// HTTPClient is a remote client that stores data in Consul.
+// HTTPClient is a remote client that stores data in Consul or HTTP REST.
 type HTTPClient struct {
-	URL *url.URL
+	URL    *url.URL
+	Client *http.Client
 }
 
 func (c *HTTPClient) Get() (*Payload, error) {
-	resp, err := http.Get(c.URL.String())
+	resp, err := c.Client.Get(c.URL.String())
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +132,6 @@ func (c *HTTPClient) Put(data []byte) error {
 		}
 	*/
 
-	// Make the HTTP client and request
 	req, err := http.NewRequest("POST", base.String(), bytes.NewReader(data))
 	if err != nil {
 		return fmt.Errorf("Failed to make HTTP request: %s", err)
@@ -122,7 +143,7 @@ func (c *HTTPClient) Put(data []byte) error {
 	req.ContentLength = int64(len(data))
 
 	// Make the request
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := c.Client.Do(req)
 	if err != nil {
 		return fmt.Errorf("Failed to upload state: %v", err)
 	}
@@ -138,14 +159,13 @@ func (c *HTTPClient) Put(data []byte) error {
 }
 
 func (c *HTTPClient) Delete() error {
-	// Make the HTTP request
 	req, err := http.NewRequest("DELETE", c.URL.String(), nil)
 	if err != nil {
 		return fmt.Errorf("Failed to make HTTP request: %s", err)
 	}
 
 	// Make the request
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := c.Client.Do(req)
 	if err != nil {
 		return fmt.Errorf("Failed to delete state: %s", err)
 	}
diff --git a/state/remote/http_test.go b/state/remote/http_test.go
index e5cdbed88..e6e7297c1 100644
--- a/state/remote/http_test.go
+++ b/state/remote/http_test.go
@@ -24,7 +24,7 @@ func TestHTTPClient(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
-	client := &HTTPClient{URL: url}
+	client := &HTTPClient{URL: url, Client: http.DefaultClient}
 	testClient(t, client)
 }
 
diff --git a/state/remote/remote.go b/state/remote/remote.go
index cb525e6a3..7ebea3222 100644
--- a/state/remote/remote.go
+++ b/state/remote/remote.go
@@ -40,6 +40,7 @@ var BuiltinClients = map[string]Factory{
 	"consul": consulFactory,
 	"http":   httpFactory,
 	"s3":     s3Factory,
+	"swift":  swiftFactory,
 
 	// This is used for development purposes only.
 	"_local": fileFactory,
diff --git a/state/remote/s3.go b/state/remote/s3.go
index 742bfac76..c98fe9712 100644
--- a/state/remote/s3.go
+++ b/state/remote/s3.go
@@ -5,11 +5,12 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strconv"
 
-	"github.com/awslabs/aws-sdk-go/aws"
-	"github.com/awslabs/aws-sdk-go/aws/awserr"
-	"github.com/awslabs/aws-sdk-go/aws/credentials"
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func s3Factory(conf map[string]string) (Client, error) {
@@ -32,6 +33,17 @@ func s3Factory(conf map[string]string) (Client, error) {
 		}
 	}
 
+	serverSideEncryption := false
+	if raw, ok := conf["encrypt"]; ok {
+		v, err := strconv.ParseBool(raw)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"'encrypt' field couldn't be parsed as bool: %s", err)
+		}
+
+		serverSideEncryption = v
+	}
+
 	accessKeyId := conf["access_key"]
 	secretAccessKey := conf["secret_key"]
 
@@ -60,16 +72,18 @@ func s3Factory(conf map[string]string) (Client, error) {
 	nativeClient := s3.New(awsConfig)
 
 	return &S3Client{
-		nativeClient: nativeClient,
-		bucketName:   bucketName,
-		keyName:      keyName,
+		nativeClient:         nativeClient,
+		bucketName:           bucketName,
+		keyName:              keyName,
+		serverSideEncryption: serverSideEncryption,
 	}, nil
 }
 
 type S3Client struct {
-	nativeClient *s3.S3
-	bucketName   string
-	keyName      string
+	nativeClient         *s3.S3
+	bucketName           string
+	keyName              string
+	serverSideEncryption bool
 }
 
 func (c *S3Client) Get() (*Payload, error) {
@@ -113,15 +127,19 @@ func (c *S3Client) Put(data []byte) error {
 	contentType := "application/octet-stream"
 	contentLength := int64(len(data))
 
-	_, err := c.nativeClient.PutObject(&s3.PutObjectInput{
+	i := &s3.PutObjectInput{
 		ContentType:   &contentType,
 		ContentLength: &contentLength,
 		Body:          bytes.NewReader(data),
 		Bucket:        &c.bucketName,
 		Key:           &c.keyName,
-	})
+	}
 
-	if err == nil {
+	if c.serverSideEncryption {
+		i.ServerSideEncryption = aws.String("AES256")
+	}
+
+	if _, err := c.nativeClient.PutObject(i); err == nil {
 		return nil
 	} else {
 		return fmt.Errorf("Failed to upload state: %v", err)
diff --git a/state/remote/s3_test.go b/state/remote/s3_test.go
index ca7ec4879..d9e99982e 100644
--- a/state/remote/s3_test.go
+++ b/state/remote/s3_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/awslabs/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/s3"
 )
 
 func TestS3Client_impl(t *testing.T) {
@@ -28,6 +28,8 @@ func TestS3Factory(t *testing.T) {
 	config["region"] = "us-west-1"
 	config["bucket"] = "foo"
 	config["key"] = "bar"
+	config["encrypt"] = "1"
+
 	// For this test we'll provide the credentials as config. The
 	// acceptance tests implicitly test passing credentials as
 	// environment variables.
@@ -80,11 +82,13 @@ func TestS3Client(t *testing.T) {
 
 	bucketName := fmt.Sprintf("terraform-remote-s3-test-%x", time.Now().Unix())
 	keyName := "testState"
+	testData := []byte(`testing data`)
 
 	config := make(map[string]string)
 	config["region"] = regionName
 	config["bucket"] = bucketName
 	config["key"] = keyName
+	config["encrypt"] = "1"
 
 	client, err := s3Factory(config)
 	if err != nil {
@@ -105,6 +109,13 @@ func TestS3Client(t *testing.T) {
 	if err != nil {
 		t.Skipf("Failed to create test S3 bucket, so skipping")
 	}
+
+	// Ensure we can perform a PUT request with the encryption header
+	err = s3Client.Put(testData)
+	if err != nil {
+		t.Logf("WARNING: Failed to send test data to S3 bucket. (error was %s)", err)
+	}
+
 	defer func() {
 		deleteBucketReq := &s3.DeleteBucketInput{
 			Bucket: &bucketName,
diff --git a/state/remote/swift.go b/state/remote/swift.go
new file mode 100644
index 000000000..3f9c88d69
--- /dev/null
+++ b/state/remote/swift.go
@@ -0,0 +1,114 @@
+package remote
+
+import (
+	"bytes"
+	"crypto/md5"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/rackspace/gophercloud"
+	"github.com/rackspace/gophercloud/openstack"
+	"github.com/rackspace/gophercloud/openstack/objectstorage/v1/containers"
+	"github.com/rackspace/gophercloud/openstack/objectstorage/v1/objects"
+)
+
+const TFSTATE_NAME = "tfstate.tf"
+
+// SwiftClient implements the Client interface for an Openstack Swift server.
+type SwiftClient struct {
+	client *gophercloud.ServiceClient
+	path   string
+}
+
+func swiftFactory(conf map[string]string) (Client, error) {
+	client := &SwiftClient{}
+
+	if err := client.validateConfig(conf); err != nil {
+		return nil, err
+	}
+
+	return client, nil
+}
+
+func (c *SwiftClient) validateConfig(conf map[string]string) (err error) {
+	if val := os.Getenv("OS_AUTH_URL"); val == "" {
+		return fmt.Errorf("missing OS_AUTH_URL environment variable")
+	}
+	if val := os.Getenv("OS_USERNAME"); val == "" {
+		return fmt.Errorf("missing OS_USERNAME environment variable")
+	}
+	if val := os.Getenv("OS_TENANT_NAME"); val == "" {
+		return fmt.Errorf("missing OS_TENANT_NAME environment variable")
+	}
+	if val := os.Getenv("OS_PASSWORD"); val == "" {
+		return fmt.Errorf("missing OS_PASSWORD environment variable")
+	}
+	path, ok := conf["path"]
+	if !ok || path == "" {
+		return fmt.Errorf("missing 'path' configuration")
+	}
+
+	provider, err := openstack.AuthenticatedClient(gophercloud.AuthOptions{
+		IdentityEndpoint: os.Getenv("OS_AUTH_URL"),
+		Username:         os.Getenv("OS_USERNAME"),
+		TenantName:       os.Getenv("OS_TENANT_NAME"),
+		Password:         os.Getenv("OS_PASSWORD"),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	c.path = path
+	c.client, err = openstack.NewObjectStorageV1(provider, gophercloud.EndpointOpts{
+		Region: os.Getenv("OS_REGION_NAME"),
+	})
+
+	return err
+}
+
+func (c *SwiftClient) Get() (*Payload, error) {
+	result := objects.Download(c.client, c.path, TFSTATE_NAME, nil)
+	bytes, err := result.ExtractContent()
+
+	if err != nil {
+		if strings.Contains(err.Error(), "but got 404 instead") {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	hash := md5.Sum(bytes)
+	payload := &Payload{
+		Data: bytes,
+		MD5:  hash[:md5.Size],
+	}
+
+	return payload, nil
+}
+
+func (c *SwiftClient) Put(data []byte) error {
+	if err := c.ensureContainerExists(); err != nil {
+		return err
+	}
+
+	reader := bytes.NewReader(data)
+	result := objects.Create(c.client, c.path, TFSTATE_NAME, reader, nil)
+
+	return result.Err
+}
+
+func (c *SwiftClient) Delete() error {
+	result := objects.Delete(c.client, c.path, TFSTATE_NAME, nil)
+	return result.Err
+}
+
+func (c *SwiftClient) ensureContainerExists() error {
+	result := containers.Create(c.client, c.path, nil)
+	if result.Err != nil {
+		return result.Err
+	}
+
+	return nil
+}
diff --git a/state/remote/swift_test.go b/state/remote/swift_test.go
new file mode 100644
index 000000000..c27de8e73
--- /dev/null
+++ b/state/remote/swift_test.go
@@ -0,0 +1,31 @@
+package remote
+
+import (
+	"net/http"
+	"os"
+	"testing"
+)
+
+func TestSwiftClient_impl(t *testing.T) {
+	var _ Client = new(SwiftClient)
+}
+
+func TestSwiftClient(t *testing.T) {
+	os_auth_url := os.Getenv("OS_AUTH_URL")
+	if os_auth_url == "" {
+		t.Skipf("skipping, OS_AUTH_URL and friends must be set")
+	}
+
+	if _, err := http.Get(os_auth_url); err != nil {
+		t.Skipf("skipping, unable to reach %s: %s", os_auth_url, err)
+	}
+
+	client, err := swiftFactory(map[string]string{
+		"path": "swift_test",
+	})
+	if err != nil {
+		t.Fatalf("bad: %s", err)
+	}
+
+	testClient(t, client)
+}
diff --git a/terraform/context.go b/terraform/context.go
index 60e5dbea0..531d49310 100644
--- a/terraform/context.go
+++ b/terraform/context.go
@@ -434,6 +434,12 @@ func (c *Context) Validate() ([]string, []error) {
 		}
 	}
 
+	// If we have errors at this point, the graphing has no chance,
+	// so just bail early.
+	if errs != nil {
+		return nil, []error{errs}
+	}
+
 	// Build the graph so we can walk it and run Validate on nodes.
 	// We also validate the graph generated here, but this graph doesn't
 	// necessarily match the graph that Plan will generate, so we'll validate the
diff --git a/terraform/context_test.go b/terraform/context_test.go
index 720ed2b2d..022a2f9af 100644
--- a/terraform/context_test.go
+++ b/terraform/context_test.go
@@ -697,43 +697,6 @@ func TestContext2Plan_preventDestroy_destroyPlan(t *testing.T) {
 	}
 }
 
-func TestContext2Plan_providerAliasMissing(t *testing.T) {
-	m := testModule(t, "apply-provider-alias-missing")
-	p := testProvider("aws")
-	p.ApplyFn = testApplyFn
-	p.DiffFn = testDiffFn
-	state := &State{
-		Modules: []*ModuleState{
-			&ModuleState{
-				Path: rootModulePath,
-				Resources: map[string]*ResourceState{
-					"aws_instance.foo": &ResourceState{
-						Type:     "aws_instance",
-						Provider: "aws.foo",
-						Primary: &InstanceState{
-							ID: "bar",
-							Attributes: map[string]string{
-								"require_new": "abc",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-		State: state,
-	})
-
-	if _, err := ctx.Plan(); err == nil {
-		t.Fatal("should err")
-	}
-}
-
 func TestContext2Plan_computed(t *testing.T) {
 	m := testModule(t, "plan-computed")
 	p := testProvider("aws")
@@ -1709,29 +1672,6 @@ func TestContext2Plan_provider(t *testing.T) {
 	}
 }
 
-func TestContext2Plan_varMultiCountOne(t *testing.T) {
-	m := testModule(t, "plan-var-multi-count-one")
-	p := testProvider("aws")
-	p.DiffFn = testDiffFn
-	ctx := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	plan, err := ctx.Plan()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	actual := strings.TrimSpace(plan.String())
-	expected := strings.TrimSpace(testTerraformPlanVarMultiCountOneStr)
-	if actual != expected {
-		t.Fatalf("bad:\n%s", actual)
-	}
-}
-
 func TestContext2Plan_varListErr(t *testing.T) {
 	m := testModule(t, "plan-var-list-err")
 	p := testProvider("aws")
@@ -1935,6 +1875,23 @@ func TestContext2Refresh_targetedCountIndex(t *testing.T) {
 	}
 }
 
+func TestContext2Refresh_moduleComputedVar(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "refresh-module-computed-var")
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	// This was failing (see GH-2188) at some point, so this test just
+	// verifies that the failure goes away.
+	if _, err := ctx.Refresh(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
 func TestContext2Refresh_delete(t *testing.T) {
 	p := testProvider("aws")
 	m := testModule(t, "refresh-basic")
@@ -2447,6 +2404,38 @@ func TestContext2Validate_badVar(t *testing.T) {
 	}
 }
 
+func TestContext2Validate_computedVar(t *testing.T) {
+	p := testProvider("aws")
+	m := testModule(t, "validate-computed-var")
+	c := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(testProvider("test")),
+		},
+	})
+
+	p.ValidateFn = func(c *ResourceConfig) ([]string, []error) {
+		if !c.IsComputed("value") {
+			return nil, []error{fmt.Errorf("value isn't computed")}
+		}
+
+		return nil, c.CheckSet([]string{"value"})
+	}
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		return fmt.Errorf("Configure should not be called for provider")
+	}
+
+	w, e := c.Validate()
+	if len(w) > 0 {
+		t.Fatalf("bad: %#v", w)
+	}
+	if len(e) > 0 {
+		t.Fatalf("bad: %#v", e)
+	}
+}
+
 func TestContext2Validate_countNegative(t *testing.T) {
 	p := testProvider("aws")
 	m := testModule(t, "validate-count-negative")
@@ -3100,28 +3089,6 @@ func TestContext2Validate_targetedDestroy(t *testing.T) {
 	}
 }
 
-func TestContext2Validate_varRef(t *testing.T) {
-	m := testModule(t, "validate-variable-ref")
-	p := testProvider("aws")
-	c := testContext2(t, &ContextOpts{
-		Module: m,
-		Providers: map[string]ResourceProviderFactory{
-			"aws": testProviderFuncFixed(p),
-		},
-	})
-
-	computed := false
-	p.ValidateResourceFn = func(t string, c *ResourceConfig) ([]string, []error) {
-		computed = c.IsComputed("foo")
-		return nil, nil
-	}
-
-	c.Validate()
-	if !computed {
-		t.Fatal("should be computed")
-	}
-}
-
 func TestContext2Validate_varRefFilled(t *testing.T) {
 	m := testModule(t, "validate-variable-ref")
 	p := testProvider("aws")
@@ -4343,6 +4310,150 @@ func TestContext2Apply_moduleDestroyOrder(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_moduleOrphanProvider(t *testing.T) {
+	m := testModule(t, "apply-module-orphan-provider-inherit")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		if _, ok := c.Get("value"); !ok {
+			return fmt.Errorf("value is not found")
+		}
+
+		return nil
+	}
+
+	// Create a state with an orphan module
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: []string{"root", "child"},
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		State:  state,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// This tests an issue where all the providers in a module but not
+// in the root weren't being added to the root properly. In this test
+// case: aws is explicitly added to root, but "test" should be added to.
+// With the bug, it wasn't.
+func TestContext2Apply_moduleOnlyProvider(t *testing.T) {
+	m := testModule(t, "apply-module-only-provider")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	pTest := testProvider("test")
+	pTest.ApplyFn = testApplyFn
+	pTest.DiffFn = testDiffFn
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(pTest),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleOnlyProviderStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleProviderAlias(t *testing.T) {
+	m := testModule(t, "apply-module-provider-alias")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(testTerraformApplyModuleProviderAliasStr)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
+func TestContext2Apply_moduleProviderAliasTargets(t *testing.T) {
+	m := testModule(t, "apply-module-provider-alias")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"no.thing"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(state.String())
+	expected := strings.TrimSpace(`
+<no state>
+	`)
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+}
+
 func TestContext2Apply_moduleVarResourceCount(t *testing.T) {
 	m := testModule(t, "apply-module-var-resource-count")
 	p := testProvider("aws")
@@ -4454,6 +4565,68 @@ func TestContext2Apply_multiProvider(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_multiVar(t *testing.T) {
+	m := testModule(t, "apply-multi-var")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	// First, apply with a count of 3
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Variables: map[string]string{
+			"count": "3",
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := state.RootModule().Outputs["output"]
+	expected := "bar0,bar1,bar2"
+	if actual != expected {
+		t.Fatalf("bad: \n%s", actual)
+	}
+
+	// Apply again, reduce the count to 1
+	{
+		ctx := testContext2(t, &ContextOpts{
+			Module: m,
+			State:  state,
+			Providers: map[string]ResourceProviderFactory{
+				"aws": testProviderFuncFixed(p),
+			},
+			Variables: map[string]string{
+				"count": "1",
+			},
+		})
+
+		if _, err := ctx.Plan(); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		state, err := ctx.Apply()
+		if err != nil {
+			t.Fatalf("err: %s", err)
+		}
+
+		actual := state.RootModule().Outputs["output"]
+		expected := "bar0"
+		if actual != expected {
+			t.Fatalf("bad: \n%s", actual)
+		}
+	}
+}
+
 func TestContext2Apply_nilDiff(t *testing.T) {
 	m := testModule(t, "apply-good")
 	p := testProvider("aws")
@@ -4521,6 +4694,49 @@ func TestContext2Apply_outputOrphan(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_providerComputedVar(t *testing.T) {
+	m := testModule(t, "apply-provider-computed")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	pTest := testProvider("test")
+	pTest.ApplyFn = testApplyFn
+	pTest.DiffFn = testDiffFn
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws":  testProviderFuncFixed(p),
+			"test": testProviderFuncFixed(pTest),
+		},
+	})
+
+	p.ConfigureFn = func(c *ResourceConfig) error {
+		if c.IsComputed("value") {
+			return fmt.Errorf("value is computed")
+		}
+
+		v, ok := c.Get("value")
+		if !ok {
+			return fmt.Errorf("value is not found")
+		}
+		if v != "yes" {
+			return fmt.Errorf("value is not 'yes': %v", v)
+		}
+
+		return nil
+	}
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
 func TestContext2Apply_Provisioner_compute(t *testing.T) {
 	m := testModule(t, "apply-provisioner-compute")
 	p := testProvider("aws")
@@ -5741,6 +5957,57 @@ func TestContext2Apply_hook(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_hookOrphan(t *testing.T) {
+	m := testModule(t, "apply-blank")
+	h := new(MockHook)
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.bar": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		State:  state,
+		Hooks:  []Hook{h},
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if _, err := ctx.Apply(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !h.PreApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostApplyCalled {
+		t.Fatal("should be called")
+	}
+	if !h.PostStateUpdateCalled {
+		t.Fatalf("should call post state update")
+	}
+}
+
 func TestContext2Apply_idAttr(t *testing.T) {
 	m := testModule(t, "apply-idattr")
 	p := testProvider("aws")
@@ -6357,6 +6624,48 @@ module.child:
 	`)
 }
 
+// GH-1858
+func TestContext2Apply_targetedModuleDep(t *testing.T) {
+	m := testModule(t, "apply-targeted-module-dep")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Targets: []string{"aws_instance.foo"},
+	})
+
+	if _, err := ctx.Plan(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	state, err := ctx.Apply()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	checkStateString(t, state, `
+aws_instance.foo:
+  ID = foo
+  foo = foo
+  type = aws_instance
+
+  Dependencies:
+    module.child
+
+module.child:
+  aws_instance.mod:
+    ID = foo
+
+  Outputs:
+
+  output = foo
+	`)
+}
+
 func TestContext2Apply_targetedModuleResource(t *testing.T) {
 	m := testModule(t, "apply-targeted-module-resource")
 	p := testProvider("aws")
@@ -6422,6 +6731,23 @@ func TestContext2Apply_unknownAttribute(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_unknownAttributeInterpolate(t *testing.T) {
+	m := testModule(t, "apply-unknown-interpolate")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
 func TestContext2Apply_vars(t *testing.T) {
 	m := testModule(t, "apply-vars")
 	p := testProvider("aws")
diff --git a/terraform/diff.go b/terraform/diff.go
index 7cd907422..d77cd77d3 100644
--- a/terraform/diff.go
+++ b/terraform/diff.go
@@ -149,15 +149,11 @@ func (d *ModuleDiff) ChangeType() DiffChangeType {
 	for _, r := range d.Resources {
 		change := r.ChangeType()
 		switch change {
-		case DiffCreate:
-			fallthrough
-		case DiffDestroy:
+		case DiffCreate, DiffDestroy:
 			if result == DiffNone {
 				result = change
 			}
-		case DiffDestroyCreate:
-			fallthrough
-		case DiffUpdate:
+		case DiffDestroyCreate, DiffUpdate:
 			result = DiffUpdate
 		}
 	}
diff --git a/terraform/eval_context.go b/terraform/eval_context.go
index 8a838afb7..f4427939a 100644
--- a/terraform/eval_context.go
+++ b/terraform/eval_context.go
@@ -28,6 +28,9 @@ type EvalContext interface {
 	// initialized) or returns nil if the provider isn't initialized.
 	Provider(string) ResourceProvider
 
+	// CloseProvider closes provider connections that aren't needed anymore.
+	CloseProvider(string) error
+
 	// ConfigureProvider configures the provider with the given
 	// configuration. This is a separate context call because this call
 	// is used to store the provider configuration for inheritance lookups
@@ -51,6 +54,10 @@ type EvalContext interface {
 	// initialized) or returns nil if the provisioner isn't initialized.
 	Provisioner(string) ResourceProvisioner
 
+	// CloseProvisioner closes provisioner connections that aren't needed
+	// anymore.
+	CloseProvisioner(string) error
+
 	// Interpolate takes the given raw configuration and completes
 	// the interpolations, returning the processed ResourceConfig.
 	//
diff --git a/terraform/eval_context_builtin.go b/terraform/eval_context_builtin.go
index efc7d04fe..a25c1c6a1 100644
--- a/terraform/eval_context_builtin.go
+++ b/terraform/eval_context_builtin.go
@@ -114,6 +114,28 @@ func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
 	return ctx.ProviderCache[PathCacheKey(providerPath)]
 }
 
+func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
+	ctx.once.Do(ctx.init)
+
+	ctx.ProviderLock.Lock()
+	defer ctx.ProviderLock.Unlock()
+
+	providerPath := make([]string, len(ctx.Path())+1)
+	copy(providerPath, ctx.Path())
+	providerPath[len(providerPath)-1] = n
+
+	var provider interface{}
+	provider = ctx.ProviderCache[PathCacheKey(providerPath)]
+	if provider != nil {
+		if p, ok := provider.(ResourceProviderCloser); ok {
+			delete(ctx.ProviderCache, PathCacheKey(providerPath))
+			return p.Close()
+		}
+	}
+
+	return nil
+}
+
 func (ctx *BuiltinEvalContext) ConfigureProvider(
 	n string, cfg *ResourceConfig) error {
 	p := ctx.Provider(n)
@@ -146,14 +168,32 @@ func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
 	ctx.ProviderLock.Lock()
 	defer ctx.ProviderLock.Unlock()
 
-	return ctx.ProviderInputConfig[n]
+	// Make a copy of the path so we can safely edit it
+	path := ctx.Path()
+	pathCopy := make([]string, len(path)+1)
+	copy(pathCopy, path)
+
+	// Go up the tree.
+	for i := len(path) - 1; i >= 0; i-- {
+		pathCopy[i+1] = n
+		k := PathCacheKey(pathCopy[:i+2])
+		if v, ok := ctx.ProviderInputConfig[k]; ok {
+			return v
+		}
+	}
+
+	return nil
 }
 
 func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface{}) {
-	ctx.ProviderLock.Lock()
-	defer ctx.ProviderLock.Unlock()
+	providerPath := make([]string, len(ctx.Path())+1)
+	copy(providerPath, ctx.Path())
+	providerPath[len(providerPath)-1] = n
 
-	ctx.ProviderInputConfig[n] = c
+	// Save the configuration
+	ctx.ProviderLock.Lock()
+	ctx.ProviderInputConfig[PathCacheKey(providerPath)] = c
+	ctx.ProviderLock.Unlock()
 }
 
 func (ctx *BuiltinEvalContext) ParentProviderConfig(n string) *ResourceConfig {
@@ -222,6 +262,28 @@ func (ctx *BuiltinEvalContext) Provisioner(n string) ResourceProvisioner {
 	return ctx.ProvisionerCache[PathCacheKey(provPath)]
 }
 
+func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
+	ctx.once.Do(ctx.init)
+
+	ctx.ProvisionerLock.Lock()
+	defer ctx.ProvisionerLock.Unlock()
+
+	provPath := make([]string, len(ctx.Path())+1)
+	copy(provPath, ctx.Path())
+	provPath[len(provPath)-1] = n
+
+	var prov interface{}
+	prov = ctx.ProvisionerCache[PathCacheKey(provPath)]
+	if prov != nil {
+		if p, ok := prov.(ResourceProvisionerCloser); ok {
+			delete(ctx.ProvisionerCache, PathCacheKey(provPath))
+			return p.Close()
+		}
+	}
+
+	return nil
+}
+
 func (ctx *BuiltinEvalContext) Interpolate(
 	cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
 	if cfg != nil {
diff --git a/terraform/eval_context_builtin_test.go b/terraform/eval_context_builtin_test.go
new file mode 100644
index 000000000..4d07e75e0
--- /dev/null
+++ b/terraform/eval_context_builtin_test.go
@@ -0,0 +1,42 @@
+package terraform
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+)
+
+func TestBuiltinEvalContextProviderInput(t *testing.T) {
+	var lock sync.Mutex
+	cache := make(map[string]map[string]interface{})
+
+	ctx1 := testBuiltinEvalContext(t)
+	ctx1.PathValue = []string{"root"}
+	ctx1.ProviderInputConfig = cache
+	ctx1.ProviderLock = &lock
+
+	ctx2 := testBuiltinEvalContext(t)
+	ctx2.PathValue = []string{"root", "child"}
+	ctx2.ProviderInputConfig = cache
+	ctx2.ProviderLock = &lock
+
+	expected1 := map[string]interface{}{"value": "foo"}
+	ctx1.SetProviderInput("foo", expected1)
+
+	expected2 := map[string]interface{}{"value": "bar"}
+	ctx2.SetProviderInput("foo", expected2)
+
+	actual1 := ctx1.ProviderInput("foo")
+	actual2 := ctx2.ProviderInput("foo")
+
+	if !reflect.DeepEqual(actual1, expected1) {
+		t.Fatalf("bad: %#v %#v", actual1, expected1)
+	}
+	if !reflect.DeepEqual(actual2, expected2) {
+		t.Fatalf("bad: %#v %#v", actual2, expected2)
+	}
+}
+
+func testBuiltinEvalContext(t *testing.T) *BuiltinEvalContext {
+	return &BuiltinEvalContext{}
+}
diff --git a/terraform/eval_context_mock.go b/terraform/eval_context_mock.go
index 2a5856829..60d83c724 100644
--- a/terraform/eval_context_mock.go
+++ b/terraform/eval_context_mock.go
@@ -25,6 +25,10 @@ type MockEvalContext struct {
 	ProviderName     string
 	ProviderProvider ResourceProvider
 
+	CloseProviderCalled   bool
+	CloseProviderName     string
+	CloseProviderProvider ResourceProvider
+
 	ProviderInputCalled bool
 	ProviderInputName   string
 	ProviderInputConfig map[string]interface{}
@@ -55,6 +59,10 @@ type MockEvalContext struct {
 	ProvisionerName        string
 	ProvisionerProvisioner ResourceProvisioner
 
+	CloseProvisionerCalled      bool
+	CloseProvisionerName        string
+	CloseProvisionerProvisioner ResourceProvisioner
+
 	InterpolateCalled       bool
 	InterpolateConfig       *config.RawConfig
 	InterpolateResource     *Resource
@@ -105,6 +113,12 @@ func (c *MockEvalContext) Provider(n string) ResourceProvider {
 	return c.ProviderProvider
 }
 
+func (c *MockEvalContext) CloseProvider(n string) error {
+	c.CloseProviderCalled = true
+	c.CloseProviderName = n
+	return nil
+}
+
 func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error {
 	c.ConfigureProviderCalled = true
 	c.ConfigureProviderName = n
@@ -150,6 +164,12 @@ func (c *MockEvalContext) Provisioner(n string) ResourceProvisioner {
 	return c.ProvisionerProvisioner
 }
 
+func (c *MockEvalContext) CloseProvisioner(n string) error {
+	c.CloseProvisionerCalled = true
+	c.CloseProvisionerName = n
+	return nil
+}
+
 func (c *MockEvalContext) Interpolate(
 	config *config.RawConfig, resource *Resource) (*ResourceConfig, error) {
 	c.InterpolateCalled = true
diff --git a/terraform/eval_provider.go b/terraform/eval_provider.go
index e5205a556..61efcc235 100644
--- a/terraform/eval_provider.go
+++ b/terraform/eval_provider.go
@@ -71,6 +71,17 @@ func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
 	return ctx.InitProvider(n.Name)
 }
 
+// EvalCloseProvider is an EvalNode implementation that closes provider
+// connections that aren't needed anymore.
+type EvalCloseProvider struct {
+	Name string
+}
+
+func (n *EvalCloseProvider) Eval(ctx EvalContext) (interface{}, error) {
+	ctx.CloseProvider(n.Name)
+	return nil, nil
+}
+
 // EvalGetProvider is an EvalNode implementation that retrieves an already
 // initialized provider instance for the given name.
 type EvalGetProvider struct {
diff --git a/terraform/eval_provider_test.go b/terraform/eval_provider_test.go
index 5d50d746b..5719b62c5 100644
--- a/terraform/eval_provider_test.go
+++ b/terraform/eval_provider_test.go
@@ -112,6 +112,22 @@ func TestEvalInitProvider(t *testing.T) {
 	}
 }
 
+func TestEvalCloseProvider(t *testing.T) {
+	n := &EvalCloseProvider{Name: "foo"}
+	provider := &MockResourceProvider{}
+	ctx := &MockEvalContext{CloseProviderProvider: provider}
+	if _, err := n.Eval(ctx); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !ctx.CloseProviderCalled {
+		t.Fatal("should be called")
+	}
+	if ctx.CloseProviderName != "foo" {
+		t.Fatalf("bad: %#v", ctx.CloseProviderName)
+	}
+}
+
 func TestEvalGetProvider_impl(t *testing.T) {
 	var _ EvalNode = new(EvalGetProvider)
 }
diff --git a/terraform/eval_provisioner.go b/terraform/eval_provisioner.go
index 362a26e84..89579c055 100644
--- a/terraform/eval_provisioner.go
+++ b/terraform/eval_provisioner.go
@@ -15,6 +15,17 @@ func (n *EvalInitProvisioner) Eval(ctx EvalContext) (interface{}, error) {
 	return ctx.InitProvisioner(n.Name)
 }
 
+// EvalCloseProvisioner is an EvalNode implementation that closes provisioner
+// connections that aren't needed anymore.
+type EvalCloseProvisioner struct {
+	Name string
+}
+
+func (n *EvalCloseProvisioner) Eval(ctx EvalContext) (interface{}, error) {
+	ctx.CloseProvisioner(n.Name)
+	return nil, nil
+}
+
 // EvalGetProvisioner is an EvalNode implementation that retrieves an already
 // initialized provisioner instance for the given name.
 type EvalGetProvisioner struct {
diff --git a/terraform/eval_provisioner_test.go b/terraform/eval_provisioner_test.go
index 1225c5abb..390bc364d 100644
--- a/terraform/eval_provisioner_test.go
+++ b/terraform/eval_provisioner_test.go
@@ -24,6 +24,22 @@ func TestEvalInitProvisioner(t *testing.T) {
 	}
 }
 
+func TestEvalCloseProvisioner(t *testing.T) {
+	n := &EvalCloseProvisioner{Name: "foo"}
+	provisioner := &MockResourceProvisioner{}
+	ctx := &MockEvalContext{CloseProvisionerProvisioner: provisioner}
+	if _, err := n.Eval(ctx); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if !ctx.CloseProvisionerCalled {
+		t.Fatal("should be called")
+	}
+	if ctx.CloseProvisionerName != "foo" {
+		t.Fatalf("bad: %#v", ctx.CloseProvisionerName)
+	}
+}
+
 func TestEvalGetProvisioner_impl(t *testing.T) {
 	var _ EvalNode = new(EvalGetProvisioner)
 }
diff --git a/terraform/evaltree_provider.go b/terraform/evaltree_provider.go
index 59916d9b5..1910bc091 100644
--- a/terraform/evaltree_provider.go
+++ b/terraform/evaltree_provider.go
@@ -62,6 +62,20 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
 					Provider: &provider,
 					Config:   &resourceConfig,
 				},
+				&EvalSetProviderConfig{
+					Provider: n,
+					Config:   &resourceConfig,
+				},
+			},
+		},
+	})
+
+	// We configure on everything but validate, since validate may
+	// not have access to all the variables.
+	seq = append(seq, &EvalOpFilter{
+		Ops: []walkOperation{walkRefresh, walkPlan, walkApply},
+		Node: &EvalSequence{
+			Nodes: []EvalNode{
 				&EvalConfigProvider{
 					Provider: n,
 					Config:   &resourceConfig,
@@ -72,3 +86,9 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
 
 	return &EvalSequence{Nodes: seq}
 }
+
+// CloseProviderEvalTree returns the evaluation tree for closing
+// provider connections that aren't needed anymore.
+func CloseProviderEvalTree(n string) EvalNode {
+	return &EvalCloseProvider{Name: n}
+}
diff --git a/terraform/graph_builder.go b/terraform/graph_builder.go
index 28a76e513..0ec3f8b20 100644
--- a/terraform/graph_builder.go
+++ b/terraform/graph_builder.go
@@ -116,13 +116,11 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 		// Provider-related transformations
 		&MissingProviderTransformer{Providers: b.Providers},
 		&ProviderTransformer{},
-		&PruneProviderTransformer{},
 		&DisableProviderTransformer{},
 
 		// Provisioner-related transformations
 		&MissingProvisionerTransformer{Provisioners: b.Provisioners},
 		&ProvisionerTransformer{},
-		&PruneProvisionerTransformer{},
 
 		// Run our vertex-level transforms
 		&VertexTransformer{
@@ -140,10 +138,6 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 		// Make sure all the connections that are proxies are connected through
 		&ProxyTransformer{},
 
-		// Optionally reduces the graph to a user-specified list of targets and
-		// their dependencies.
-		&TargetsTransformer{Targets: b.Targets, Destroy: b.Destroy},
-
 		// Make sure we have a single root
 		&RootTransformer{},
 	}
@@ -152,6 +146,16 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 	// We don't do the following for modules.
 	if len(path) <= 1 {
 		steps = append(steps,
+			// Optionally reduces the graph to a user-specified list of targets and
+			// their dependencies.
+			&TargetsTransformer{Targets: b.Targets, Destroy: b.Destroy},
+
+			// Prune the providers and provisioners. This must happen
+			// only once because flattened modules might depend on empty
+			// providers.
+			&PruneProviderTransformer{},
+			&PruneProvisionerTransformer{},
+
 			// Create the destruction nodes
 			&DestroyTransformer{FullDestroy: b.Destroy},
 			&CreateBeforeDestroyTransformer{},
@@ -160,6 +164,10 @@ func (b *BuiltinGraphBuilder) Steps(path []string) []GraphTransformer {
 				Then: &PruneDestroyTransformer{Diff: b.Diff, State: b.State},
 			}),
 
+			// Insert nodes to close opened plugin connections
+			&CloseProviderTransformer{},
+			&CloseProvisionerTransformer{},
+
 			// Make sure we have a single root after the above changes.
 			// This is the 2nd root transformer. In practice this shouldn't
 			// actually matter as the RootTransformer is idempotent.
diff --git a/terraform/graph_builder_test.go b/terraform/graph_builder_test.go
index 1f7f25055..dbc8ae61e 100644
--- a/terraform/graph_builder_test.go
+++ b/terraform/graph_builder_test.go
@@ -154,6 +154,49 @@ func TestBuiltinGraphBuilder_multiLevelModule(t *testing.T) {
 	}
 }
 
+func TestBuiltinGraphBuilder_orphanDeps(t *testing.T) {
+	state := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "foo",
+						},
+					},
+
+					"aws_instance.bar": &ResourceState{
+						Type:         "aws_instance",
+						Dependencies: []string{"aws_instance.foo"},
+						Primary: &InstanceState{
+							ID: "bar",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	b := &BuiltinGraphBuilder{
+		Root:     testModule(t, "graph-builder-orphan-deps"),
+		State:    state,
+		Validate: true,
+	}
+
+	g, err := b.Build(RootModulePath)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(testBuiltinGraphBuilderOrphanDepsStr)
+	if actual != expected {
+		t.Fatalf("bad: %s", actual)
+	}
+}
+
 /*
 TODO: This exposes a really bad bug we need to fix after we merge
 the f-ast-branch. This bug still exists in master.
@@ -196,6 +239,8 @@ aws_instance.db
 aws_instance.web
   aws_instance.db
 provider.aws
+provider.aws (close)
+  aws_instance.web
 `
 
 const testBuiltinGraphBuilderVerboseStr = `
@@ -213,8 +258,38 @@ aws_instance.web (destroy tainted)
 aws_instance.web (destroy)
   provider.aws
 provider.aws
+provider.aws (close)
+  aws_instance.web
 `
 
+const testBuiltinGraphBuilderMultiLevelStr = `
+module.foo.module.bar.output.value
+  module.foo.module.bar.var.bar
+module.foo.module.bar.plan-destroy
+module.foo.module.bar.var.bar
+  module.foo.var.foo
+module.foo.plan-destroy
+module.foo.var.foo
+root
+  module.foo.module.bar.output.value
+  module.foo.module.bar.plan-destroy
+  module.foo.plan-destroy
+`
+
+const testBuiltinGraphBuilderOrphanDepsStr = `
+aws_instance.bar (orphan)
+  provider.aws
+aws_instance.foo (orphan)
+  aws_instance.bar (orphan)
+provider.aws
+provider.aws (close)
+  aws_instance.foo (orphan)
+`
+
+/*
+TODO: Commented out this const as it's likely this needs to
+be updated when the TestBuiltinGraphBuilder_modules test is
+enabled again.
 const testBuiltinGraphBuilderModuleStr = `
 aws_instance.web
   aws_instance.web (destroy)
@@ -231,17 +306,4 @@ module.consul (expanded)
   provider.aws
 provider.aws
 `
-
-const testBuiltinGraphBuilderMultiLevelStr = `
-module.foo.module.bar.output.value
-  module.foo.module.bar.var.bar
-module.foo.module.bar.plan-destroy
-module.foo.module.bar.var.bar
-  module.foo.var.foo
-module.foo.plan-destroy
-module.foo.var.foo
-root
-  module.foo.module.bar.output.value
-  module.foo.module.bar.plan-destroy
-  module.foo.plan-destroy
-`
+*/
diff --git a/terraform/graph_config_node_resource.go b/terraform/graph_config_node_resource.go
index bf1803b00..936398d2a 100644
--- a/terraform/graph_config_node_resource.go
+++ b/terraform/graph_config_node_resource.go
@@ -148,9 +148,7 @@ func (n *GraphNodeConfigResource) DynamicExpand(ctx EvalContext) (*Graph, error)
 	// Primary and non-destroy modes are responsible for creating/destroying
 	// all the nodes, expanding counts.
 	switch n.DestroyMode {
-	case DestroyNone:
-		fallthrough
-	case DestroyPrimary:
+	case DestroyNone, DestroyPrimary:
 		steps = append(steps, &ResourceCountTransformer{
 			Resource: n.Resource,
 			Destroy:  n.DestroyMode != DestroyNone,
diff --git a/terraform/graphnodeconfigtype_string.go b/terraform/graphnodeconfigtype_string.go
index de24c2dcd..d8c1724f4 100644
--- a/terraform/graphnodeconfigtype_string.go
+++ b/terraform/graphnodeconfigtype_string.go
@@ -9,7 +9,7 @@ const _GraphNodeConfigType_name = "GraphNodeConfigTypeInvalidGraphNodeConfigType
 var _GraphNodeConfigType_index = [...]uint8{0, 26, 53, 80, 105, 130, 157}
 
 func (i GraphNodeConfigType) String() string {
-	if i < 0 || i+1 >= GraphNodeConfigType(len(_GraphNodeConfigType_index)) {
+	if i < 0 || i >= GraphNodeConfigType(len(_GraphNodeConfigType_index)-1) {
 		return fmt.Sprintf("GraphNodeConfigType(%d)", i)
 	}
 	return _GraphNodeConfigType_name[_GraphNodeConfigType_index[i]:_GraphNodeConfigType_index[i+1]]
diff --git a/terraform/instancetype_string.go b/terraform/instancetype_string.go
index fc8697644..3114bc157 100644
--- a/terraform/instancetype_string.go
+++ b/terraform/instancetype_string.go
@@ -9,7 +9,7 @@ const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
 
 func (i InstanceType) String() string {
-	if i < 0 || i+1 >= InstanceType(len(_InstanceType_index)) {
+	if i < 0 || i >= InstanceType(len(_InstanceType_index)-1) {
 		return fmt.Sprintf("InstanceType(%d)", i)
 	}
 	return _InstanceType_name[_InstanceType_index[i]:_InstanceType_index[i+1]]
diff --git a/terraform/interpolate.go b/terraform/interpolate.go
index 15b51fcb2..83f6265e1 100644
--- a/terraform/interpolate.go
+++ b/terraform/interpolate.go
@@ -362,7 +362,7 @@ MISSING:
 	// Validation for missing interpolations should happen at a higher
 	// semantic level. If we reached this point and don't have variables,
 	// just return the computed value.
-	if scope == nil || scope.Resource == nil {
+	if scope == nil && scope.Resource == nil {
 		return config.UnknownVariableValue, nil
 	}
 
@@ -437,6 +437,14 @@ func (i *Interpolater) computeResourceMultiVariable(
 	}
 
 	if len(values) == 0 {
+		// If the operation is refresh, it isn't an error for a value to
+		// be unknown. Instead, we return that the value is computed so
+		// that the graph can continue to refresh other nodes. It doesn't
+		// matter because the config isn't interpolated anyways.
+		if i.Operation == walkRefresh {
+			return config.UnknownVariableValue, nil
+		}
+
 		return "", fmt.Errorf(
 			"Resource '%s' does not have attribute '%s' "+
 				"for variable '%s'",
@@ -445,7 +453,7 @@ func (i *Interpolater) computeResourceMultiVariable(
 			v.FullKey())
 	}
 
-	return strings.Join(values, config.InterpSplitDelim), nil
+	return config.NewStringList(values).String(), nil
 }
 
 func (i *Interpolater) resourceVariableInfo(
diff --git a/terraform/resource_provider.go b/terraform/resource_provider.go
index d8705232d..ea23b031d 100644
--- a/terraform/resource_provider.go
+++ b/terraform/resource_provider.go
@@ -71,6 +71,12 @@ type ResourceProvider interface {
 	Refresh(*InstanceInfo, *InstanceState) (*InstanceState, error)
 }
 
+// ResourceProviderCloser is an interface that providers that can close
+// connections that aren't needed anymore must implement.
+type ResourceProviderCloser interface {
+	Close() error
+}
+
 // ResourceType is a type of resource that a resource provider can manage.
 type ResourceType struct {
 	Name string
diff --git a/terraform/resource_provider_mock.go b/terraform/resource_provider_mock.go
index fa2bd24c6..3b2b351dc 100644
--- a/terraform/resource_provider_mock.go
+++ b/terraform/resource_provider_mock.go
@@ -10,6 +10,8 @@ type MockResourceProvider struct {
 	// Anything you want, in case you need to store extra data with the mock.
 	Meta interface{}
 
+	CloseCalled                  bool
+	CloseError                   error
 	InputCalled                  bool
 	InputInput                   UIInput
 	InputConfig                  *ResourceConfig
@@ -55,6 +57,11 @@ type MockResourceProvider struct {
 	ValidateResourceReturnErrors []error
 }
 
+func (p *MockResourceProvider) Close() error {
+	p.CloseCalled = true
+	return p.CloseError
+}
+
 func (p *MockResourceProvider) Input(
 	input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
 	p.InputCalled = true
diff --git a/terraform/resource_provider_mock_test.go b/terraform/resource_provider_mock_test.go
index 0beaf87d1..ebefadf29 100644
--- a/terraform/resource_provider_mock_test.go
+++ b/terraform/resource_provider_mock_test.go
@@ -6,4 +6,5 @@ import (
 
 func TestMockResourceProvider_impl(t *testing.T) {
 	var _ ResourceProvider = new(MockResourceProvider)
+	var _ ResourceProviderCloser = new(MockResourceProvider)
 }
diff --git a/terraform/resource_provisioner.go b/terraform/resource_provisioner.go
index acc80d054..3327e3000 100644
--- a/terraform/resource_provisioner.go
+++ b/terraform/resource_provisioner.go
@@ -23,6 +23,12 @@ type ResourceProvisioner interface {
 	Apply(UIOutput, *InstanceState, *ResourceConfig) error
 }
 
+// ResourceProvisionerCloser is an interface that provisioners that can close
+// connections that aren't needed anymore must implement.
+type ResourceProvisionerCloser interface {
+	Close() error
+}
+
 // ResourceProvisionerFactory is a function type that creates a new instance
 // of a resource provisioner.
 type ResourceProvisionerFactory func() (ResourceProvisioner, error)
diff --git a/terraform/terraform_test.go b/terraform/terraform_test.go
index e30d27a13..59dad38d4 100644
--- a/terraform/terraform_test.go
+++ b/terraform/terraform_test.go
@@ -56,7 +56,7 @@ func tempEnv(t *testing.T, k string, v string) string {
 }
 
 func testConfig(t *testing.T, name string) *config.Config {
-	c, err := config.Load(filepath.Join(fixtureDir, name, "main.tf"))
+	c, err := config.LoadFile(filepath.Join(fixtureDir, name, "main.tf"))
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -379,6 +379,23 @@ do_instance.foo:
   type = do_instance
 `
 
+const testTerraformApplyModuleOnlyProviderStr = `
+<no state>
+module.child:
+  aws_instance.foo:
+    ID = foo
+  test_instance.foo:
+    ID = foo
+`
+
+const testTerraformApplyModuleProviderAliasStr = `
+<no state>
+module.child:
+  aws_instance.foo:
+    ID = foo
+    provider = aws.eu
+`
+
 const testTerraformApplyOutputOrphanStr = `
 <no state>
 Outputs:
diff --git a/terraform/test-fixtures/apply-blank/main.tf b/terraform/test-fixtures/apply-blank/main.tf
new file mode 100644
index 000000000..0081db186
--- /dev/null
+++ b/terraform/test-fixtures/apply-blank/main.tf
@@ -0,0 +1 @@
+// Nothing!
diff --git a/terraform/test-fixtures/apply-module-only-provider/child/main.tf b/terraform/test-fixtures/apply-module-only-provider/child/main.tf
new file mode 100644
index 000000000..e15099c17
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-only-provider/child/main.tf
@@ -0,0 +1,2 @@
+resource "aws_instance" "foo" {}
+resource "test_instance" "foo" {}
diff --git a/terraform/test-fixtures/apply-module-only-provider/main.tf b/terraform/test-fixtures/apply-module-only-provider/main.tf
new file mode 100644
index 000000000..2276b5f36
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-only-provider/main.tf
@@ -0,0 +1,5 @@
+provider "aws" {}
+
+module "child" {
+    source = "./child"
+}
diff --git a/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf b/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf
new file mode 100644
index 000000000..e334ff2c7
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-orphan-provider-inherit/main.tf
@@ -0,0 +1,3 @@
+provider "aws" {
+    value = "foo"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-alias/child/main.tf b/terraform/test-fixtures/apply-module-provider-alias/child/main.tf
new file mode 100644
index 000000000..ee923f255
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-alias/child/main.tf
@@ -0,0 +1,7 @@
+provider "aws" {
+    alias = "eu"
+}
+
+resource "aws_instance" "foo" {
+    provider = "aws.eu"
+}
diff --git a/terraform/test-fixtures/apply-module-provider-alias/main.tf b/terraform/test-fixtures/apply-module-provider-alias/main.tf
new file mode 100644
index 000000000..0f6991c53
--- /dev/null
+++ b/terraform/test-fixtures/apply-module-provider-alias/main.tf
@@ -0,0 +1,3 @@
+module "child" {
+    source = "./child"
+}
diff --git a/terraform/test-fixtures/apply-multi-var/main.tf b/terraform/test-fixtures/apply-multi-var/main.tf
new file mode 100644
index 000000000..22eb1988e
--- /dev/null
+++ b/terraform/test-fixtures/apply-multi-var/main.tf
@@ -0,0 +1,10 @@
+variable "count" {}
+
+resource "aws_instance" "bar" {
+    foo = "bar${count.index}"
+    count = "${var.count}"
+}
+
+output "output" {
+    value = "${join(",", aws_instance.bar.*.foo)}"
+}
diff --git a/terraform/test-fixtures/apply-provider-alias-missing/main.tf b/terraform/test-fixtures/apply-provider-alias-missing/main.tf
deleted file mode 100644
index ea50084fd..000000000
--- a/terraform/test-fixtures/apply-provider-alias-missing/main.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-provider "aws" {
-	alias = "bar"
-}
-
-resource "aws_instance" "bar" {
-    foo = "bar"
-    provider = "aws.bar"
-}
diff --git a/terraform/test-fixtures/apply-provider-computed/main.tf b/terraform/test-fixtures/apply-provider-computed/main.tf
new file mode 100644
index 000000000..4a39bb546
--- /dev/null
+++ b/terraform/test-fixtures/apply-provider-computed/main.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+    value = "${test_instance.foo.value}"
+}
+
+resource "aws_instance" "bar" {}
+
+resource "test_instance" "foo" {
+    value = "yes"
+}
diff --git a/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf b/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf
new file mode 100644
index 000000000..90a7c407b
--- /dev/null
+++ b/terraform/test-fixtures/apply-targeted-module-dep/child/main.tf
@@ -0,0 +1,5 @@
+resource "aws_instance" "mod" { }
+
+output "output" {
+  value = "${aws_instance.mod.id}"
+}
diff --git a/terraform/test-fixtures/apply-targeted-module-dep/main.tf b/terraform/test-fixtures/apply-targeted-module-dep/main.tf
new file mode 100644
index 000000000..754219c3e
--- /dev/null
+++ b/terraform/test-fixtures/apply-targeted-module-dep/main.tf
@@ -0,0 +1,7 @@
+module "child" {
+    source = "./child"
+}
+
+resource "aws_instance" "foo" {
+    foo = "${module.child.output}"
+}
diff --git a/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf b/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf
new file mode 100644
index 000000000..6a2f85930
--- /dev/null
+++ b/terraform/test-fixtures/apply-unknown-interpolate/child/main.tf
@@ -0,0 +1 @@
+variable "value" {}
diff --git a/terraform/test-fixtures/apply-unknown-interpolate/main.tf b/terraform/test-fixtures/apply-unknown-interpolate/main.tf
new file mode 100644
index 000000000..1ee7dd6cb
--- /dev/null
+++ b/terraform/test-fixtures/apply-unknown-interpolate/main.tf
@@ -0,0 +1,6 @@
+resource "aws_instance" "foo" {}
+
+module "child" {
+    source = "./child"
+    value = "${aws_instance.foo.nope}"
+}
diff --git a/terraform/test-fixtures/graph-builder-orphan-deps/main.tf b/terraform/test-fixtures/graph-builder-orphan-deps/main.tf
new file mode 100644
index 000000000..b21d3b6ab
--- /dev/null
+++ b/terraform/test-fixtures/graph-builder-orphan-deps/main.tf
@@ -0,0 +1 @@
+provider "aws" {}
diff --git a/terraform/test-fixtures/plan-var-multi-count-one/main.tf b/terraform/test-fixtures/plan-var-multi-count-one/main.tf
deleted file mode 100644
index 6fd84932f..000000000
--- a/terraform/test-fixtures/plan-var-multi-count-one/main.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-resource "aws_instance" "foo" {
-    num = "2"
-
-    count = 1
-}
-
-resource "aws_instance" "bar" {
-    foo = "${aws_instance.foo.*.num}"
-}
diff --git a/terraform/test-fixtures/refresh-module-computed-var/child/main.tf b/terraform/test-fixtures/refresh-module-computed-var/child/main.tf
new file mode 100644
index 000000000..38260d637
--- /dev/null
+++ b/terraform/test-fixtures/refresh-module-computed-var/child/main.tf
@@ -0,0 +1,5 @@
+variable "value" {}
+
+output "value" {
+    value = "${var.value}"
+}
diff --git a/terraform/test-fixtures/refresh-module-computed-var/main.tf b/terraform/test-fixtures/refresh-module-computed-var/main.tf
new file mode 100644
index 000000000..a8573327b
--- /dev/null
+++ b/terraform/test-fixtures/refresh-module-computed-var/main.tf
@@ -0,0 +1,8 @@
+module "child" {
+    source = "./child"
+    value = "${join(" ", aws_instance.test.*.id)}"
+}
+
+resource "aws_instance" "test" {
+    value = "yes"
+}
diff --git a/terraform/test-fixtures/transform-provider-missing/main.tf b/terraform/test-fixtures/transform-provider-missing/main.tf
new file mode 100644
index 000000000..976f3e5af
--- /dev/null
+++ b/terraform/test-fixtures/transform-provider-missing/main.tf
@@ -0,0 +1,3 @@
+provider "aws" {}
+resource "aws_instance" "web" {}
+resource "foo_instance" "web" {}
diff --git a/terraform/test-fixtures/validate-computed-var/main.tf b/terraform/test-fixtures/validate-computed-var/main.tf
new file mode 100644
index 000000000..4a39bb546
--- /dev/null
+++ b/terraform/test-fixtures/validate-computed-var/main.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+    value = "${test_instance.foo.value}"
+}
+
+resource "aws_instance" "bar" {}
+
+resource "test_instance" "foo" {
+    value = "yes"
+}
diff --git a/terraform/transform_destroy.go b/terraform/transform_destroy.go
index 9fb235107..8d5aeb4c9 100644
--- a/terraform/transform_destroy.go
+++ b/terraform/transform_destroy.go
@@ -1,6 +1,8 @@
 package terraform
 
-import "github.com/hashicorp/terraform/dag"
+import (
+	"github.com/hashicorp/terraform/dag"
+)
 
 type GraphNodeDestroyMode byte
 
@@ -103,6 +105,12 @@ func (t *DestroyTransformer) transform(
 		nodeToCn[n] = cn
 		nodeToDn[cn] = n
 
+		// If the creation node is equal to the destroy node, then
+		// don't do any of the edge jump rope below.
+		if n.(interface{}) == cn.(interface{}) {
+			continue
+		}
+
 		// Add it to the graph
 		g.Add(n)
 
diff --git a/terraform/transform_orphan.go b/terraform/transform_orphan.go
index 448aae794..8e609f609 100644
--- a/terraform/transform_orphan.go
+++ b/terraform/transform_orphan.go
@@ -256,6 +256,7 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 	})
 
 	// Apply
+	var err error
 	seq.Nodes = append(seq.Nodes, &EvalOpFilter{
 		Ops: []walkOperation{walkApply},
 		Node: &EvalSequence{
@@ -278,6 +279,7 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 					Diff:     &diff,
 					Provider: &provider,
 					Output:   &state,
+					Error:    &err,
 				},
 				&EvalWriteState{
 					Name:         n.ResourceName,
@@ -286,6 +288,11 @@ func (n *graphNodeOrphanResource) EvalTree() EvalNode {
 					Dependencies: n.DependentOn(),
 					State:        &state,
 				},
+				&EvalApplyPost{
+					Info:  info,
+					State: &state,
+					Error: &err,
+				},
 				&EvalUpdateStateHook{},
 			},
 		},
@@ -298,6 +305,24 @@ func (n *graphNodeOrphanResource) dependableName() string {
 	return n.ResourceName
 }
 
+// GraphNodeDestroyable impl.
+func (n *graphNodeOrphanResource) DestroyNode(mode GraphNodeDestroyMode) GraphNodeDestroy {
+	if mode != DestroyPrimary {
+		return nil
+	}
+
+	return n
+}
+
+// GraphNodeDestroy impl.
+func (n *graphNodeOrphanResource) CreateBeforeDestroy() bool {
+	return false
+}
+
+func (n *graphNodeOrphanResource) CreateNode() dag.Vertex {
+	return n
+}
+
 // Same as graphNodeOrphanResource, but for flattening
 type graphNodeOrphanResourceFlat struct {
 	*graphNodeOrphanResource
@@ -313,3 +338,21 @@ func (n *graphNodeOrphanResourceFlat) Name() string {
 func (n *graphNodeOrphanResourceFlat) Path() []string {
 	return n.PathValue
 }
+
+// GraphNodeDestroyable impl.
+func (n *graphNodeOrphanResourceFlat) DestroyNode(mode GraphNodeDestroyMode) GraphNodeDestroy {
+	if mode != DestroyPrimary {
+		return nil
+	}
+
+	return n
+}
+
+// GraphNodeDestroy impl.
+func (n *graphNodeOrphanResourceFlat) CreateBeforeDestroy() bool {
+	return false
+}
+
+func (n *graphNodeOrphanResourceFlat) CreateNode() dag.Vertex {
+	return n
+}
diff --git a/terraform/transform_provider.go b/terraform/transform_provider.go
index 4863a4c98..fb8857c96 100644
--- a/terraform/transform_provider.go
+++ b/terraform/transform_provider.go
@@ -2,6 +2,7 @@ package terraform
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform/config"
@@ -17,6 +18,13 @@ type GraphNodeProvider interface {
 	ProviderConfig() *config.RawConfig
 }
 
+// GraphNodeCloseProvider is an interface that nodes that can be a close
+// provider must implement. The CloseProviderName returned is the name of
+// the provider they satisfy.
+type GraphNodeCloseProvider interface {
+	CloseProviderName() string
+}
+
 // GraphNodeProviderConsumer is an interface that nodes that require
 // a provider must implement. ProvidedBy must return the name of the provider
 // to use.
@@ -98,6 +106,50 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
 	return err
 }
 
+// CloseProviderTransformer is a GraphTransformer that adds nodes to the
+// graph that will close open provider connections that aren't needed anymore.
+// A provider connection is not needed anymore once all depended resources
+// in the graph are evaluated.
+type CloseProviderTransformer struct{}
+
+func (t *CloseProviderTransformer) Transform(g *Graph) error {
+	pm := providerVertexMap(g)
+	cpm := closeProviderVertexMap(g)
+	var err error
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProviderConsumer); ok {
+			for _, p := range pv.ProvidedBy() {
+				source := cpm[p]
+
+				if source == nil {
+					// Create a new graphNodeCloseProvider and add it to the graph
+					source = &graphNodeCloseProvider{ProviderNameValue: p}
+					g.Add(source)
+
+					// Close node needs to depend on provider
+					provider, ok := pm[p]
+					if !ok {
+						err = multierror.Append(err, fmt.Errorf(
+							"%s: provider %s couldn't be found",
+							dag.VertexName(v), p))
+						continue
+					}
+					g.Connect(dag.BasicEdge(source, provider))
+
+					// Make sure we also add the new graphNodeCloseProvider to the map
+					// so we don't create and add any duplicate graphNodeCloseProviders.
+					cpm[p] = source
+				}
+
+				// Close node depends on all nodes provided by the provider
+				g.Connect(dag.BasicEdge(source, v))
+			}
+		}
+	}
+
+	return err
+}
+
 // MissingProviderTransformer is a GraphTransformer that adds nodes
 // for missing providers into the graph. Specifically, it creates provider
 // configuration nodes for all the providers that we support. These are
@@ -108,15 +160,44 @@ type MissingProviderTransformer struct {
 }
 
 func (t *MissingProviderTransformer) Transform(g *Graph) error {
+	// Create a set of our supported providers
+	supported := make(map[string]struct{}, len(t.Providers))
+	for _, v := range t.Providers {
+		supported[v] = struct{}{}
+	}
+
+	// Get the map of providers we already have in our graph
 	m := providerVertexMap(g)
-	for _, p := range t.Providers {
-		if _, ok := m[p]; ok {
-			// This provider already exists as a configured node
+
+	// Go through all the provider consumers and make sure we add
+	// that provider if it is missing.
+	for _, v := range g.Vertices() {
+		pv, ok := v.(GraphNodeProviderConsumer)
+		if !ok {
 			continue
 		}
 
-		// Add our own missing provider node to the graph
-		g.Add(&graphNodeMissingProvider{ProviderNameValue: p})
+		for _, p := range pv.ProvidedBy() {
+			if _, ok := m[p]; ok {
+				// This provider already exists as a configure node
+				continue
+			}
+
+			// If the provider has an alias in it, we just want the type
+			ptype := p
+			if idx := strings.IndexRune(p, '.'); idx != -1 {
+				ptype = p[:idx]
+			}
+
+			if _, ok := supported[ptype]; !ok {
+				// If we don't support the provider type, skip it.
+				// Validation later will catch this as an error.
+				continue
+			}
+
+			// Add our own missing provider node to the graph
+			m[p] = g.Add(&graphNodeMissingProvider{ProviderNameValue: p})
+		}
 	}
 
 	return nil
@@ -143,6 +224,28 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
 	return nil
 }
 
+func providerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvider); ok {
+			m[pv.ProviderName()] = v
+		}
+	}
+
+	return m
+}
+
+func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeCloseProvider); ok {
+			m[pv.CloseProviderName()] = v
+		}
+	}
+
+	return m
+}
+
 type graphNodeDisabledProvider struct {
 	GraphNodeProvider
 }
@@ -258,6 +361,39 @@ func (n *graphNodeDisabledProviderFlat) DependentOn() []string {
 	return result
 }
 
+type graphNodeCloseProvider struct {
+	ProviderNameValue string
+}
+
+func (n *graphNodeCloseProvider) Name() string {
+	return fmt.Sprintf("provider.%s (close)", n.ProviderNameValue)
+}
+
+// GraphNodeEvalable impl.
+func (n *graphNodeCloseProvider) EvalTree() EvalNode {
+	return CloseProviderEvalTree(n.ProviderNameValue)
+}
+
+// GraphNodeDependable impl.
+func (n *graphNodeCloseProvider) DependableName() []string {
+	return []string{n.Name()}
+}
+
+func (n *graphNodeCloseProvider) CloseProviderName() string {
+	return n.ProviderNameValue
+}
+
+// GraphNodeDotter impl.
+func (n *graphNodeCloseProvider) DotNode(name string, opts *GraphDotOpts) *dot.Node {
+	if !opts.Verbose {
+		return nil
+	}
+	return dot.NewNode(name, map[string]string{
+		"label": n.Name(),
+		"shape": "diamond",
+	})
+}
+
 type graphNodeMissingProvider struct {
 	ProviderNameValue string
 }
@@ -305,17 +441,6 @@ func (n *graphNodeMissingProvider) Flatten(p []string) (dag.Vertex, error) {
 	}, nil
 }
 
-func providerVertexMap(g *Graph) map[string]dag.Vertex {
-	m := make(map[string]dag.Vertex)
-	for _, v := range g.Vertices() {
-		if pv, ok := v.(GraphNodeProvider); ok {
-			m[pv.ProviderName()] = v
-		}
-	}
-
-	return m
-}
-
 // Same as graphNodeMissingProvider, but for flattening
 type graphNodeMissingProviderFlat struct {
 	*graphNodeMissingProvider
diff --git a/terraform/transform_provider_test.go b/terraform/transform_provider_test.go
index fdf764c3f..9c6ff67e7 100644
--- a/terraform/transform_provider_test.go
+++ b/terraform/transform_provider_test.go
@@ -30,7 +30,7 @@ func TestProviderTransformer(t *testing.T) {
 	}
 }
 
-func TestMissingProviderTransformer(t *testing.T) {
+func TestCloseProviderTransformer(t *testing.T) {
 	mod := testModule(t, "transform-provider-basic")
 
 	g := Graph{Path: RootModulePath}
@@ -41,9 +41,80 @@ func TestMissingProviderTransformer(t *testing.T) {
 		}
 	}
 
-	transform := &MissingProviderTransformer{Providers: []string{"foo"}}
-	if err := transform.Transform(&g); err != nil {
-		t.Fatalf("err: %s", err)
+	{
+		transform := &ProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(testTransformCloseProviderBasicStr)
+	if actual != expected {
+		t.Fatalf("bad:\n\n%s", actual)
+	}
+}
+
+func TestCloseProviderTransformer_withTargets(t *testing.T) {
+	mod := testModule(t, "transform-provider-basic")
+
+	g := Graph{Path: RootModulePath}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&ProviderTransformer{},
+		&CloseProviderTransformer{},
+		&TargetsTransformer{
+			Targets: []string{"something.else"},
+		},
+	}
+
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	actual := strings.TrimSpace(g.String())
+	expected := strings.TrimSpace(`
+provider.aws
+provider.aws (close)
+  provider.aws
+	`)
+	if actual != expected {
+		t.Fatalf("expected:%s\n\ngot:\n\n%s", expected, actual)
+	}
+}
+
+func TestMissingProviderTransformer(t *testing.T) {
+	mod := testModule(t, "transform-provider-missing")
+
+	g := Graph{Path: RootModulePath}
+	{
+		tf := &ConfigTransformer{Module: mod}
+		if err := tf.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &MissingProviderTransformer{Providers: []string{"foo", "bar"}}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
 	}
 
 	actual := strings.TrimSpace(g.String())
@@ -78,6 +149,13 @@ func TestPruneProviderTransformer(t *testing.T) {
 		}
 	}
 
+	{
+		transform := &CloseProviderTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
 	{
 		transform := &PruneProviderTransformer{}
 		if err := transform.Transform(&g); err != nil {
@@ -96,37 +174,17 @@ func TestDisableProviderTransformer(t *testing.T) {
 	mod := testModule(t, "transform-provider-disable")
 
 	g := Graph{Path: RootModulePath}
-	{
-		tf := &ConfigTransformer{Module: mod}
-		if err := tf.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&MissingProviderTransformer{Providers: []string{"aws"}},
+		&ProviderTransformer{},
+		&DisableProviderTransformer{},
+		&CloseProviderTransformer{},
+		&PruneProviderTransformer{},
 	}
 
-	{
-		transform := &MissingProviderTransformer{Providers: []string{"aws"}}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &ProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &PruneProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &DisableProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
 			t.Fatalf("err: %s", err)
 		}
 	}
@@ -134,7 +192,7 @@ func TestDisableProviderTransformer(t *testing.T) {
 	actual := strings.TrimSpace(g.String())
 	expected := strings.TrimSpace(testTransformDisableProviderBasicStr)
 	if actual != expected {
-		t.Fatalf("bad:\n\n%s", actual)
+		t.Fatalf("expected:\n%s\n\ngot:\n%s\n", expected, actual)
 	}
 }
 
@@ -142,37 +200,17 @@ func TestDisableProviderTransformer_keep(t *testing.T) {
 	mod := testModule(t, "transform-provider-disable-keep")
 
 	g := Graph{Path: RootModulePath}
-	{
-		tf := &ConfigTransformer{Module: mod}
-		if err := tf.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
+	transforms := []GraphTransformer{
+		&ConfigTransformer{Module: mod},
+		&MissingProviderTransformer{Providers: []string{"aws"}},
+		&ProviderTransformer{},
+		&DisableProviderTransformer{},
+		&CloseProviderTransformer{},
+		&PruneProviderTransformer{},
 	}
 
-	{
-		transform := &MissingProviderTransformer{Providers: []string{"aws"}}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &ProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &PruneProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
-			t.Fatalf("err: %s", err)
-		}
-	}
-
-	{
-		transform := &DisableProviderTransformer{}
-		if err := transform.Transform(&g); err != nil {
+	for _, tr := range transforms {
+		if err := tr.Transform(&g); err != nil {
 			t.Fatalf("err: %s", err)
 		}
 	}
@@ -180,7 +218,7 @@ func TestDisableProviderTransformer_keep(t *testing.T) {
 	actual := strings.TrimSpace(g.String())
 	expected := strings.TrimSpace(testTransformDisableProviderKeepStr)
 	if actual != expected {
-		t.Fatalf("bad:\n\n%s", actual)
+		t.Fatalf("expected:\n%s\n\ngot:\n%s\n", expected, actual)
 	}
 }
 
@@ -203,22 +241,44 @@ aws_instance.web
 provider.aws
 `
 
+const testTransformCloseProviderBasicStr = `
+aws_instance.web
+  provider.aws
+provider.aws
+provider.aws (close)
+  aws_instance.web
+  provider.aws
+`
+
 const testTransformMissingProviderBasicStr = `
 aws_instance.web
+foo_instance.web
 provider.aws
+provider.aws (close)
+  aws_instance.web
+  provider.aws
 provider.foo
+provider.foo (close)
+  foo_instance.web
+  provider.foo
 `
 
 const testTransformPruneProviderBasicStr = `
 foo_instance.web
   provider.foo
 provider.foo
+provider.foo (close)
+  foo_instance.web
+  provider.foo
 `
 
 const testTransformDisableProviderBasicStr = `
 module.child
   provider.aws (disabled)
   var.foo
+provider.aws (close)
+  module.child
+  provider.aws (disabled)
 provider.aws (disabled)
 var.foo
 `
@@ -230,5 +290,9 @@ module.child
   provider.aws
   var.foo
 provider.aws
+provider.aws (close)
+  aws_instance.foo
+  module.child
+  provider.aws
 var.foo
 `
diff --git a/terraform/transform_provisioner.go b/terraform/transform_provisioner.go
index bf661f88a..a99fe48b0 100644
--- a/terraform/transform_provisioner.go
+++ b/terraform/transform_provisioner.go
@@ -14,6 +14,13 @@ type GraphNodeProvisioner interface {
 	ProvisionerName() string
 }
 
+// GraphNodeCloseProvisioner is an interface that nodes that can be a close
+// provisioner must implement. The CloseProvisionerName returned is the name
+// of the provisioner they satisfy.
+type GraphNodeCloseProvisioner interface {
+	CloseProvisionerName() string
+}
+
 // GraphNodeProvisionerConsumer is an interface that nodes that require
 // a provisioner must implement. ProvisionedBy must return the name of the
 // provisioner to use.
@@ -49,6 +56,37 @@ func (t *ProvisionerTransformer) Transform(g *Graph) error {
 	return err
 }
 
+// CloseProvisionerTransformer is a GraphTransformer that adds nodes to the
+// graph that will close open provisioner connections that aren't needed
+// anymore. A provisioner connection is not needed anymore once all depended
+// resources in the graph are evaluated.
+type CloseProvisionerTransformer struct{}
+
+func (t *CloseProvisionerTransformer) Transform(g *Graph) error {
+	m := closeProvisionerVertexMap(g)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvisionerConsumer); ok {
+			for _, p := range pv.ProvisionedBy() {
+				source := m[p]
+
+				if source == nil {
+					// Create a new graphNodeCloseProvisioner and add it to the graph
+					source = &graphNodeCloseProvisioner{ProvisionerNameValue: p}
+					g.Add(source)
+
+					// Make sure we also add the new graphNodeCloseProvisioner to the map
+					// so we don't create and add any duplicate graphNodeCloseProvisioners.
+					m[p] = source
+				}
+
+				g.Connect(dag.BasicEdge(source, v))
+			}
+		}
+	}
+
+	return nil
+}
+
 // MissingProvisionerTransformer is a GraphTransformer that adds nodes
 // for missing provisioners into the graph. Specifically, it creates provisioner
 // configuration nodes for all the provisioners that we support. These are
@@ -94,6 +132,45 @@ func (t *PruneProvisionerTransformer) Transform(g *Graph) error {
 	return nil
 }
 
+func provisionerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeProvisioner); ok {
+			m[pv.ProvisionerName()] = v
+		}
+	}
+
+	return m
+}
+
+func closeProvisionerVertexMap(g *Graph) map[string]dag.Vertex {
+	m := make(map[string]dag.Vertex)
+	for _, v := range g.Vertices() {
+		if pv, ok := v.(GraphNodeCloseProvisioner); ok {
+			m[pv.CloseProvisionerName()] = v
+		}
+	}
+
+	return m
+}
+
+type graphNodeCloseProvisioner struct {
+	ProvisionerNameValue string
+}
+
+func (n *graphNodeCloseProvisioner) Name() string {
+	return fmt.Sprintf("provisioner.%s (close)", n.ProvisionerNameValue)
+}
+
+// GraphNodeEvalable impl.
+func (n *graphNodeCloseProvisioner) EvalTree() EvalNode {
+	return &EvalCloseProvisioner{Name: n.ProvisionerNameValue}
+}
+
+func (n *graphNodeCloseProvisioner) CloseProvisionerName() string {
+	return n.ProvisionerNameValue
+}
+
 type graphNodeMissingProvisioner struct {
 	ProvisionerNameValue string
 }
@@ -119,17 +196,6 @@ func (n *graphNodeMissingProvisioner) Flatten(p []string) (dag.Vertex, error) {
 	}, nil
 }
 
-func provisionerVertexMap(g *Graph) map[string]dag.Vertex {
-	m := make(map[string]dag.Vertex)
-	for _, v := range g.Vertices() {
-		if pv, ok := v.(GraphNodeProvisioner); ok {
-			m[pv.ProvisionerName()] = v
-		}
-	}
-
-	return m
-}
-
 // Same as graphNodeMissingProvisioner, but for flattening
 type graphNodeMissingProvisionerFlat struct {
 	*graphNodeMissingProvisioner
diff --git a/terraform/transform_provisioner_test.go b/terraform/transform_provisioner_test.go
index f38a0a045..ea5faff77 100644
--- a/terraform/transform_provisioner_test.go
+++ b/terraform/transform_provisioner_test.go
@@ -18,9 +18,18 @@ func TestMissingProvisionerTransformer(t *testing.T) {
 		}
 	}
 
-	transform := &MissingProvisionerTransformer{Provisioners: []string{"foo"}}
-	if err := transform.Transform(&g); err != nil {
-		t.Fatalf("err: %s", err)
+	{
+		transform := &MissingProvisionerTransformer{Provisioners: []string{"foo"}}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
+	{
+		transform := &CloseProvisionerTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
 	}
 
 	actual := strings.TrimSpace(g.String())
@@ -56,6 +65,13 @@ func TestPruneProvisionerTransformer(t *testing.T) {
 		}
 	}
 
+	{
+		transform := &CloseProvisionerTransformer{}
+		if err := transform.Transform(&g); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+	}
+
 	{
 		transform := &PruneProvisionerTransformer{}
 		if err := transform.Transform(&g); err != nil {
@@ -86,10 +102,14 @@ func TestGraphNodeMissingProvisioner_ProvisionerName(t *testing.T) {
 const testTransformMissingProvisionerBasicStr = `
 aws_instance.web
 provisioner.foo
+provisioner.shell (close)
+  aws_instance.web
 `
 
 const testTransformPruneProvisionerBasicStr = `
 aws_instance.web
   provisioner.foo
 provisioner.foo
+provisioner.foo (close)
+  aws_instance.web
 `
diff --git a/terraform/transform_targets.go b/terraform/transform_targets.go
index 84e3aed60..cab8c8b1e 100644
--- a/terraform/transform_targets.go
+++ b/terraform/transform_targets.go
@@ -34,7 +34,7 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
 		for _, v := range g.Vertices() {
 			if _, ok := v.(GraphNodeAddressable); ok {
 				if !targetedNodes.Include(v) {
-					log.Printf("[DEBUG] Removing %s, filtered by targeting.", v)
+					log.Printf("[DEBUG] Removing %q, filtered by targeting.", dag.VertexName(v))
 					g.Remove(v)
 				}
 			}
diff --git a/terraform/version.go b/terraform/version.go
new file mode 100644
index 000000000..7146a8807
--- /dev/null
+++ b/terraform/version.go
@@ -0,0 +1,9 @@
+package terraform
+
+// The main version number that is being run at the moment.
+const Version = "0.6.0"
+
+// A pre-release marker for the version. If this is "" (empty string)
+// then it means that it is a final release. Otherwise, this is a pre-release
+// such as "dev" (in development), "beta", "rc1", etc.
+const VersionPrerelease = "dev"
diff --git a/terraform/walkoperation_string.go b/terraform/walkoperation_string.go
index ddd894f53..423793c3c 100644
--- a/terraform/walkoperation_string.go
+++ b/terraform/walkoperation_string.go
@@ -9,7 +9,7 @@ const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestro
 var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75}
 
 func (i walkOperation) String() string {
-	if i+1 >= walkOperation(len(_walkOperation_index)) {
+	if i >= walkOperation(len(_walkOperation_index)-1) {
 		return fmt.Sprintf("walkOperation(%d)", i)
 	}
 	return _walkOperation_name[_walkOperation_index[i]:_walkOperation_index[i+1]]
diff --git a/version.go b/version.go
index 3683352c9..31b54445d 100644
--- a/version.go
+++ b/version.go
@@ -1,12 +1,9 @@
 package main
 
+import "github.com/hashicorp/terraform/terraform"
+
 // The git commit that was compiled. This will be filled in by the compiler.
 var GitCommit string
 
-// The main version number that is being run at the moment.
-const Version = "0.5.3"
-
-// A pre-release marker for the version. If this is "" (empty string)
-// then it means that it is a final release. Otherwise, this is a pre-release
-// such as "dev" (in development), "beta", "rc1", etc.
-const VersionPrerelease = "dev"
+const Version = terraform.Version
+const VersionPrerelease = terraform.VersionPrerelease
diff --git a/website/Gemfile.lock b/website/Gemfile.lock
index 7366999a6..625e13326 100644
--- a/website/Gemfile.lock
+++ b/website/Gemfile.lock
@@ -79,18 +79,18 @@ GEM
       celluloid (~> 0.16.0)
       rb-fsevent (>= 0.9.3)
       rb-inotify (>= 0.9)
-    middleman (3.3.13)
+    middleman (3.3.12)
       coffee-script (~> 2.2)
       compass (>= 1.0.0, < 2.0.0)
       compass-import-once (= 1.0.5)
       execjs (~> 2.0)
       haml (>= 4.0.5)
       kramdown (~> 1.2)
-      middleman-core (= 3.3.13)
+      middleman-core (= 3.3.12)
       middleman-sprockets (>= 3.1.2)
       sass (>= 3.4.0, < 4.0)
       uglifier (~> 2.5)
-    middleman-core (3.3.13)
+    middleman-core (3.3.12)
       activesupport (~> 4.1.0)
       bundler (~> 1.1)
       erubis
diff --git a/website/source/assets/stylesheets/_docs.scss b/website/source/assets/stylesheets/_docs.scss
index 48a92b0a7..0cf800715 100755
--- a/website/source/assets/stylesheets/_docs.scss
+++ b/website/source/assets/stylesheets/_docs.scss
@@ -7,22 +7,23 @@ body.page-sub{
 }
 
 body.layout-atlas,
-body.layout-consul,
-body.layout-dnsimple,
-body.layout-dme,
-body.layout-docker,
+body.layout-aws,
+body.layout-azure,
 body.layout-cloudflare,
 body.layout-cloudstack,
+body.layout-consul,
+body.layout-digitalocean,
+body.layout-dme,
+body.layout-dnsimple,
+body.layout-docker,
 body.layout-google,
 body.layout-heroku,
 body.layout-mailgun,
 body.layout-openstack,
 body.layout-template,
-body.layout-digitalocean,
-body.layout-aws,
 body.layout-docs,
-body.layout-inner,
 body.layout-downloads,
+body.layout-inner,
 body.layout-intro{
 	background: $light-black image-url('sidebar-wire.png') left 62px no-repeat;
 
@@ -287,4 +288,3 @@ body.layout-intro{
 		}
 	}
 }
-
diff --git a/website/source/docs/commands/apply.html.markdown b/website/source/docs/commands/apply.html.markdown
index 9bb5acdbf..dec4ea19d 100644
--- a/website/source/docs/commands/apply.html.markdown
+++ b/website/source/docs/commands/apply.html.markdown
@@ -14,7 +14,7 @@ set of actions generated by a `terraform plan` execution plan.
 
 ## Usage
 
-Usage: `terraform apply [options] [dir]`
+Usage: `terraform apply [options] [dir-or-plan]`
 
 By default, `apply` scans the current directory for the configuration
 and applies the changes appropriately. However, a path to another configuration
diff --git a/website/source/docs/commands/destroy.html.markdown b/website/source/docs/commands/destroy.html.markdown
index 0a0f3a738..98f1b79e6 100644
--- a/website/source/docs/commands/destroy.html.markdown
+++ b/website/source/docs/commands/destroy.html.markdown
@@ -18,9 +18,11 @@ Usage: `terraform destroy [options] [dir]`
 Infrastructure managed by Terraform will be destroyed. This will ask for
 confirmation before destroying.
 
-This command accepts all the flags that the
-[apply command](/docs/commands/apply.html) accepts. If `-force` is
-set, then the destroy confirmation will not be shown.
+This command accepts all the arguments and flags that the [apply
+command](/docs/commands/apply.html) accepts, with the exception of a plan file
+argument.
+
+If `-force` is set, then the destroy confirmation will not be shown.
 
 The `-target` flag, instead of affecting "dependencies" will instead also
 destroy any resources that _depend on_ the target(s) specified.
diff --git a/website/source/docs/commands/output.html.markdown b/website/source/docs/commands/output.html.markdown
index ac1ab5a23..f1a70394e 100644
--- a/website/source/docs/commands/output.html.markdown
+++ b/website/source/docs/commands/output.html.markdown
@@ -21,4 +21,8 @@ current directory for the state file to query.
 The command-line flags are all optional. The list of available flags are:
 
 * `-state=path` - Path to the state file. Defaults to "terraform.tfstate".
-
+* `-module=module_name` - The module path which has needed output.
+    By default this is the root path. Other modules can be specified by
+    a period-separated list. Example: "foo" would reference the module
+    "foo" but "foo.bar" would reference the "bar" module in the "foo"
+    module.
diff --git a/website/source/docs/commands/push.html.markdown b/website/source/docs/commands/push.html.markdown
index 1a752e657..8c5af1f8f 100644
--- a/website/source/docs/commands/push.html.markdown
+++ b/website/source/docs/commands/push.html.markdown
@@ -52,10 +52,20 @@ The command-line flags are all optional. The list of available flags are:
 
 * `-no-color` - Disables output with coloring
 
+
+* `-overwrite=foo` - Marks a specific variable to be updated on Atlas.
+  Normally, if a variable is already set in Atlas, Terraform will not
+  send the local value (even if it is different). This forces it to
+  send the local value to Atlas. This flag can be repeated multiple times.
+
 * `-token=<token>` - Atlas API token to use to authorize the upload.
   If blank or unspecified, the `ATLAS_TOKEN` environmental variable
   will be used.
 
+* `-var='foo=bar'` - Set the value of a variable for the Terraform configuration.
+
+* `-var-file=foo` - Set the value of variables using a variable file.
+
 * `-vcs=true` - If true (default), then Terraform will detect if a VCS
   is in use, such as Git, and will only upload files that are comitted to
   version control. If no version control system is detected, Terraform will
@@ -78,6 +88,30 @@ all the files to be safe. To exclude certain files, specify the `-exclude`
 flag when pushing, or specify the `exclude` parameter in the
 [Atlas configuration section](/docs/configuration/atlas.html).
 
+## Terraform Variables
+
+When you `push`, Terraform will automatically set the local values of
+your Terraform variables on Atlas. The values are only set if they
+don't already exist on Atlas. If you want to force push a certain
+variable value to update it, use the `-overwrite` flag.
+
+All the variable values stored on Atlas are encrypted and secured
+using [Vault](https://vaultproject.io). We blogged about the
+[architecture of our secure storage system](https://hashicorp.com/blog/how-atlas-uses-vault-for-managing-secrets.html) if you want more detail.
+
+The variable values can be updated using the `-overwrite` flag or via
+the [Atlas website](https://atlas.hashicorp.com). An example of updating
+just a single variable `foo` is shown below:
+
+```
+$ terraform push -var 'foo=bar' -overwrite foo
+...
+```
+
+Both the `-var` and `-overwrite` flag are required. The `-var` flag
+sets the value locally (the exact same process as commands such as apply
+or plan), and the `-overwrite` flag tells the push command to update Atlas.
+
 ## Remote State Requirement
 
 `terraform push` requires that
diff --git a/website/source/docs/configuration/interpolation.html.md b/website/source/docs/configuration/interpolation.html.md
index 5c3ce791d..8235ce18d 100644
--- a/website/source/docs/configuration/interpolation.html.md
+++ b/website/source/docs/configuration/interpolation.html.md
@@ -72,8 +72,8 @@ are documented below.
 
 The supported built-in functions are:
 
-  * `concat(args...)` - Concatenates the values of multiple arguments into
-      a single string.
+  * `concat(list1, list2)` - Combines two or more lists into a single list.
+     Example: `combine(aws_instance.db.*.tags.Name, aws_instance.web.*.tags.Name)`
 
   * `element(list, index)` - Returns a single element from a list
       at the given index. If the index is greater than the number of
@@ -133,7 +133,7 @@ The supported built-in functions are:
 
 ## Templates
 
-Long strings can be managed using templates. Templates are [resources](/docs/configuration/resources.html) defined by a filename and some variables to use during interpolation. They have a computed `rendered` attribute containing the result.
+Long strings can be managed using templates. [Templates](/docs/providers/template/index.html) are [resources](/docs/configuration/resources.html) defined by a filename and some variables to use during interpolation. They have a computed `rendered` attribute containing the result.
 
 A template resource looks like:
 
@@ -160,3 +160,42 @@ ${hello} ${world}!
 Then the rendered value would be `goodnight moon!`.
 
 You may use any of the built-in functions in your template.
+
+
+### Using Templates with Count
+
+Here is an example that combines the capabilities of templates with the interpolation
+from `count` to give us a parametized template, unique to each resource instance:
+
+```
+variable "count" {
+  default = 2
+}
+
+variable "hostnames" {
+  default = {
+    "0" = "example1.org"
+    "1" = "example2.net"
+  }
+}
+
+resource "template_file" "web_init" {
+  // here we expand multiple template_files - the same number as we have instances
+  count = "${var.count}"
+  filename = "templates/web_init.tpl"
+  vars {
+    // that gives us access to use count.index to do the lookup
+    hostname = "${lookup(var.hostnames, count.index)}"
+  }
+}
+
+resource "aws_instance" "web" {
+  // ...
+  count = "${var.count}"
+  // here we link each web instance to the proper template_file
+  user_data = "${element(template_file.web_init.*.rendered, count.index)}"
+}
+```
+
+With this, we will build a list of `template_file.web_init` resources which we can
+use in combination with our list of `aws_instance.web` resources.
diff --git a/website/source/docs/configuration/resources.html.md b/website/source/docs/configuration/resources.html.md
index b1d7687d8..1ed50df98 100644
--- a/website/source/docs/configuration/resources.html.md
+++ b/website/source/docs/configuration/resources.html.md
@@ -129,7 +129,7 @@ resource "aws_instance" "app" {
 
 ## Multiple Provider Instances
 
-By default, a resource targets the resource based on its type. For example
+By default, a resource targets the provider based on its type. For example
 an `aws_instance` resource will target the "aws" provider. As of Terraform
 0.5.0, a resource can target any provider by name.
 
diff --git a/website/source/docs/modules/sources.html.markdown b/website/source/docs/modules/sources.html.markdown
index f8a3dd3c7..b0a2b4d0c 100644
--- a/website/source/docs/modules/sources.html.markdown
+++ b/website/source/docs/modules/sources.html.markdown
@@ -124,9 +124,15 @@ to Terraform (using the forced source type syntax documented below) to use
 Git:
 
 ```
+// force https source
 module "consul" {
 	source = "git::https://hashicorp.com/module.git"
 }
+
+// force ssh source
+module "ami" {
+	source = "git::ssh://git@github.com/owner/repo.git"
+}
 ```
 
 URLs for Git repositories (of any protocol) support the following query
diff --git a/website/source/docs/providers/atlas/r/artifact.html.markdown b/website/source/docs/providers/atlas/r/artifact.html.markdown
index 889413f21..3dee419f7 100644
--- a/website/source/docs/providers/atlas/r/artifact.html.markdown
+++ b/website/source/docs/providers/atlas/r/artifact.html.markdown
@@ -24,7 +24,7 @@ to this artifact will trigger a change to that instance.
 # Read the AMI
 resource "atlas_artifact" "web" {
     name = "hashicorp/web"
-    type = "aws.ami"
+    type = "amazon.ami"
     build = "latest"
     metadata {
         arch = "386"
diff --git a/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown b/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
index 10292d7e3..6d6215f22 100644
--- a/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/app_cookie_stickiness_policy.html.markdown
@@ -26,7 +26,7 @@ resource "aws_elb" "lb" {
 
 resource "aws_app_cookie_stickiness_policy" "foo" {
 	  name = "foo_policy"
-	  load_balancer = "${aws_elb.lb}"
+	  load_balancer = "${aws_elb.lb.id}"
 	  lb_port = 80
 	  cookie_name = "MyAppCookie"
 }
diff --git a/website/source/docs/providers/aws/r/autoscale.html.markdown b/website/source/docs/providers/aws/r/autoscaling_group.html.markdown
similarity index 98%
rename from website/source/docs/providers/aws/r/autoscale.html.markdown
rename to website/source/docs/providers/aws/r/autoscaling_group.html.markdown
index 2e4021e94..552ff8d57 100644
--- a/website/source/docs/providers/aws/r/autoscale.html.markdown
+++ b/website/source/docs/providers/aws/r/autoscaling_group.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_autoscaling_group"
-sidebar_current: "docs-aws-resource-autoscale"
+sidebar_current: "docs-aws-resource-autoscaling-group"
 description: |-
   Provides an AutoScaling Group resource.
 ---
@@ -110,7 +110,7 @@ Docs](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AutoScalingG
 for more information on an ASG's lifecycle.
 
 Terraform will wait for healthy instances for up to 10 minutes. If ASG creation
-is taking more than a few minutes, it's worth investigating for scaling actvity
+is taking more than a few minutes, it's worth investigating for scaling activity
 errors, which can be caused by problems with the selected Launch Configuration.
 
 #### Waiting for ELB Capacity
diff --git a/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown b/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown
new file mode 100644
index 000000000..e47d337c6
--- /dev/null
+++ b/website/source/docs/providers/aws/r/autoscaling_notification.html.markdown
@@ -0,0 +1,68 @@
+---
+layout: "aws"
+page_title: "AWS: aws_autoscaling_notification"
+sidebar_current: "docs-aws-resource-autoscaling-notification"
+description: |-
+  Provides an AutoScaling Group with Notification support
+---
+
+# aws\_autoscaling\_notification
+
+Provides an AutoScaling Group with Notification support, via SNS Topics. Each of
+the `notifications` map to a [Notification Configuration][2] inside Amazon Web
+Services, and are applied to each AutoScaling Group you supply.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "aws_autoscaling_notification" "example_notifications" {
+  group_names = [
+    "${aws_autoscaling_group.bar.name}",
+    "${aws_autoscaling_group.foo.name}",
+  ]
+  notifications  = [
+    "autoscaling:EC2_INSTANCE_LAUNCH", 
+    "autoscaling:EC2_INSTANCE_TERMINATE",
+    "autoscaling:EC2_INSTANCE_LAUNCH_ERROR"
+  ]
+  topic_arn = "${aws_sns_topic.example.arn}"
+}
+
+resource "aws_sns_topic" "example" {
+  name = "example-topic"
+  # arn is an exported attribute
+}
+
+resource "aws_autoscaling_group" "bar" {
+  name = "foobar1-terraform-test"
+  [... ASG attributes ...]
+}
+
+resource "aws_autoscaling_group" "foo" {
+  name = "barfoo-terraform-test"
+  [... ASG attributes ...]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `group_names` - (Required) A list of AutoScaling Group Names
+* `notifications` - (Required) A list of Notification Types that trigger
+notifications. Acceptable are documented [in the AWS documentation here][1]
+* `topic_arn` - (Required) The Topic ARN for notifications to be sent through
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `group_names` 
+* `notifications`
+* `topic_arn` 
+
+
+[1]: http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_NotificationConfiguration.html
+[2]: http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html 
diff --git a/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown b/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown
new file mode 100644
index 000000000..2543c0220
--- /dev/null
+++ b/website/source/docs/providers/aws/r/autoscaling_policy.html.markdown
@@ -0,0 +1,53 @@
+---
+layout: "aws"
+page_title: "AWS: aws_autoscaling_policy"
+sidebar_current: "docs-aws-resource-autoscaling-policy"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+# aws\_autoscaling\_policy
+
+Provides an AutoScaling Scaling Policy resource.
+
+~> **NOTE:** You may want to omit `desired_capacity` attribute from attached `aws_autoscaling_group`
+when using autoscaling policies. It's good practice to pick either
+[manual](http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-manual-scaling.html)
+or [dynamic](http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-scale-based-on-demand.html)
+(policy-based) scaling.
+
+## Example Usage
+```
+resource "aws_autoscaling_policy" "bat" {
+  name = "foobar3-terraform-test"
+  scaling_adjustment = 4
+  adjustment_type = "ChangeInCapacity"
+  cooldown = 300
+  autoscaling_group_name = "${aws_autoscaling_group.bar.name}"
+}
+
+resource "aws_autoscaling_group" "bar" {
+  availability_zones = ["us-east-1a"]
+  name = "foobar3-terraform-test"
+  max_size = 5
+  min_size = 2
+  health_check_grace_period = 300
+  health_check_type = "ELB"
+  force_delete = true
+  launch_configuration = "${aws_launch_configuration.foo.name}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the policy.
+* `autoscaling_group_name` - (Required) The name or ARN of the group.
+* `adjustment_type` - (Required) Specifies whether the `scaling_adjustment` is an absolute number or a percentage of the current capacity. Valid values are `ChangeInCapacity`, `ExactCapacity`, and `PercentChangeInCapacity`.
+* `scaling_adjustment` - (Required) The number of instances by which to scale. `adjustment_type` determines the interpretation of this number (e.g., as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity.
+* `cooldown` - (Optional) The amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `min_adjustment_step` - (Optional) Used with `adjustment_type` with the value `PercentChangeInCapacity`, the scaling policy changes the `desired_capacity` of the Auto Scaling group by at least the number of instances specified in the value.
+
+## Attribute Reference
+* `arn` - The ARN assigned by AWS to the scaling policy.
diff --git a/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown b/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown
new file mode 100644
index 000000000..e6ede269f
--- /dev/null
+++ b/website/source/docs/providers/aws/r/cloudwatch_metric_alarm.html.markdown
@@ -0,0 +1,75 @@
+---
+layout: "aws"
+page_title: "AWS: cloudwatch_metric_alarm"
+sidebar_current: "docs-aws-resource-cloudwatch-metric-alarm"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+# aws\_cloudwatch\_metric\_alarm
+
+Provides a CloudWatch Metric Alarm resource.
+
+## Example Usage
+```
+resource "aws_cloudwatch_metric_alarm" "foobar" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    insufficient_data_actions = []
+}
+```
+
+## Example in Conjuction with Scaling Policies
+```
+resource "aws_autoscaling_policy" "bat" {
+    name = "foobar3-terraform-test"
+    scaling_adjustment = 4
+    adjustment_type = "ChangeInCapacity"
+    cooldown = 300
+    autoscaling_group_name = "${aws_autoscaling_group.bar.name}"
+}
+
+resource "aws_cloudwatch_metric_alarm" "bat" {
+    alarm_name = "terraform-test-foobar5"
+    comparison_operator = "GreaterThanOrEqualToThreshold"
+    evaluation_periods = "2"
+    metric_name = "CPUUtilization"
+    namespace = "AWS/EC2"
+    period = "120"
+    statistic = "Average"
+    threshold = "80"
+    alarm_description = "This metric monitor ec2 cpu utilization"
+    alarm_actions = ["${aws_autoscaling_policy.bat.arn}"]
+}
+```
+## Argument Reference
+
+See [related part of AWS Docs](http://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)
+for details about valid values.
+
+The following arguments are supported:
+
+* `alarm_name` - (Required) The descriptive name for the alarm. This name must be unique within the user's AWS account
+* `comparison_operator` - (Required) The arithmetic operation to use when comparing the specified Statistic and Threshold. The specified Statistic value is used as the first operand. Either of the following is supported: `GreaterThanOrEqualToThreshold`, `GreaterThanThreshold`, `LessThanThreshold`, `LessThanOrEqualToThreshold`.
+* `evaluation_periods` - (Required) The number of periods over which data is compared to the specified threshold.
+* `metric_name` - (Required) The name for the alarm's associated metric.
+  See docs for [supported metrics]([valid metrics](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html)).
+* `namespace` - (Required) The namespace for the alarm's associated metric.
+* `period` - (Required) The period in seconds over which the specified `statistic` is applied.
+* `statistic` - (Required) The statistic to apply to the alarm's associated metric.
+   Either of the following is supported: `SampleCount`, `Average`, `Sum`, `Minimum`, `Maximum`
+* `threshold` - (Required) The value against which the specified statistic is compared.
+* `actions_enabled` - (Optional) Indicates whether or not actions should be executed during any changes to the alarm's state. Defaults to `true`.
+* `alarm_actions` - (Optional) The list of actions to execute when this alarm transitions into an ALARM state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `alarm_description` - (Optional) The description for the alarm.
+* `dimensions` - (Optional) The dimensions for the alarm's associated metric.
+* `insufficient_data_actions` - (Optional) The list of actions to execute when this alarm transitions into an INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `ok_actions` - (Optional) The list of actions to execute when this alarm transitions into an OK state from any other state. Each action is specified as an Amazon Resource Number (ARN).
+* `unit` - (Optional) The unit for the alarm's associated metric.
diff --git a/website/source/docs/providers/aws/r/db_instance.html.markdown b/website/source/docs/providers/aws/r/db_instance.html.markdown
index 22e82a939..784ade649 100644
--- a/website/source/docs/providers/aws/r/db_instance.html.markdown
+++ b/website/source/docs/providers/aws/r/db_instance.html.markdown
@@ -29,6 +29,9 @@ resource "aws_db_instance" "default" {
 
 ## Argument Reference
 
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](http://docs.aws.amazon.com/AmazonRDS/latest/CommandLineReference/CLIReference-cmd-ModifyDBInstance.html).
+
 The following arguments are supported:
 
 * `allocated_storage` - (Required) The allocated storage in gigabytes.
@@ -54,6 +57,8 @@ The following arguments are supported:
 * `iops` - (Optional) The amount of provisioned IOPS. Setting this implies a
     storage_type of "io1".
 * `maintenance_window` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+  See [RDS Maintenance Window docs](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AdjustingTheMaintenanceWindow.html) for more.
 * `multi_az` - (Optional) Specifies if the RDS instance is multi-AZ
 * `port` - (Optional) The port on which the DB accepts connections.
 * `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible.
@@ -65,7 +70,7 @@ The following arguments are supported:
 * `storage_encrypted` - (Optional) Specifies whether the DB instance is encrypted. The default is `false` if not specified.
 * `apply_immediately` - (Optional) Specifies whether any database modifications
      are applied immediately, or during the next maintenance window. Default is
-     `false`. See [Amazon RDS Documentation for more for more information.](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+     `false`. See [Amazon RDS Documentation for more information.](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
 * `replicate_source_db` - (Optional) Specifies that this resource is a Replicate
 database, and to use this value as the source database. This correlates to the
 `identifier` of another Amazon RDS Database to replicate. See
@@ -100,5 +105,4 @@ The following attributes are exported:
 * `username` - The master username for the database
 * `storage_encrypted` - Specifies whether the DB instance is encrypted
 
-
 [1]: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
diff --git a/website/source/docs/providers/aws/r/db_security_group.html.markdown b/website/source/docs/providers/aws/r/db_security_group.html.markdown
index 85041f522..7a9242677 100644
--- a/website/source/docs/providers/aws/r/db_security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/db_security_group.html.markdown
@@ -8,7 +8,10 @@ description: |-
 
 # aws\_db\_security\_group
 
-Provides an RDS security group resource.
+Provides an RDS security group resource. This is only for DB instances in the
+EC2-Classic Platform. For instances inside a VPC, use the
+[`aws_db_instance.vpc_security_group_ids`](/docs/providers/aws/r/db_instance.html#vpc_security_group_ids)
+attribute instead.
 
 ## Example Usage
 
diff --git a/website/source/docs/providers/aws/r/dynamodb_table.html.markdown b/website/source/docs/providers/aws/r/dynamodb_table.html.markdown
new file mode 100644
index 000000000..29ceb0595
--- /dev/null
+++ b/website/source/docs/providers/aws/r/dynamodb_table.html.markdown
@@ -0,0 +1,113 @@
+---
+layout: "aws"
+page_title: "AWS: dynamodb_table"
+sidebar_current: "docs-aws-resource-dynamodb-table"
+description: |-
+  Provides a DynamoDB table resource
+---
+
+# aws\_dynamodb\_table
+
+Provides a DynamoDB table resource
+
+## Example Usage
+
+The following dynamodb table description models the table and GSI shown
+in the [AWS SDK example documentation](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html)
+
+```
+resource "aws_dynamodb_table" "basic-dynamodb-table" {
+    name = "GameScores"
+    read_capacity = 20
+    write_capacity = 20
+    hash_key = "UserId"
+    range_key = "GameTitle"
+    attribute {
+      name = "UserId"
+      type = "S"
+    }
+    attribute {
+      name = "GameTitle"
+      type = "S"
+    }
+    attribute {
+      name = "TopScore"
+      type = "N"
+    }
+    global_secondary_index {
+      name = "GameTitleIndex"
+      hash_key = "GameTitle"
+      range_key = "TopScore"
+      write_capacity = 10
+      read_capacity = 10
+      projection_type = "INCLUDE"
+      non_key_attributes = [ "UserId" ]
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the table, this needs to be unique
+  within a region.
+* `read_capacity` - (Required) The number of read units for this table
+* `write_capacity` - (Required) The number of write units for this table
+* `hash_key` - (Required) The attribute to use as the hash key (the
+  attribute must also be defined as an attribute record
+* `range_key` - (Optional) The attribute to use as the range key (must
+  also be defined)
+* `attribute` - Define an attribute, has two properties:
+  * `name` - The name of the attribute
+  * `type` - One of: S, N, or B for (S)tring, (N)umber or (B)inary data
+* `local_secondary_index` - (Optional) Describe an LSI on the table;
+  these can only be allocated *at creation* so you cannot change this
+definition after you have created the resource. 
+* `global_secondary_index` - (Optional) Describe a GSO for the table;
+  subject to the normal limits on the number of GSIs, projected
+attributes, etc.  
+
+For both `local_secondary_index` and `global_secondary_index` objects,
+the following properties are supported:
+
+* `name` - (Required) The name of the LSI or GSI
+* `hash_key` - (Required) The name of the hash key in the index; must be
+  defined as an attribute in the resource
+* `range_key` - (Required) The name of the range key; must be defined
+* `projection_type` - (Required) One of "ALL", "INCLUDE" or "KEYS_ONLY"
+   where *ALL* projects every attribute into the index, *KEYS_ONLY*
+    projects just the hash and range key into the index, and *INCLUDE*
+    projects only the keys specified in the _non_key_attributes_
+parameter. 
+* `non_key_attributes` - (Optional) Only required with *INCLUDE* as a
+  projection type; a list of attributes to project into the index. These
+do not need to be defined as attributes on the table. 
+
+For `global_secondary_index` objects only, you need to specify
+`write_capacity` and `read_capacity` in the same way you would for the
+table as they have separate I/O capacity.
+
+### A note about attributes
+
+Only define attributes on the table object that are going to be used as:
+
+* Table hash key or range key
+* LSI or GSI hash key or range key
+
+The DynamoDB API expects attribute structure (name and type) to be 
+passed along when creating or updating GSI/LSIs or creating the initial 
+table. In these cases it expects the Hash / Range keys to be provided; 
+because these get re-used in numerous places (i.e the table's range key 
+could be a part of one or more GSIs), they are stored on the table 
+object to prevent duplication and increase consistency. If you add 
+attributes here that are not used in these scenarios it can cause an 
+infinite loop in planning.  
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The name of the table
+
diff --git a/website/source/docs/providers/aws/r/ebs_volume.html.md b/website/source/docs/providers/aws/r/ebs_volume.html.md
index 0cc75c7b8..00bb639a6 100644
--- a/website/source/docs/providers/aws/r/ebs_volume.html.md
+++ b/website/source/docs/providers/aws/r/ebs_volume.html.md
@@ -3,7 +3,7 @@ layout: "aws"
 page_title: "AWS: aws_ebs_volume"
 sidebar_current: "docs-aws-resource-ebs-volume"
 description: |-
-  Provides an Elastic IP resource.
+  Provides an elastic block storage resource.
 ---
 
 # aws\_ebs\_volume
@@ -16,6 +16,9 @@ Manages a single EBS volume.
 resource "aws_ebs_volume" "example" {
     availability_zone = "us-west-1a"
     size = 40
+    tags {
+        Name = "HelloWorld"
+    }
 }
 ```
 
@@ -27,6 +30,15 @@ The following arguments are supported:
 * `encrypted` - (Optional) If true, the disk will be encrypted.
 * `iops` - (Optional) The amount of IOPS to provision for the disk.
 * `size` - (Optional) The size of the drive in GB.
-* `snapshot_id` (Optinal) A snapshot to base the EBS volume off of.
+* `snapshot_id` (Optional) A snapshot to base the EBS volume off of.
 * `type` - (Optional) The type of EBS volume.
 * `kms_key_id` - (Optional) The KMS key ID for the volume.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The volume ID (e.g. vol-59fcb34e).
+
+
diff --git a/website/source/docs/providers/aws/r/ecs_cluster.html.markdown b/website/source/docs/providers/aws/r/ecs_cluster.html.markdown
new file mode 100644
index 000000000..d00e05fab
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_cluster.html.markdown
@@ -0,0 +1,32 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+sidebar_current: "docs-aws-resource-ecs-cluster"
+description: |-
+  Provides an ECS cluster.
+---
+
+# aws\_ecs\_cluster
+
+Provides an ECS cluster.
+
+## Example Usage
+
+```
+resource "aws_ecs_cluster" "foo" {
+  name = "white-hart"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `name` - The name of the cluster
+* `id` - The Amazon Resource Name (ARN) that identifies the cluster
diff --git a/website/source/docs/providers/aws/r/ecs_service.html.markdown b/website/source/docs/providers/aws/r/ecs_service.html.markdown
new file mode 100644
index 000000000..cd45b788a
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_service.html.markdown
@@ -0,0 +1,59 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+sidebar_current: "docs-aws-resource-ecs-service"
+description: |-
+  Provides an ECS service.
+---
+
+# aws\_ecs\_service
+
+Provides an ECS service - effectively a task that is expected to run until an error occures or user terminates it (typically a webserver or a database). 
+
+See [ECS Services section in AWS developer guide](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html).
+
+## Example Usage
+
+```
+resource "aws_ecs_service" "mongo" {
+  name = "mongodb"
+  cluster = "${aws_ecs_cluster.foo.id}"
+  task_definition = "${aws_ecs_task_definition.mongo.arn}"
+  desired_count = 3
+  iam_role = "${aws_iam.foo.id}"
+
+  load_balancer {
+    elb_name = "${aws_elb.foo.id}"
+    container_name = "mongo"
+    container_port = 8080
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the service (up to 255 letters, numbers, hyphens, and underscores)
+* `task_definition` - (Required) The family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service.
+* `desired_count` - (Required) The number of instances of the task definition to place and keep running
+* `cluster` - (Optional) ARN of an ECS cluster
+* `iam_role` - (Optional) IAM role that allows your Amazon ECS container agent to make calls to your load balancer on your behalf. This parameter is only required if you are using a load balancer with your service.
+* `load_balancer` - (Optional) A load balancer block. Load balancers documented below.
+
+Load balancers support the following:
+
+* `elb_name` - (Required) The name of the load balancer.
+* `container_name` - (Required) The name of the container to associate with the load balancer (as it appears in a container definition).
+* `container_port` - (Required) The port on the container to associate with the load balancer.
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the service
+* `name` - The name of the service
+* `cluster` - The Amazon Resource Name (ARN) of cluster which the service runs on
+* `iam_role` - The ARN of IAM role used for ELB
+* `desired_count` - The number of instances of the task definition
diff --git a/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown b/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown
new file mode 100644
index 000000000..e89a81e1a
--- /dev/null
+++ b/website/source/docs/providers/aws/r/ecs_task_definition.html.markdown
@@ -0,0 +1,46 @@
+---
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+sidebar_current: "docs-aws-resource-ecs-task-definition"
+description: |-
+  Provides an ECS task definition.
+---
+
+# aws\_ecs\_task\_definition
+
+Provides an ECS task definition to be used in `aws_ecs_service`.
+
+## Example Usage
+
+```
+resource "aws_ecs_task_definition" "jenkins" {
+  family = "jenkins"
+  container_definitions = "${file("task-definitions/jenkins.json")}"
+
+  volume {
+    name = "jenkins-home"
+    host_path = "/ecs/jenkins-home"
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `family` - (Required) The family, unique name for your task definition.
+* `container_definitions` - (Required) A list of container definitions in JSON format. See [AWS docs](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_defintions.html) for syntax.
+* `volume` - (Optional) A volume block. Volumes documented below.
+
+Volumes support the following:
+
+* `name` - (Required) The name of the volume. This name is referenced in the `sourceVolume` parameter of container definition `mountPoints`.
+* `host_path` - (Required) The path on the host container instance that is presented to the container.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `arn` - Full ARN of the task definition (including both `family` & `revision`)
+* `family` - The family of the task definition.
+* `revision` - The revision of the task in a particular family.
diff --git a/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown b/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
index ccc4429dd..bbc52ac2c 100644
--- a/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_cluster.html.markdown
@@ -1,9 +1,9 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_cluster"
 sidebar_current: "docs-aws-resource-elasticache-cluster"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Cluster resource.
 ---
 
 # aws\_elasticache\_cluster
@@ -17,6 +17,7 @@ resource "aws_elasticache_cluster" "bar" {
     cluster_id = "cluster-example"
     engine = "memcached"
     node_type = "cache.m1.small"
+    port = 11211
     num_cache_nodes = 1
     parameter_group_name = "default.memcached1.4"
 }
@@ -47,8 +48,8 @@ value must be between 1 and 20
 * `parameter_group_name` – (Required) Name of the parameter group to associate
 with this cache cluster
 
-* `port` – (Optional) The port number on which each of the cache nodes will
-accept connections. Default 11211.
+* `port` – (Required) The port number on which each of the cache nodes will
+accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
 
 * `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used
 for the cache cluster.
@@ -59,18 +60,19 @@ names to associate with this cache cluster
 * `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated
  with the cache cluster
 
+* `apply_immediately` - (Optional) Specifies whether any database modifications
+     are applied immediately, or during the next maintenance window. Default is
+     `false`. See [Amazon ElastiCache Documentation for more information.][1]
+     (Available since v0.6.0)
+
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
 
 ## Attributes Reference
 
 The following attributes are exported:
 
-* `cluster_id`
-* `engine`
-* `engine_version`
-* `node_type`
-* `num_cache_nodes`
-* `parameter_group_name`
-* `port`
-* `subnet_group_name`
-* `security_group_names`
-* `security_group_ids`
+* `cache_nodes` - List of node objects including `id`, `address` and `port`.
+   Referenceable e.g. as `${aws_elasticache_cluster.bar.cache_nodes.0.address}`
+
+[1]: http://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html
diff --git a/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown
new file mode 100644
index 000000000..f7cf29340
--- /dev/null
+++ b/website/source/docs/providers/aws/r/elasticache_parameter_group.html.markdown
@@ -0,0 +1,49 @@
+---
+layout: "aws"
+page_title: "AWS: aws_elasticache_parameter_group"
+sidebar_current: "docs-aws-resource-elasticache-parameter-group"
+---
+
+# aws\_elasticache\_parameter\_group
+
+Provides an ElastiCache parameter group resource.
+
+## Example Usage
+
+```
+resource "aws_elasticache_parameter_group" "default" {
+    name = "cache-params"
+    family = "redis2.8"
+    description = "Cache cluster default param group"
+
+    parameter {
+        name = "activerehashing"
+        value = "yes"
+    }
+
+    parameter {
+        name = "min-slaves-to-write"
+        value = "2"
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the ElastiCache parameter group.
+* `family` - (Required) The family of the ElastiCache parameter group.
+* `description` - (Required) The description of the ElastiCache parameter group.
+* `parameter` - (Optional) A list of ElastiCache parameters to apply.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the ElastiCache parameter.
+* `value` - (Required) The value of the ElastiCache parameter.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ElastiCache parameter group name.
diff --git a/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
index 15370140b..be5e0c877 100644
--- a/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_security_group.html.markdown
@@ -1,9 +1,9 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_security_group"
 sidebar_current: "docs-aws-resource-elasticache-security-group"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Security Group to control access to one or more cache clusters.
 ---
 
 # aws\_elasticache\_security\_<wbr>group
diff --git a/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown b/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
index ad80e5a29..213987de5 100644
--- a/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
+++ b/website/source/docs/providers/aws/r/elasticache_subnet_group.html.markdown
@@ -1,9 +1,9 @@
 ---
 layout: "aws"
-page_title: "AWS: aws_subnet"
+page_title: "AWS: aws_elasticache_subnet_group"
 sidebar_current: "docs-aws-resource-elasticache-subnet-group"
 description: |-
-  Provides an VPC subnet resource.
+  Provides an ElastiCache Subnet Group resource.
 ---
 
 # aws\_elasticache\_subnet\_group
@@ -47,7 +47,7 @@ The following arguments are supported:
 * `description` – (Required) Description for the cache subnet group
 * `name` – (Required) Name for the cache subnet group. This value is stored as 
 a lowercase string
-* `subnet_ids` – (Optional) List of VPC Subnet IDs for the cache subnet group
+* `subnet_ids` – (Required) List of VPC Subnet IDs for the cache subnet group
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/elb.html.markdown b/website/source/docs/providers/aws/r/elb.html.markdown
index 1f4a0b507..9c63788d3 100644
--- a/website/source/docs/providers/aws/r/elb.html.markdown
+++ b/website/source/docs/providers/aws/r/elb.html.markdown
@@ -46,6 +46,10 @@ resource "aws_elb" "bar" {
   idle_timeout = 400
   connection_draining = true
   connection_draining_timeout = 400
+
+  tags {
+    Name = "foobar-terraform-elb"
+  }
 }
 ```
 
@@ -65,6 +69,7 @@ The following arguments are supported:
 * `idle_timeout` - (Optional) The time in seconds that the connection is allowed to be idle. Default: 60.
 * `connection_draining` - (Optional) Boolean to enable connection draining.
 * `connection_draining_timeout` - (Optional) The time in seconds to allow for connections to drain. 
+* `tags` - (Optional) A mapping of tags to assign to the resource.
 
 Exactly one of `availability_zones` or `subnets` must be specified: this
 determines if the ELB exists in a VPC or in EC2-classic.
diff --git a/website/source/docs/providers/aws/r/flow_log.html.markdown b/website/source/docs/providers/aws/r/flow_log.html.markdown
new file mode 100644
index 000000000..0de997c3d
--- /dev/null
+++ b/website/source/docs/providers/aws/r/flow_log.html.markdown
@@ -0,0 +1,84 @@
+---
+layout: "aws"
+page_title: "AWS: aws_flow_log"
+sidebar_current: "docs-aws-resource-flow-log"
+description: |-
+  Provides a VPC/Subnet/ENI Flow Log
+---
+
+# aws\_flow\_log
+
+Provides a VPC/Subnet/ENI Flow Log to capture IP traffic for a specific network
+interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group.
+
+```
+resource "aws_flow_log" "test_flow_log" {
+  # log_group_name needs to exist before hand
+  # until we have a CloudWatch Log Group Resource
+  log_group_name = "tf-test-log-group"
+	iam_role_arn = "${aws_iam_role.test_role.arn}"
+  vpc_id = "${aws_vpc.default.id}"
+  traffic_type = "ALL"
+}
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "vpc-flow-logs.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+} 
+EOF
+}
+
+resource "aws_iam_role_policy" "test_policy" {
+    name = "test_policy"
+    role = "${aws_iam_role.test_role.id}"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}   
+EOF
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `log_group_name` - (Required) The name of the CloudWatch log group
+* `iam_role_arn` - (Required) The ARN for the IAM role that's used to post flow
+  logs to a CloudWatch Logs log group
+* `vpc_id` - (Optional) VPC ID to attach to
+* `subnet_id` - (Optional) Subnet ID to attach to
+* `eni_id` - (Optional) Elastic Network Interface ID to attach to
+* `traffic_type` - (Required) The type of traffic to capture. Valid values:
+  `ACCEPT`,`REJECT`, `ALL`
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Flow Log ID
diff --git a/website/source/docs/providers/aws/r/iam_group_membership.html.markdown b/website/source/docs/providers/aws/r/iam_group_membership.html.markdown
new file mode 100644
index 000000000..8714a827c
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_group_membership.html.markdown
@@ -0,0 +1,56 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+sidebar_current: "docs-aws-resource-iam-group-membership"
+description: |-
+  Provides an IAM role.
+---
+
+# aws\_iam\_group\_membership
+
+Provides a top level resource to manage IAM Group membership for IAM Users. For
+more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or
+[IAM Users][2]
+
+## Example Usage
+
+```
+resource "aws_iam_group_membership" "team" {
+	name = "tf-testing-group-membership"
+	users = [
+		"${aws_iam_user.user_one.name}",
+		"${aws_iam_user.user_two.name}",
+	]
+	group = "${aws_iam_group.group.name}"
+}
+
+resource "aws_iam_group" "group" {
+	name = "test-group"
+}
+
+resource "aws_iam_user" "user_one" {
+	name = "test-user"
+}
+
+resource "aws_iam_user" "user_two" {
+	name = "test-user-two"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name to identify the Group Membership
+* `users` - (Required) A list of IAM User names to associate with the Group
+* `group` – (Required) The IAM Group name to attach the list of `users` to
+
+## Attributes Reference
+
+* `name` - The name to identifing the Group Membership
+* `users` - list of IAM User names 
+* `group` – IAM Group name 
+
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
diff --git a/website/source/docs/providers/aws/r/iam_group_policy.html.markdown b/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
index 9916e8ca0..f5efa8619 100644
--- a/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_group_policy.html.markdown
@@ -43,7 +43,7 @@ resource "aws_iam_group" "my_developers" {
 The following arguments are supported:
 
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `name` - (Required) Name of the policy.
 * `group` - (Required) The IAM group to attach to the policy.
 
diff --git a/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown b/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
index 580cb3dca..c09ff6dc8 100644
--- a/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_instance_profile.html.markdown
@@ -23,16 +23,15 @@ resource "aws_iam_role" "role" {
     path = "/"
     assume_role_policy = <<EOF
 {
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {"AWS": "*"},
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
 }
 EOF
 }
diff --git a/website/source/docs/providers/aws/r/iam_policy.html.markdown b/website/source/docs/providers/aws/r/iam_policy.html.markdown
index db8affeff..aea36b66e 100644
--- a/website/source/docs/providers/aws/r/iam_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_policy.html.markdown
@@ -39,7 +39,7 @@ The following arguments are supported:
 * `description` - (Optional) Description of the IAM policy.
 * `path` - (Optional, default "/") Path in which to create the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `name` (Required) - The name of the policy.
 
 ## Attributes Reference
diff --git a/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown b/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown
new file mode 100644
index 000000000..4cc0e18cb
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_policy_attachment.html.markdown
@@ -0,0 +1,54 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_policy_attachment"
+sidebar_current: "docs-aws-resource-iam-policy-attachment"
+description: |-
+  Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+---
+
+# aws\_iam\_policy\_attachment
+
+Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+
+```
+resource "aws_iam_user" "user" {
+    name = "test-user"
+}
+resource "aws_iam_role" "role" {
+    name = "test-role"
+}
+resource "aws_iam_group" "group" {
+    name = "test-group"
+}
+
+resource "aws_iam_policy" "policy" {
+    name = "test-policy"
+    description = "A test policy"
+    policy = 	#omitted
+}
+
+resource "aws_iam_policy_attachment" "test-attach" {
+    name = "test-attachment"
+    users = ["${aws_iam_user.user.name}"]
+    roles = ["${aws_iam_role.role.name}"]
+    groups = ["${aws_iam_group.group.name}"]
+    policy_arn = "${aws_iam_policy.policy.arn}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` 		(Required) - The name of the policy.
+* `users`		(Optional) - The user(s) the policy should be applied to
+* `roles		(Optional) - The role(s) the policy should be applied to`
+* `groups		(Optional) - The group(s) the policy should be applied to`
+* `policy_arn`	(Required) - The ARN of the policy you want to apply
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The policy's ID.
+* `name` - The name of the policy.
diff --git a/website/source/docs/providers/aws/r/iam_role_policy.html.markdown b/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
index 2e9fe4620..a9418632e 100644
--- a/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/iam_role_policy.html.markdown
@@ -18,18 +18,18 @@ resource "aws_iam_role_policy" "test_policy" {
     role = "${aws_iam_role.test_role.id}"
     policy = <<EOF
 {
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {"AWS": "*"},
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
 }
 EOF
+}
 
 resource "aws_iam_role" "test_role" {
     name = "test_role"
@@ -57,7 +57,7 @@ The following arguments are supported:
 
 * `name` - (Required) The name of the role policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string.
-  The heredoc syntax or `file` funciton is helpful here.
+  The heredoc syntax or `file` function is helpful here.
 * `role` - (Required) The IAM role to attach to the policy.
 
 ## Attributes Reference
diff --git a/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown b/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown
new file mode 100644
index 000000000..820bc6f89
--- /dev/null
+++ b/website/source/docs/providers/aws/r/iam_server_certificate.html.markdown
@@ -0,0 +1,102 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+sidebar_current: "docs-aws-resource-iam-server-certificate"
+description: |-
+  Provides an IAM Server Certificate
+---
+
+# aws\_iam\_server\_certificate
+
+Provides an IAM Server Certificate resource to upload Server Certificates.
+Certs uploaded to IAM can easily work with other AWS services such as:
+
+- AWS Elastic Beanstalk
+- Elastic Load Balancing
+- CloudFront
+- AWS OpsWorks
+
+For information about server certificates in IAM, see [Managing Server
+Certficates][2] in AWS Documentation.
+
+## Example Usage
+
+**Using certs on file:**
+
+```
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "some_test_cert"
+  certificate_body = "${file("self-ca-cert.pem")}"
+  private_key = "${file("test-key.pem")}"
+}
+```
+
+**Example with cert in-line:**
+
+```
+resource "aws_iam_server_certificate" "test_cert_alt" {
+  name = "alt_test_cert"
+  certificate_body = <<EOF
+-----BEGIN CERTIFICATE-----
+[......] # cert contents
+-----END CERTIFICATE-----
+EOF
+
+  private_key =  <<EOF
+-----BEGIN RSA PRIVATE KEY-----
+[......] # cert contents
+-----END CERTIFICATE-----
+EOF
+}
+```
+
+**Use in combination with an AWS ELB resource:**
+
+```
+resource "aws_iam_server_certificate" "test_cert" {
+  name = "some_test_cert"
+  certificate_body = "${file("self-ca-cert.pem")}"
+  private_key = "${file("test-key.pem")}"
+}
+
+resource "aws_elb" "ourapp" {
+  name = "terraform-asg-deployment-example"
+  availability_zones = ["us-west-2a"]
+  cross_zone_load_balancing = true
+
+  listener {
+    instance_port = 8000
+    instance_protocol = "http"
+    lb_port = 443
+    lb_protocol = "https"
+    ssl_certificate_id = "${aws_iam_server_certificate.test_cert.arn}"
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the Server Certificate. Do not include the 
+  path in this value.
+* `certificate_body` – (Required) The contents of the public key certificate in 
+  PEM-encoded format.
+* `certificate_chain` – (Optional) The contents of the certificate chain. 
+  This is typically a concatenation of the PEM-encoded public key certificates 
+  of the chain. 
+* `private_key` – (Required) The contents of the private key in PEM-encoded format.
+* `path` - (Optional) The IAM path for the server certificate.  If it is not 
+    included, it defaults to a slash (/). If this certificate is for use with
+    AWS CloudFront, the path must be in format `/cloudfront/your_path_here`.
+    See [IAM Identifiers][1] for more details on IAM Paths.
+
+## Attributes Reference
+
+* `id` - The unique Server Certificate name
+* `name` - The name of the Server Certificate
+* `arn` - The Amazon Resource Name (ARN) specifying the server certificate.
+
+
+[1]: http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html
+[2]: http://docs.aws.amazon.com/IAM/latest/UserGuide/ManagingServerCerts.html
diff --git a/website/source/docs/providers/aws/r/instance.html.markdown b/website/source/docs/providers/aws/r/instance.html.markdown
index 080ccb871..22cbe68cd 100644
--- a/website/source/docs/providers/aws/r/instance.html.markdown
+++ b/website/source/docs/providers/aws/r/instance.html.markdown
@@ -38,6 +38,7 @@ The following arguments are supported:
      Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination)
 * `instance_type` - (Required) The type of instance to start
 * `key_name` - (Optional) The key name to use for the instance.
+* `monitoring` - (Optional) If true, the launched EC2 instance will have detailed monitoring enabled. (Available since v0.6.0)
 * `security_groups` - (Optional) A list of security group names to associate with.
    If you are within a non-default VPC, you'll need to use `vpc_security_group_ids` instead.
 * `vpc_security_group_ids` - (Optional) A list of security group IDs to associate with.
@@ -95,7 +96,7 @@ Each `ebs_block_device` supports the following:
   on instance termination (Default: `true`).
 * `encrypted` - (Optional) Enables [EBS
   encryption](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)
-  on the volume (Default: `false`).
+  on the volume (Default: `false`). Cannot be used with `snapshot_id`.
 
 Modifying any `ebs_block_device` currently requires resource replacement.
 
diff --git a/website/source/docs/providers/aws/r/kinesis_stream.html.markdown b/website/source/docs/providers/aws/r/kinesis_stream.html.markdown
new file mode 100644
index 000000000..a667bb427
--- /dev/null
+++ b/website/source/docs/providers/aws/r/kinesis_stream.html.markdown
@@ -0,0 +1,44 @@
+---
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+sidebar_current: "docs-aws-resource-kinesis-stream"
+description: |-
+  Provides a AWS Kinesis Stream
+---
+
+# aws\_kinesis\_stream
+
+Provides a Kinesis Stream resource. Amazon Kinesis is a managed service that 
+scales elastically for real-time processing of streaming big data.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```
+resource "aws_kinesis_stream" "test_stream" {
+	name = "terraform-kinesis-test"
+	shard_count = 1
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) A name to identify the stream. This is unique to the 
+AWS account and region the Stream is created in.
+* `shard_count` – (Required) The number of shards that the stream will use.
+Amazon has guidlines for specifying the Stream size that should be referenced 
+when creating a Kinesis stream. See [Amazon Kinesis Streams][2] for more.
+
+## Attributes Reference
+
+* `id` - The unique Stream id
+* `name` - The unique Stream name (same as `id`)
+* `shard_count` - The count of Shards for this Stream
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream
+
+
+[1]: http://aws.amazon.com/documentation/kinesis/
+[2]: http://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html
diff --git a/website/source/docs/providers/aws/r/lambda_function.html.markdown b/website/source/docs/providers/aws/r/lambda_function.html.markdown
new file mode 100644
index 000000000..4c931fbad
--- /dev/null
+++ b/website/source/docs/providers/aws/r/lambda_function.html.markdown
@@ -0,0 +1,66 @@
+---
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+sidebar_current: "docs-aws-resource-aws-lambda-function"
+description: |-
+  Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS. The Lambda Function itself includes source code and runtime configuration.
+---
+
+# aws\_lambda\_function
+
+Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS. The Lambda Function itself includes source code and runtime configuration.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+
+## Example Usage
+
+```
+resource "aws_iam_role" "iam_for_lambda" {
+    name = "iam_for_lambda"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_lambda_function" "test_lambda" {
+    filename = "lambda_function_payload.zip"
+    function_name = "lambda_function_name"
+    role = "${aws_iam_role.iam_for_lambda.arn}"
+    handler = "exports.test"
+}
+```
+
+## Argument Reference
+
+* `filename` - (Required) A [zip file][2] containing your lambda function source code.
+* `function_name` - (Required) A unique name for your Lambda Function.
+* `handler` - (Required) The function [entrypoint][3] in your code.
+* `role` - (Required) IAM role attached to the Lambda Function. This governs both who / what can invoke your Lambda Function, as well as what resources our Lambda Function has access to. See [Lambda Permission Model][4] for more details.
+* `description` - (Optional) Description of what your Lambda Function does.
+* `memory_size` - (Optional) Amount of memory in MB your Lambda Function can use at runtime. Defaults to `128`. See [Limits][5]
+* `runtime` - (Optional) Defaults to `nodejs`.
+* `timeout` - (Optional) The amount of time your Lambda Function has to run in seconds. Defaults to `3`. See [Limits][5]
+
+## Attributes Reference
+
+* `arn` - The Amazon Resource Name (ARN) identifying your Lambda Function.
+* `last_modified` - The date this resource was last modified.
+
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/walkthrough-s3-events-adminuser-create-test-function-create-function.html
+[3]: http://docs.aws.amazon.com/lambda/latest/dg/walkthrough-custom-events-create-test-function.html
+[4]: http://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
+[5]: http://docs.aws.amazon.com/lambda/latest/dg/limits.html
diff --git a/website/source/docs/providers/aws/r/launch_config.html.markdown b/website/source/docs/providers/aws/r/launch_configuration.html.markdown
similarity index 96%
rename from website/source/docs/providers/aws/r/launch_config.html.markdown
rename to website/source/docs/providers/aws/r/launch_configuration.html.markdown
index 67954017a..49201e6f5 100644
--- a/website/source/docs/providers/aws/r/launch_config.html.markdown
+++ b/website/source/docs/providers/aws/r/launch_configuration.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_launch_configuration"
-sidebar_current: "docs-aws-resource-launch-config"
+sidebar_current: "docs-aws-resource-launch-configuration"
 description: |-
   Provides a resource to create a new launch configuration, used for autoscaling groups.
 ---
@@ -34,6 +34,7 @@ The following arguments are supported:
 * `security_groups` - (Optional) A list of associated security group IDS.
 * `associate_public_ip_address` - (Optional) Associate a public ip address with an instance in a VPC.
 * `user_data` - (Optional) The user data to provide when launching the instance.
+* `enable_monitoring` - (Optional) Enables/disables detailed monitoring. This is enabled by default.
 * `block_device_mapping` - (Optional) A list of block devices to add. Their keys are documented below.
 
 <a id="block-devices"></a>
diff --git a/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown b/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
index ea3e0f63e..bb4ad524e 100644
--- a/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
+++ b/website/source/docs/providers/aws/r/lb_cookie_stickiness_policy.html.markdown
@@ -26,7 +26,7 @@ resource "aws_elb" "lb" {
 
 resource "aws_lb_cookie_stickiness_policy" "foo" {
 	  name = "foo_policy"
-	  load_balancer = "${aws_elb.lb}"
+	  load_balancer = "${aws_elb.lb.id}"
 	  lb_port = 80
 	  cookie_expiration_period = 600
 }
diff --git a/website/source/docs/providers/aws/r/network_acl.html.markdown b/website/source/docs/providers/aws/r/network_acl.html.markdown
index 3451b55ff..1dc11e902 100644
--- a/website/source/docs/providers/aws/r/network_acl.html.markdown
+++ b/website/source/docs/providers/aws/r/network_acl.html.markdown
@@ -62,6 +62,10 @@ Both `egress` and `ingress` support the following keys:
 protocol, you must specify a from and to port of 0.
 * `cidr_block` - (Optional) The CIDR block to match. This must be a
 valid network mask.
+* `icmp_type` - (Optional) The ICMP type to be used. Default 0.
+* `icmp_code` - (Optional) The ICMP type code to be used. Default 0.
+
+~> Note: For more information on ICMP types and codes, see here: http://www.nthelp.com/icmp.html
 
 ## Attributes Reference
 
diff --git a/website/source/docs/providers/aws/r/network_interface.markdown b/website/source/docs/providers/aws/r/network_interface.markdown
new file mode 100644
index 000000000..8144d8f0f
--- /dev/null
+++ b/website/source/docs/providers/aws/r/network_interface.markdown
@@ -0,0 +1,51 @@
+---
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+sidebar_current: "docs-aws-resource-network-interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+# aws\_network\_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```
+resource "aws_network_interface" "test" {
+    subnet_id = "${aws_subnet.public_a.id}"
+	private_ips = ["10.0.0.50"]
+	security_groups = ["${aws_security_group.web.name}"]
+	attachment {
+		instance = "${aws_instance.test.id}"
+		device_index = 1
+	}
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `subnet_id` - (Required) Subnet ID to create the ENI in.
+* `private_ips` - (Optional) List of private IPs to assign to the ENI.
+* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
+* `attachment` - (Required) Block to define the attachment of the ENI. Documented below.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+The `attachment` block supports:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `device_index` - (Required) Integer to define the devices index.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `subnet_id` - Subnet ID the ENI is in.
+* `private_ips` - List of private IPs assigned to the ENI.
+* `security_groups` - List of security groups attached to the ENI.
+* `attachment` - Block defining the attachment of the ENI.
+* `tags` - Tags assigned to the ENI.
+
diff --git a/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown b/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown
new file mode 100644
index 000000000..907000077
--- /dev/null
+++ b/website/source/docs/providers/aws/r/route53_delegation_set.html.markdown
@@ -0,0 +1,44 @@
+---
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+sidebar_current: "docs-aws-resource-route53-delegation-set"
+description: |-
+  Provides a Route53 Delegation Set resource.
+---
+
+# aws\_route53\_delegation_set
+
+Provides a [Route53 Delegation Set](http://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html) resource.
+
+## Example Usage
+
+```
+resource "aws_route53_delegation_set" "main" {
+    reference_name = "DynDNS"
+}
+
+resource "aws_route53_zone" "primary" {
+    name = "hashicorp.com"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+
+resource "aws_route53_zone" "secondary" {
+    name = "terraform.io"
+    delegation_set_id = "${aws_route53_delegation_set.main.id}"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `reference_name` - (Optional) This is a reference name used in Caller Reference
+  (helpful for identifying single delegation set amongst others)
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The delegation set ID
+* `name_servers` - A list of authoritative name servers for the hosted zone
+  (effectively a list of NS records).
diff --git a/website/source/docs/providers/aws/r/route53_health_check.html.markdown b/website/source/docs/providers/aws/r/route53_health_check.html.markdown
new file mode 100644
index 000000000..0f810784a
--- /dev/null
+++ b/website/source/docs/providers/aws/r/route53_health_check.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "aws"
+page_title: "AWS: aws_route53_health_check"
+sidebar_current: "docs-aws-resource-route53-health-check"
+description: |-
+  Provides a Route53 health check.
+---
+# aws\_route53\_health\_check
+
+Provides a Route53 health check.
+
+## Example Usage
+
+```
+resource "aws_route53_health_check" "foo" {
+  fqdn = "foobar.terraform.com"
+  port = 80
+  type = "HTTP"
+  resource_path = "/"
+  failure_threshold = "5"
+  request_interval = "30"
+
+  tags = {
+    Name = "tf-test-health-check"
+   }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `fqdn` - (Optional) The fully qualified domain name of the endpoint to be checked.
+* `ip_address` - (Optional) The IP address of the endpoint to be checked.
+* `failure_threshold` - (Required) The number of consecutive health checks that an endpoint must pass or fai.
+* `request_interval` - (Required) The number of seconds between the time that Amazon Route 53 gets a response from your endpoint and the time that it sends the next health-check request.
+* `resource_path` - (Optional) The path that you want Amazon Route 53 to request when performing health checks.
+* `search_string` - (Optional) String searched in respoonse body for check to considered healthy.
+* `tags` - (Optional) A mapping of tags to assign to the health check.
+
+Exactly one of `fqdn` or `ip_address` must be specified.
+
diff --git a/website/source/docs/providers/aws/r/route53_record.html.markdown b/website/source/docs/providers/aws/r/route53_record.html.markdown
index 8183258f3..e7455ba13 100644
--- a/website/source/docs/providers/aws/r/route53_record.html.markdown
+++ b/website/source/docs/providers/aws/r/route53_record.html.markdown
@@ -54,7 +54,7 @@ See [related part of AWS Route53 Developer Guide](http://docs.aws.amazon.com/Rou
 to understand differences between alias and non-alias records.
 
 TTL for all alias records is [60 seconds](http://aws.amazon.com/route53/faqs/#dns_failover_do_i_need_to_adjust),
-you cannot change this, therefore `ttl` has to be ommitted in alias records.
+you cannot change this, therefore `ttl` has to be omitted in alias records.
 
 ```
 resource "aws_elb" "main" {
@@ -89,12 +89,15 @@ The following arguments are supported:
 * `zone_id` - (Required) The ID of the hosted zone to contain this record.
 * `name` - (Required) The name of the record.
 * `type` - (Required) The record type.
-* `ttl` - (Required) The TTL of the record.
-* `records` - (Required) A string list of records.
+* `ttl` - (Required for non-alias records) The TTL of the record.
+* `records` - (Required for non-alias records) A string list of records.
 * `weight` - (Optional) The weight of weighted record (0-255).
 * `set_identifier` - (Optional) Unique identifier to differentiate weighted
-  record from one another. Required for each weighted record.
-* `alias` - (Optional) An alias block. Alias record documented below.
+record from one another. Required for each weighted record.
+* `failover` - (Optional) The routing behavior when associated health check fails. Must be PRIMARY or SECONDARY.
+* `health_check_id` - (Optional) The health check the record should be associated with.
+* `alias` - (Optional) An alias block. Conflicts with `ttl` & `records`.
+  Alias record documented below.
 
 Exactly one of `records` or `alias` must be specified: this determines whether it's an alias record.
 
diff --git a/website/source/docs/providers/aws/r/route53_zone.html.markdown b/website/source/docs/providers/aws/r/route53_zone.html.markdown
index 7b75e10b9..2533a76c2 100644
--- a/website/source/docs/providers/aws/r/route53_zone.html.markdown
+++ b/website/source/docs/providers/aws/r/route53_zone.html.markdown
@@ -58,11 +58,12 @@ The following arguments are supported:
 * `tags` - (Optional) A mapping of tags to assign to the zone.
 * `vpc_id` - (Optional) The VPC to associate with a private hosted zone. Specifying `vpc_id` will create a private hosted zone.
 * `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+* `delegation_set_id` - (Optional) The ID of the reusable delgation set whose NS records you want to assign to the hosted zone.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
 * `zone_id` - The Hosted Zone ID. This can be referenced by zone records.
-* `name_servers` - A list of name servers in a default delegation set.
+* `name_servers` - A list of name servers in associated (or default) delegation set.
   Find more about delegation sets in [AWS docs](http://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html).
diff --git a/website/source/docs/providers/aws/r/route53_zone_association.html.markdown b/website/source/docs/providers/aws/r/route53_zone_association.html.markdown
index 49995fb63..7275290af 100644
--- a/website/source/docs/providers/aws/r/route53_zone_association.html.markdown
+++ b/website/source/docs/providers/aws/r/route53_zone_association.html.markdown
@@ -30,7 +30,7 @@ resource "aws_route53_zone" "example" {
   vpc_id = "${aws_vpc.primary.id}"
 }
 
-resource "aws_route53_zone_assocation" "secondary" {
+resource "aws_route53_zone_association" "secondary" {
   zone_id = "${aws_route53_zone.example.id}"
   vpc_id = "${aws_vpc.secondary.id}"
 }
diff --git a/website/source/docs/providers/aws/r/route_table_assoc.html.markdown b/website/source/docs/providers/aws/r/route_table_association.html.markdown
similarity index 92%
rename from website/source/docs/providers/aws/r/route_table_assoc.html.markdown
rename to website/source/docs/providers/aws/r/route_table_association.html.markdown
index 712a1dd9c..d7ba450f1 100644
--- a/website/source/docs/providers/aws/r/route_table_assoc.html.markdown
+++ b/website/source/docs/providers/aws/r/route_table_association.html.markdown
@@ -1,7 +1,7 @@
 ---
 layout: "aws"
 page_title: "AWS: aws_route_table_association"
-sidebar_current: "docs-aws-resource-route-table-assoc"
+sidebar_current: "docs-aws-resource-route-table-association"
 description: |-
   Provides a resource to create an association between a subnet and routing table.
 ---
diff --git a/website/source/docs/providers/aws/r/s3_bucket.html.markdown b/website/source/docs/providers/aws/r/s3_bucket.html.markdown
index c0ecd91c7..4f367d4f8 100644
--- a/website/source/docs/providers/aws/r/s3_bucket.html.markdown
+++ b/website/source/docs/providers/aws/r/s3_bucket.html.markdown
@@ -32,7 +32,7 @@ resource "aws_s3_bucket" "b" {
 resource "aws_s3_bucket" "b" {
     bucket = "s3-website-test.hashicorp.com"
     acl = "public-read"
-    policy = "#{file("policy.json")}"
+    policy = "${file("policy.json")}"
 
     website {
         index_document = "index.html"
@@ -47,7 +47,8 @@ The following arguments are supported:
 
 * `bucket` - (Required) The name of the bucket.
 * `acl` - (Optional) The [canned ACL](http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Defaults to "private".
-* `policy` - (Optional) A valid [bucket policy](http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html) JSON document.
+* `policy` - (Optional) A valid [bucket policy](http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html) JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a `terraform plan`. In this case, please make sure you use the verbose/specific version of the policy.
+
 * `tags` - (Optional) A mapping of tags to assign to the bucket.
 * `force_destroy` - (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are *not* recoverable.
 * `website` - (Optional) A website object (documented below).
diff --git a/website/source/docs/providers/aws/r/security_group.html.markdown b/website/source/docs/providers/aws/r/security_group.html.markdown
index 0e253e707..ebd21bc73 100644
--- a/website/source/docs/providers/aws/r/security_group.html.markdown
+++ b/website/source/docs/providers/aws/r/security_group.html.markdown
@@ -28,14 +28,14 @@ resource "aws_security_group" "allow_all" {
 
   ingress {
       from_port = 0
-      to_port = 65535
+      to_port = 0
       protocol = "-1"
       cidr_blocks = ["0.0.0.0/0"]
   }
 
   egress {
       from_port = 0
-      to_port = 65535
+      to_port = 0
       protocol = "-1"
       cidr_blocks = ["0.0.0.0/0"]
   }
diff --git a/website/source/docs/providers/aws/r/security_group_rule.html.markdown b/website/source/docs/providers/aws/r/security_group_rule.html.markdown
index dbc0c1c72..1aee8cd00 100644
--- a/website/source/docs/providers/aws/r/security_group_rule.html.markdown
+++ b/website/source/docs/providers/aws/r/security_group_rule.html.markdown
@@ -8,7 +8,7 @@ description: |-
 
 # aws\_security\_group\_rule
 
-Provides a security group rule resource. Represents a signle `ingress` or
+Provides a security group rule resource. Represents a single `ingress` or
 `egress` group rule, which can be added to external Security Groups.
 
 ~> **NOTE on Security Groups and Security Group Rules:** Terraform currently
diff --git a/website/source/docs/providers/aws/r/sns_topic.html.markdown b/website/source/docs/providers/aws/r/sns_topic.html.markdown
new file mode 100644
index 000000000..62a3c23f7
--- /dev/null
+++ b/website/source/docs/providers/aws/r/sns_topic.html.markdown
@@ -0,0 +1,35 @@
+---
+layout: "aws"
+page_title: "AWS: sns_topic"
+sidebar_current: "docs-aws-resource-sns-topic"
+description: |-
+  Provides an SNS topic resource.
+---
+
+# aws\_sns\_topic
+
+Provides an SNS topic resource
+
+## Example Usage
+
+```
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The friendly name for the SNS topic
+* `policy` - (Optional) The fully-formed AWS policy as JSON
+* `delivery_policy` - (Optional) The SNS delivery policy
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ARN of the SNS topic
+* `arn` - The ARN of the SNS topic, as a more obvious property (clone of id)
+
diff --git a/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown b/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown
new file mode 100644
index 000000000..f27644350
--- /dev/null
+++ b/website/source/docs/providers/aws/r/sns_topic_subscription.html.markdown
@@ -0,0 +1,93 @@
+---
+layout: "aws"
+page_title: "AWS: sns_topic_subscription"
+sidebar_current: "docs-aws-resource-sns-topic-subscription"
+description: |-
+  Provides a resource for subscribing to SNS topics.
+---
+
+# aws\_sns\_topic\_subscription
+
+  Provides a resource for subscribing to SNS topics. Requires that an SNS topic exist for the subscription to attach to.
+This resource allows you to automatically place messages sent to SNS topics in SQS queues, send them as HTTP(S) POST requests
+to a given endpoint, send SMS messages, or notify devices / applications. The most likely use case for Terraform users will
+probably be SQS queues.
+
+## Example Usage
+
+You can directly supply a topic and ARN by hand in the `topic_arn` property along with the queue ARN:
+
+```
+resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
+    topic_arn = "arn:aws:sns:us-west-2:432981146916:user-updates-topic"
+    protocol = "sqs"
+    endpoint = "arn:aws:sqs:us-west-2:432981146916:terraform-queue-too"
+}
+```
+
+Alternatively you can use the ARN properties of a managed SNS topic and SQS queue:
+
+```
+resource "aws_sns_topic" "user_updates" {
+  name = "user-updates-topic"
+}
+
+resource "aws_sqs_queue" "user_updates_queue" {
+	name = "user-updates-queue"
+}
+
+resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
+    topic_arn = "${aws_sns_topic.user_updates.arn}"
+    protocol  = "sqs"
+    endpoint  = "${aws_sqs_queue.user_updates_queue.arn}"
+}
+```
+
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `topic_arn` - (Required) The ARN of the SNS topic to subscribe to
+* `protocol` - (Required) The protocol to use. The possible values for this are: `sqs`, `http`, `https`, `sms`, or `application`. (`email` is an option but unsupported, see below)
+* `endpoint` - (Required) The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
+* `raw_message_delivery` - (Optional) Boolean indicating whether or not to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property).
+
+### Protocols supported
+
+Supported SNS protocols include:
+
+* `http` -- delivery of JSON-encoded message via HTTP POST
+* `https` -- delivery of JSON-encoded message via HTTPS POST
+* `sms` -- delivery of message via SMS
+* `sqs` -- delivery of JSON-encoded message to an Amazon SQS queue
+* `application` -- delivery of JSON-encoded message to an EndpointArn for a mobile app and device
+
+Unsupported protocols include the following:
+
+* `email` -- delivery of message via SMTP
+* `email-json` -- delivery of JSON-encoded message via SMTP
+
+These are unsupported because the email address needs to be authorized and does not generate an ARN until the target email address has been validated. This breaks
+the Terraform model and as a result are not currently supported.
+
+### Specifying endpoints
+
+Endpoints have different format requirements according to the protocol that is chosen.
+
+* HTTP/HTTPS endpoints will require a URL to POST data to
+* SMS endpoints are mobile numbers that are capable of receiving an SMS
+* SQS endpoints come in the form of the SQS queue's ARN (not the URL of the queue) e.g: `arn:aws:sqs:us-west-2:432981146916:terraform-queue-too`
+* Application endpoints are also the endpoint ARN for the mobile app and device.
+
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ARN of the subscription
+* `topic_arn` - The ARN of the topic the subscription belongs to
+* `protocol` - The protocol being used
+* `endpoint` - The full endpoint to send data to (SQS ARN, HTTP(S) URL, Application ARN, SMS number, etc.)
+* `arn` - The ARN of the subscription stored as a more user-friendly property
+
diff --git a/website/source/docs/providers/aws/r/spot_instance_request.html.markdown b/website/source/docs/providers/aws/r/spot_instance_request.html.markdown
new file mode 100644
index 000000000..abb1f4705
--- /dev/null
+++ b/website/source/docs/providers/aws/r/spot_instance_request.html.markdown
@@ -0,0 +1,71 @@
+---
+layout: "aws"
+page_title: "AWS: aws_spot_instance_request"
+sidebar_current: "docs-aws-resource-spot-instance-request"
+description: |-
+  Provides a Spot Instance Request resource.
+---
+
+# aws\_spot\_instance\_request
+
+Provides an EC2 Spot Instance Request resource. This allows instances to be
+requested on the spot market.
+
+Terraform always creates Spot Instance Requests with a `persistent` type, which
+means that for the duration of their lifetime, AWS will launch an instance
+with the configured details if and when the spot market will accept the
+requested price.
+
+On destruction, Terraform will make an attempt to terminate the associated Spot
+Instance if there is one present.
+
+~> **NOTE:** Because their behavior depends on the live status of the spot
+market, Spot Instance Requests have a unique lifecycle that makes them behave
+differently than other Terraform resources. Most importantly: there is __no
+guarantee__ that a Spot Instance exists to fulfill the request at any given
+point in time. See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information.
+
+
+## Example Usage
+
+```
+# Request a spot instance at $0.03
+resource "aws_spot_instance_request" "cheap_worker" {
+    ami = "ami-1234"
+    spot_price = "0.03"
+    instance_type = "c4.xlarge"
+    tags {
+        Name = "CheapWorker"
+    }
+}
+```
+
+## Argument Reference
+
+Spot Instance Requests support all the same arguments as
+[`aws_instance`](instance.html), with the addition of:
+
+* `spot_price` - (Required) The price to request on the spot market.
+* `wait_for_fulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The Spot Instance Request ID.
+
+These attributes are exported, but they are expected to change over time and so
+should only be used for informational purposes, not for resource dependencies:
+
+* `spot_bid_status` - The current [bid
+  status](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html)
+  of the Spot Instance Request.
+* `spot_request_state` The current [request
+  state](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html#creating-spot-request-status)
+  of the Spot Instance Request.
+* `spot_instance_id` - The Instance ID (if any) that is currently fulfilling
+  the Spot Instance request.
diff --git a/website/source/docs/providers/aws/r/sqs_queue.html.markdown b/website/source/docs/providers/aws/r/sqs_queue.html.markdown
index e03c4a2f5..a3bf25c57 100644
--- a/website/source/docs/providers/aws/r/sqs_queue.html.markdown
+++ b/website/source/docs/providers/aws/r/sqs_queue.html.markdown
@@ -11,7 +11,7 @@ description: |-
 ## Example Usage
 
 ```
-resource "aws_sqs_queue" "terrform_queue" {
+resource "aws_sqs_queue" "terraform_queue" {
   name = "terraform-example-queue"
   delay_seconds = 90
   max_message_size = 2048
@@ -23,6 +23,7 @@ resource "aws_sqs_queue" "terrform_queue" {
 ## Argument Reference
 
 The following arguments are supported:
+
 * `name` - (Required) This is the human-readable name of the queue
 * `visibility_timeout_seconds` - (Optional) The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes). The default for this attribute is 30 seconds
 * `message_retention_seconds` - (Optional) The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). The default for this attribute is 345600 (4 days).
@@ -35,4 +36,5 @@ The following arguments are supported:
 
 The following attributes are exported:
 
-* `id` - The URL for the created Amazon SQS queue.
\ No newline at end of file
+* `id` - The URL for the created Amazon SQS queue.
+* `arn` - The ARN of the SQS queue
diff --git a/website/source/docs/providers/aws/r/volume_attachment.html.markdown b/website/source/docs/providers/aws/r/volume_attachment.html.markdown
new file mode 100644
index 000000000..d3421dc8c
--- /dev/null
+++ b/website/source/docs/providers/aws/r/volume_attachment.html.markdown
@@ -0,0 +1,57 @@
+---
+layout: "aws"
+page_title: "AWS: aws_volume_attachment"
+sidebar_current: "docs-aws-resource-volume-attachment"
+description: |-
+  Provides an AWS EBS Volume Attachment
+---
+
+# aws\_volume\_attachment
+
+Provides an AWS EBS Volume Attachment as a top level resource, to attach and
+detach volumes from AWS Instances.
+
+## Example Usage
+
+```
+resource "aws_volume_attachment" "ebs_att" {
+  device_name = "/dev/sdh"
+  volume_id = "${aws_ebs_volume.example.id}"
+  instance_id = "${aws_instance.web.id}"
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-21f78e11"
+  availability_zone = "us-west-2a"
+  instance_type = "t1.micro"
+  tags {
+    Name = "HelloWorld"
+  }
+}
+
+resource "aws_ebs_volume" "example" {
+  availability_zone = "us-west-2a"
+  size = 1
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `device_name` - (Required) The device name to expose to the instance (for 
+example, `/dev/sdh` or `xvdh`)
+* `instance_id` - (Required) ID of the Instance to attach to
+* `volume_id` - (Required) ID of the Volume to be attached
+* `force_detach` - (Optional, Boolean) Set to `true` if you want to force the
+volume to detach. Useful if previous attempts failed, but use this option only 
+as a last resort, as this can result in **data loss**. See 
+[Detaching an Amazon EBS Volume from an Instance][1] for more information.
+
+## Attributes Reference
+
+* `device_name` - The device name exposed to the instance
+* `instance_id` - ID of the Instance
+* `volume_id` - ID of the Volume 
+
+[1]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html
diff --git a/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown b/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
index 3e595adcc..c2e05743f 100644
--- a/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
+++ b/website/source/docs/providers/aws/r/vpc_dhcp_options.html.markdown
@@ -59,8 +59,5 @@ The following attributes are exported:
 
 * `id` - The ID of the DHCP Options Set.
 
-## Known Issues
-* https://github.com/awslabs/aws-sdk-go/issues/210
-
 You can find more technical documentation about DHCP Options Set in the
 official [AWS User Guide](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html).
diff --git a/website/source/docs/providers/aws/r/vpc_peering.html.markdown b/website/source/docs/providers/aws/r/vpc_peering.html.markdown
index 4e9720eff..cf3e16eb0 100644
--- a/website/source/docs/providers/aws/r/vpc_peering.html.markdown
+++ b/website/source/docs/providers/aws/r/vpc_peering.html.markdown
@@ -46,16 +46,16 @@ The following arguments are supported:
 * `peer_owner_id` - (Required) The AWS account ID of the owner of the peer VPC.
 * `peer_vpc_id` - (Required) The ID of the VPC with which you are creating the VPC peering connection.
 * `vpc_id` - (Required) The ID of the requester VPC.
-* `auto_accept` - (Optional) Accept the peering ( you need to be the owner of both vpc)
+* `auto_accept` - (Optional) Accept the peering (you need to be the owner of both VPCs).
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
-* `id` - The ID of the VPC Peering Connectiona
+* `id` - The ID of the VPC Peering Connections
 * `accept_status` - The Status of the VPC peering connection request.
 
 
 ## Notes
-You still have to accept the peering with the aws console, aws-cli or aws-sdk-go.
+You still have to accept the peering with the AWS Console, aws-cli or aws-sdk-go.
diff --git a/website/source/docs/providers/aws/r/vpn_connection.html.markdown b/website/source/docs/providers/aws/r/vpn_connection.html.markdown
index dd4a9ecea..ecfd197d2 100644
--- a/website/source/docs/providers/aws/r/vpn_connection.html.markdown
+++ b/website/source/docs/providers/aws/r/vpn_connection.html.markdown
@@ -46,7 +46,7 @@ The following arguments are supported:
 * `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
 * `vpn_gateway_id` - (Required) The ID of the virtual private gateway.
 
-## Attrubute Reference
+## Attribute Reference
 
 The following attributes are exported:
 
diff --git a/website/source/docs/providers/azure/index.html.markdown b/website/source/docs/providers/azure/index.html.markdown
new file mode 100644
index 000000000..eec8494a1
--- /dev/null
+++ b/website/source/docs/providers/azure/index.html.markdown
@@ -0,0 +1,59 @@
+---
+layout: "azure"
+page_title: "Provider: Azure"
+sidebar_current: "docs-azure-index"
+description: |-
+  The Azure provider is used to interact with the many resources supported by Azure. The provider needs to be configured with a publish settings file and optionally a subscription ID before it can be used.
+---
+
+# Azure Provider
+
+The Azure provider is used to interact with the many resources supported
+by Azure. The provider needs to be configured with a [publish settings
+file](https://manage.windowsazure.com/publishsettings) and optionally a
+subscription ID before it can be used.
+
+Use the navigation to the left to read about the available resources.
+
+## Example Usage
+
+```
+# Configure the Azure Provider
+provider "azure" {
+    settings_file = "${var.azure_settings_file}"
+}
+
+# Create a web server
+resource "azure_instance" "web" {
+    ...
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `settings_file` - (Optional) The path to a publish settings file used to
+  authenticate with the Azure API. You can download the settings file here:
+  https://manage.windowsazure.com/publishsettings. You must either provide
+  (or source from the `AZURE_SETTINGS_FILE` environment variable) a settings
+  file or both a `subscription_id` and `certificate`.
+
+* `subscription_id` - (Optional) The subscription ID to use. If a
+  `settings_file` is not provided `subscription_id` is required. It can also
+  be sourced from the `AZURE_SUBSCRIPTION_ID` environment variable.
+
+* `certificate` - (Optional) The certificate used to authenticate with the
+  Azure API. If a `settings_file` is not provided `certificate` is required.
+  It can also be sourced from the `AZURE_CERTIFICATE` environment variable.
+
+## Testing:
+
+The following environment variables must be set for the running of the
+acceptance test suite:
+
+* A valid combination of the above which are required for authentification.
+
+* `AZURE_STORAGE` - The name of a storage account to be used in tests which
+  require a storage backend. The storage account needs to be located in
+  the Western US Azure region.
diff --git a/website/source/docs/providers/azure/r/affinity_group.html.markdown b/website/source/docs/providers/azure/r/affinity_group.html.markdown
new file mode 100644
index 000000000..906f73070
--- /dev/null
+++ b/website/source/docs/providers/azure/r/affinity_group.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "azure"
+page_title: "Azure: azure_affinity_group"
+sidebar_current: "docs-azure-affinity-group"
+description: |-
+    Creates a new affinity group on Azure.
+---
+
+# azure\_affinity\_group
+
+Creates a new affinity group on Azure.
+
+## Example Usage
+
+```
+resource "azure_affinity_group" "terraform-main-group" {
+    name = "terraform-group"
+    location = "North Europe"
+    label = "tf-group-01"
+    description = "Affinity group created by Terraform."
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the affinity group. Must be unique on your
+    Azure subscription.
+
+* `location` - (Required) The location where the affinity group should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `label` - (Required) A label to be used for tracking purposes.
+
+* `description` - (Optional) A description for the affinity group.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The affinity group ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/data_disk.html.markdown b/website/source/docs/providers/azure/r/data_disk.html.markdown
new file mode 100644
index 000000000..5f0aad95b
--- /dev/null
+++ b/website/source/docs/providers/azure/r/data_disk.html.markdown
@@ -0,0 +1,70 @@
+---
+layout: "azure"
+page_title: "Azure: azure_data_disk"
+sidebar_current: "docs-azure-resource-data-disk"
+description: |-
+  Adds a data disk to a virtual machine. If the name of an existing disk is given, it will attach that disk. Otherwise it will create and attach a new empty disk.
+---
+
+# azure\_data\_disk
+
+Adds a data disk to a virtual machine. If the name of an existing disk is given,
+it will attach that disk. Otherwise it will create and attach a new empty disk.
+
+## Example Usage
+
+```
+resource "azure_data_disk" "data" {
+    lun = 0
+    size = 10
+    storage_service_name = "yourstorage"
+    virtual_machine = "server1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Optional) The name of an existing registered disk to attach to the
+    virtual machine. If left empty, a new empty disk will be created and
+    attached instead. Changing this forces a new resource to be created.
+
+* `label` - (Optional) The identifier of the data disk. Changing this forces a
+    new resource to be created (defaults to "virtual_machine-lun")
+
+* `lun` - (Required) The Logical Unit Number (LUN) for the disk. The LUN
+    specifies the slot in which the data drive appears when mounted for usage
+    by the virtual machine. Valid LUN values are 0 through 31.
+
+* `size` - (Optional) The size, in GB, of an empty disk to be attached to the
+    virtual machine. Required when creating a new disk, not used otherwise.
+
+* `caching` - (Optional) The caching behavior of data disk. Valid options are:
+    `None`, `ReadOnly` and `ReadWrite` (defaults `None`)
+
+* `storage_service_name` - (Optional) The name of an existing storage account
+    within the subscription which will be used to store the VHD of this disk.
+    Required if no value is supplied for `media_link`. Changing this forces
+    a new resource to be created.
+
+* `media_link` - (Optional) The location of the blob in storage where the VHD
+    of this disk will be created. The storage account where must be associated
+    with the subscription. Changing this forces a new resource to be created.
+
+* `source_media_link` - (Optional) The location of a blob in storage where a
+    VHD file is located that is imported and registered as a disk. If a value
+    is supplied, `media_link` will not be used.
+
+* `virtual_machine` - (Required) The name of the virtual machine the disk will
+    be attached to.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The security group ID.
+* `name` - The name of the disk.
+* `label` - The identifier for the disk.
+* `media_link` - The location of the blob in storage where the VHD of this disk
+    is created.
diff --git a/website/source/docs/providers/azure/r/dns_server.html.markdown b/website/source/docs/providers/azure/r/dns_server.html.markdown
new file mode 100644
index 000000000..d9f3567c2
--- /dev/null
+++ b/website/source/docs/providers/azure/r/dns_server.html.markdown
@@ -0,0 +1,36 @@
+---
+layout: "azure"
+page_title: "Azure: azure_dns_server"
+sidebar_current: "docs-azure-resource-dns-server"
+description: |-
+    Creates a new DNS server definition to be used internally in Azure.
+---
+
+# azure\_dns\_server
+
+Creates a new DNS server definition to be used internally in Azure.
+
+## Example Usage
+
+```
+resource "azure_dns_server" "google-dns" {
+    name = "google"
+    dns_address = "8.8.8.8"
+}
+`
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the DNS server reference. Changing this
+    forces a new resource to be created.
+
+* `dns_address` - (Required) The IP address of the DNS server.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The DNS server definition ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/hosted_service.html.markdown b/website/source/docs/providers/azure/r/hosted_service.html.markdown
new file mode 100644
index 000000000..56a946315
--- /dev/null
+++ b/website/source/docs/providers/azure/r/hosted_service.html.markdown
@@ -0,0 +1,50 @@
+---
+layout: "azure"
+page_title: "Azure: azure_hosted_service"
+sidebar_current: "docs-azure-hosted-service"
+description: |-
+    Creates a new hosted service on Azure with its own .cloudapp.net domain.
+---
+
+# azure\_hosted\_service
+
+Creates a new hosted service on Azure with its own .cloudapp.net domain.
+
+## Example Usage
+
+```
+resource "azure_hosted_service" "terraform-service" {
+    name = "terraform-service"
+    location = "North Europe"
+    ephemeral_contents = false
+    description = "Hosted service created by Terraform."
+    label = "tf-hs-01"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the hosted service. Must be unique on Azure.
+
+* `location` - (Required) The location where the hosted service should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `ephemeral_contents` - (Required) A boolean value (true|false), specifying
+    whether all the resources present in the hosted hosted service should be
+    destroyed following the hosted service's destruction.
+
+* `reverse_dns_fqdn` - (Optional) The reverse of the fully qualified domain name
+    for the hosted service.
+
+* `label` - (Optional) A label to be used for tracking purposes. Must be
+    non-void. Defaults to `Made by Terraform.`.
+
+* `description` - (Optional) A description for the hosted service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The hosted service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/instance.html.markdown b/website/source/docs/providers/azure/r/instance.html.markdown
new file mode 100644
index 000000000..6b9428762
--- /dev/null
+++ b/website/source/docs/providers/azure/r/instance.html.markdown
@@ -0,0 +1,133 @@
+---
+layout: "azure"
+page_title: "Azure: azure_instance"
+sidebar_current: "docs-azure-resource-instance"
+description: |-
+  Creates a hosted service, role and deployment and then creates a virtual machine in the deployment based on the specified configuration.
+---
+
+# azure\_instance
+
+Creates a hosted service, role and deployment and then creates a virtual
+machine in the deployment based on the specified configuration.
+
+## Example Usage
+
+```
+resource "azure_hosted_service" "terraform-service" {
+    name = "terraform-service"
+    location = "North Europe"
+    ephemeral_contents = false
+    description = "Hosted service created by Terraform."
+    label = "tf-hs-01"
+}
+
+resource "azure_instance" "web" {
+    name = "terraform-test"
+    hosted_service_name = "${azure_hosted_service.terraform-service.name}"
+    image = "Ubuntu Server 14.04 LTS"
+    size = "Basic_A1"
+    storage_service_name = "yourstorage"
+    location = "West US"
+    username = "terraform"
+    password = "Pass!admin123"
+
+    endpoint {
+        name = "SSH"
+        protocol = "tcp"
+        public_port = 22
+        private_port = 22
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the instance. Changing this forces a new
+    resource to be created.
+
+* `hosted_service_name` - (Optional) The name of the hosted service the
+    instance should be deployed under. If not provided; it will default to the
+    value of `name`. Changes to this parameter forces the creation of a new
+    resource.
+
+* `description` - (Optional) The description for the associated hosted service.
+    Changing this forces a new resource to be created (defaults to the instance
+    name).
+
+* `image` - (Required) The name of an existing VM or OS image to use for this
+    instance. Changing this forces a new resource to be created.
+
+* `size` - (Required) The size of the instance.
+
+* `subnet` - (Optional) The name of the subnet to connect this instance to. If
+    a value is supplied `virtual_network` is required. Changing this forces a
+    new resource to be created.
+
+* `virtual_network` - (Optional) The name of the virtual network the `subnet`
+    belongs to. If a value is supplied `subnet` is required. Changing this
+    forces a new resource to be created.
+
+* `storage_service_name` - (Optional) The name of an existing storage account
+    within the subscription which will be used to store the VHDs of this
+    instance. Changing this forces a new resource to be created.
+
+* `reverse_dns` - (Optional) The DNS address to which the IP address of the
+    hosted service resolves when queried using a reverse DNS query. Changing
+    this forces a new resource to be created.
+
+* `location` - (Required) The location/region where the cloud service is
+    created. Changing this forces a new resource to be created.
+
+* `automatic_updates` - (Optional) If true this will enable automatic updates.
+    This attribute is only used when creating a Windows instance. Changing this
+    forces a new resource to be created (defaults false)
+
+* `time_zone` - (Optional) The appropriate time zone for this instance in the
+    format 'America/Los_Angeles'. This attribute is only used when creating a
+    Windows instance. Changing this forces a new resource to be created
+    (defaults false)
+
+* `username` - (Required) The username of a new user that will be created while
+    creating the instance. Changing this forces a new resource to be created.
+
+* `password` - (Optional) The password of the new user that will be created
+    while creating the instance. Required when creating a Windows instance or
+    when not supplying an `ssh_key_thumbprint` while creating a Linux instance.
+    Changing this forces a new resource to be created.
+
+* `ssh_key_thumbprint` - (Optional) The SSH thumbprint of an existing SSH key
+    within the subscription. This attribute is only used when creating a Linux
+    instance. Changing this forces a new resource to be created.
+
+* `security_group` - (Optional) The Network Security Group to associate with
+    this instance.
+
+* `endpoint` - (Optional) Can be specified multiple times to define multiple
+    endpoints. Each `endpoint` block supports fields documented below.
+
+The `endpoint` block supports:
+
+* `name` - (Required) The name of the external endpoint.
+
+* `protocol` - (Optional) The transport protocol for the endpoint. Valid
+    options are: `tcp` and `udp` (defaults `tcp`)
+
+* `public_port` - (Required) The external port to use for the endpoint.
+
+* `private_port` - (Required) The private port on which the instance is
+    listening.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The instance ID.
+* `description` - The description for the associated hosted service.
+* `subnet` - The subnet the instance is connected to.
+* `endpoint` - The complete set of configured endpoints.
+* `security_group` - The associated Network Security Group.
+* `ip_address` - The private IP address assigned to the instance.
+* `vip_address` - The public IP address assigned to the instance.
diff --git a/website/source/docs/providers/azure/r/local_network_connection.html.markdown b/website/source/docs/providers/azure/r/local_network_connection.html.markdown
new file mode 100644
index 000000000..53e758b3a
--- /dev/null
+++ b/website/source/docs/providers/azure/r/local_network_connection.html.markdown
@@ -0,0 +1,39 @@
+---
+layout: "azure"
+page_title: "Azure: azure_local_network_connection"
+sidebar_current: "docs-azure-resource-local-network-connection"
+description: |-
+  Defines a new connection to a remote network throguh a VPN tunnel.
+---
+
+# azure\_local\_network\_connection
+
+Defines a new connection to a remote network throguh a VPN tunnel.
+
+## Example Usage
+
+```
+resource "azure_local_network_connection" "localnet" {
+    name = "terraform-local-network-connection"
+    vpn_gateway_address = "45.12.189.2"
+    address_space_prefixes = ["10.10.10.0/24", "10.10.11.0/24"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name by which this local network connection will
+    be referenced by. Changing this forces a new resource to be created.
+
+* `vpn_gateway_address` - (Required) The public IPv4 of the VPN endpoint.
+
+* `address_space_prefixes` - (Required) List of address spaces accessible
+    through the VPN connection. The elements are in the CIDR format.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The local network connection ID.
diff --git a/website/source/docs/providers/azure/r/security_group.html.markdown b/website/source/docs/providers/azure/r/security_group.html.markdown
new file mode 100644
index 000000000..771923e5b
--- /dev/null
+++ b/website/source/docs/providers/azure/r/security_group.html.markdown
@@ -0,0 +1,42 @@
+---
+layout: "azure"
+page_title: "Azure: azure_security_group"
+sidebar_current: "docs-azure-resource-security-group"
+description: |-
+  Creates a new network security group within the context of the specified subscription.
+---
+
+# azure\_security\_group
+
+Creates a new network security group within the context of the specified
+subscription.
+
+## Example Usage
+
+```
+resource "azure_security_group" "web" {
+    name = "webservers"
+    location = "West US"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the security group. Changing this forces a
+    new resource to be created.
+
+* `label` - (Optional) The identifier for the security group. The label can be
+    up to 1024 characters long. Changing this forces a new resource to be
+    created (defaults to the security group name)
+
+* `location` - (Required) The location/region where the security group is
+    created. Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The security group ID.
+* `label` - The identifier for the security group.
diff --git a/website/source/docs/providers/azure/r/security_group_rule.html.markdown b/website/source/docs/providers/azure/r/security_group_rule.html.markdown
new file mode 100644
index 000000000..20a28ce9d
--- /dev/null
+++ b/website/source/docs/providers/azure/r/security_group_rule.html.markdown
@@ -0,0 +1,76 @@
+---
+layout: "azure"
+page_title: "Azure: azure_security_group_rule"
+sidebar_current: "docs-azure-resource-security-group-rule"
+description: |-
+  Creates a new network security rule to be associated with a given security group.
+---
+
+# azure\_security\_group\_rule
+
+Creates a new network security rule to be associated with a given security group.
+
+## Example Usage
+
+```
+resource "azure_security_group" "web" {
+    ...
+}
+
+resource "azure_security_group" "apps" {
+    ...
+}
+
+resource "azure_security_group_rule" "ssh_access" {
+    name = "ssh-access-rule"
+    security_group_names = ["${azure_security_group.web.name}", "${azure_security_group.apps.name}"]
+    type = "Inbound"
+    action = "Allow"
+    priority = 200
+    source_address_prefix = "100.0.0.0/32"
+    source_port_range = "*"
+    destination_address_prefix = "10.0.0.0/32"
+    destination_port_range = "22"
+    protocol = "TCP"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+* `name` - (Required) The name of the security group rule.
+
+* `security_group_names` - (Required) A list of the names of the security groups
+    the rule should be applied to.
+    Changing this list forces the creation of a new resource.
+
+* `type` - (Required) The type of the security rule. Valid options are:
+    `Inbound` and `Outbound`.
+
+* `priority` - (Required) The priority of the network security rule. Rules with
+    lower priority are evaluated first. This value can be between 100 and 4096.
+
+* `action` - (Optional) The action that is performed when the security rule is
+    matched. Valid options are: `Allow` and `Deny`.
+
+* `source_address_prefix` - (Required) The address prefix of packet sources that
+    that should be subjected to the rule. An asterisk (\*) can also be used to
+    match all source IPs.
+
+* `source_port_range` - (Required) The source port or range. This value can be
+    between 0 and 65535. An asterisk (\*) can also be used to match all ports.
+
+* `destination_address_prefix` - (Required) The address prefix of packet
+    destinations that should be subjected to the rule. An asterisk
+    (\*) can also be used to match all destination IPs.
+
+* `destination_port_range` - (Required) The destination port or range. This value
+    can be between 0 and 65535. An asterisk (\*) can also be used to match all
+    ports.
+
+* `protocol` - (Optional) The protocol of the security rule. Valid options are:
+    `TCP`, `UDP` and `*`.
+
+The following attributes are exported:
+
+* `id` - The security group rule ID. Coincides with its given `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_server.html.markdown b/website/source/docs/providers/azure/r/sql_database_server.html.markdown
new file mode 100644
index 000000000..c03873181
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_server.html.markdown
@@ -0,0 +1,50 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_server"
+sidebar_current: "docs-azure-sql-database-server"
+description: |-
+    Allocates a new SQL Database Server on Azure.
+---
+
+# azure\_sql\_database\_server
+
+Allocates a new SQL Database Server on Azure.
+
+## Example Usage
+
+```
+resource "azure_sql_database_server" "sql-serv" {
+    name = "<computed>"
+    location = "West US"
+    username = "SuperUser"
+    password = "SuperSEKR3T"
+    version = "2.0"
+    url = "<computed>"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Computed) The name of the database server. It is determined upon
+    creation as it is randomly-generated per server.
+
+* `location` - (Required) The location where the database server should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `username` - (Required) The username for the administrator of the database server.
+
+* `password` - (Required) The password for the administrator of the database server.
+
+* `version` - (Optional) The version of the database server to be used. Can be any
+    one of `2.0` or `12.0`.
+
+* `url` - (Computed) The fully qualified domain name of the database server.
+    Will be of the form `<name>.database.windows.net`.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database server ID. Coincides with the randomly-generated `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown b/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown
new file mode 100644
index 000000000..5579ed116
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_server_firewall_rule.html.markdown
@@ -0,0 +1,57 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_server_firewall_rule"
+sidebar_current: "docs-azure-sql-database-server-firewall-rule"
+description: |-
+    Defines a new Firewall Rule to be applied across the given Database Servers.
+---
+
+# azure\_sql\_database\_server
+
+Defines a new Firewall Rule to be applied across the given Database Servers.
+
+## Example Usage
+
+```
+resource "azure_sql_database_server" "sql-serv1" {
+    ...
+}
+
+resource "azure_sql_database_server" "sql-serv2" {
+    ...
+}
+
+resource "azure_sql_database_server_firewall_rule" "constraint" {
+    name = "terraform-testing-rule"
+    start_ip = "154.0.0.0"
+    end_ip   = "154.0.0.255"
+    database_server_names = [
+        "${azure_sql_database_server.sql-serv1.name}",
+        "${azure_sql_database_server.sql-serv2.name}",
+    ]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the rule. Changing forces the creation of a
+    new resource.
+
+* `start_ip` - (Required) The IPv4 which will represent the lower bound of the
+    rule's application IP's. Traffic to/from IP's greater than or equal to this
+    one up to the `end_ip` will be permitted.
+
+* `end_ip` - (Required) The IPv4 which will represent the upper bound of the
+    rule's application IP's. Traffic to/from IP's lesser that or equal to this
+    one all the way down to the `start_ip` will be permitted.
+
+* `database_server_names` - (Required) The set of names of the Azure SQL
+    Database servers the rule should be enforced on.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database server ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/sql_database_service.html.markdown b/website/source/docs/providers/azure/r/sql_database_service.html.markdown
new file mode 100644
index 000000000..f068d3ff1
--- /dev/null
+++ b/website/source/docs/providers/azure/r/sql_database_service.html.markdown
@@ -0,0 +1,52 @@
+---
+layout: "azure"
+page_title: "Azure: azure_sql_database_service"
+sidebar_current: "docs-azure-sql-database-service"
+description: |-
+    Creates a new SQL Database Service on an Azure Database Server.
+---
+
+# azure\_sql\_database\_service
+
+Creates a new SQL database service on an Azure database server.
+
+## Example Usage
+
+```
+resource "azure_sql_database_service" "sql-server" {
+    name = "terraform-testing-db-renamed"
+    database_server_name = "flibberflabber"
+    edition = "Standard"
+    collation = "SQL_Latin1_General_CP1_CI_AS"
+    max_size_bytes = "5368709120"
+    service_level_id = "f1173c43-91bd-4aaa-973c-54e79e15235b"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the database service.
+
+* `database_server_name` - (Required) The name of the database server this service
+    should run on. Changes here force the creation of a new resource.
+
+* `edition` - (Optional) The edition of the database service. For more information
+    on each variant, please view [this](https://msdn.microsoft.com/library/azure/dn741340.aspx) link.
+
+* `collation` - (Optional) The collation to be used within the database service.
+    Defaults to the standard Latin charset.
+
+* `max_size_bytes` - (Optional) The maximum size in bytes the database service
+    should be allowed to expand to. Range depends on the database `edition`
+    selected above.
+
+* `service_level_id` - (Optional) The ID corresponding to the service level per
+    edition. Please refer to [this](https://msdn.microsoft.com/en-us/library/azure/dn505701.aspx) link for more details.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The database service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_blob.html.markdown b/website/source/docs/providers/azure/r/storage_blob.html.markdown
new file mode 100644
index 000000000..0e02d099a
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_blob.html.markdown
@@ -0,0 +1,49 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_blob"
+sidebar_current: "docs-azure-storage-blob"
+description: |-
+    Creates a new storage blob within a given storage container on Azure.
+---
+
+# azure\_storage\_blob
+
+Creates a new storage blob within a given storage container on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_blob" "foo" {
+    name = "tftesting-blob"
+    storage_service_name = "tfstorserv"
+    storage_container_name = "terraform-storage-container"
+    type = "PageBlob"
+    size = 1024
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage blob. Must be unique within
+    the storage service the blob is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage container in which the blob will be created resides.
+
+* `storage_container_name` - (Required) The name of the storage container
+    in which this blob should be created. Must be located on the storage
+    service given with `storage_service_name`.
+
+* `type` - (Required) The type of the storage blob to be created. One of either
+    `BlockBlob` or `PageBlob`.
+
+* `size` - (Optional) Used only for `PageBlob`'s to specify the size in bytes
+    of the blob to be created. Must be a multiple of 512. Defaults to 0.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage blob ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_container.html.markdown b/website/source/docs/providers/azure/r/storage_container.html.markdown
new file mode 100644
index 000000000..d0484c376
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_container.html.markdown
@@ -0,0 +1,43 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_container"
+sidebar_current: "docs-azure-storage-container"
+description: |-
+    Creates a new storage container within a given storage service on Azure.
+---
+
+# azure\_storage\_container
+
+Creates a new storage container within a given storage service on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_container" "stor-cont" {
+    name = "terraform-storage-container"
+    container_access_type = "blob"
+    storage_service_name = "tfstorserv"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage container. Must be unique within
+    the storage service the container is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage container should be created.
+
+* `container_access_type` - (Required) The 'interface' for access the container
+    provides. Can be either `blob`, `container` or ``.
+
+* `properties` - (Optional) Key-value definition of additional properties
+    associated to the storage service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage container ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_queue.html.markdown b/website/source/docs/providers/azure/r/storage_queue.html.markdown
new file mode 100644
index 000000000..2b9170c47
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_queue.html.markdown
@@ -0,0 +1,36 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_queue"
+sidebar_current: "docs-azure-storage-queue"
+description: |-
+    Creates a new storage queue within a given storage service on Azure.
+---
+
+# azure\_storage\_queue
+
+Creates a new storage queue within a given storage service on Azure.
+
+## Example Usage
+
+```
+resource "azure_storage_queue" "stor-queue" {
+    name = "terraform-storage-queue"
+    storage_service_name = "tfstorserv"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage queue. Must be unique within
+    the storage service the queue is located.
+
+* `storage_service_name` - (Required) The name of the storage service within
+    which the storage queue should be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage queue ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/storage_service.html.markdown b/website/source/docs/providers/azure/r/storage_service.html.markdown
new file mode 100644
index 000000000..6000817de
--- /dev/null
+++ b/website/source/docs/providers/azure/r/storage_service.html.markdown
@@ -0,0 +1,55 @@
+---
+layout: "azure"
+page_title: "Azure: azure_storage_service"
+sidebar_current: "docs-azure-storage-service"
+description: |-
+    Creates a new storage service on Azure in which storage containers may be created.
+---
+
+# azure\_storage\_service
+
+Creates a new storage service on Azure in which storage containers may be created.
+
+## Example Usage
+
+```
+resource "azure_storage_service" "tfstor" {
+    name = "tfstor"
+    location = "West US"
+    description = "Made by Terraform."
+    account_type = "Standard_LRS"
+}
+````
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the storage service. Must be between 4 and 24
+    lowercase-only characters or digits Must be unique on Azure.
+
+* `location` - (Required) The location where the storage service should be created.
+    For a list of all Azure locations, please consult [this link](http://azure.microsoft.com/en-us/regions/).
+
+* `account_type` - (Required) The type of storage account to be created.
+    Available options include `Standard_LRS`, `Standard_ZRS`, `Standard_GRS`,
+    `Standard_RAGRS` and `Premium_LRS`. To learn more about the differences
+    of each storage account type, please consult [this link](http://blogs.msdn.com/b/windowsazurestorage/archive/2013/12/11/introducing-read-access-geo-replicated-storage-ra-grs-for-windows-azure-storage.aspx).
+
+* `affinity_group` - (Optional) The affinity group the storage service should
+    belong to.
+
+* `properties` - (Optional) Key-value definition of additional properties
+    associated to the storage service. For additional information on what
+    these properties do, please consult [this link](https://msdn.microsoft.com/en-us/library/azure/hh452235.aspx).
+
+* `label` - (Optional) A label to be used for tracking purposes. Must be
+    non-void. Defaults to `Made by Terraform.`.
+
+* `description` - (Optional) A description for the storage service.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The storage service ID. Coincides with the given `name`.
diff --git a/website/source/docs/providers/azure/r/virtual_network.html.markdown b/website/source/docs/providers/azure/r/virtual_network.html.markdown
new file mode 100644
index 000000000..50f717714
--- /dev/null
+++ b/website/source/docs/providers/azure/r/virtual_network.html.markdown
@@ -0,0 +1,62 @@
+---
+layout: "azure"
+page_title: "Azure: azure_virtual_network"
+sidebar_current: "docs-azure-resource-virtual-network"
+description: |-
+  Creates a new virtual network including any configured subnets. Each subnet can optionally be configured with a security group to be associated with the subnet.
+---
+
+# azure\_virtual\_network
+
+Creates a new virtual network including any configured subnets. Each subnet can
+optionally be configured with a security group to be associated with the subnet.
+
+## Example Usage
+
+```
+resource "azure_virtual_network" "default" {
+    name = "test-network"
+    address_space = ["10.1.2.0/24"]
+    location = "West US"
+
+    subnet {
+        name = "subnet1"
+        address_prefix = "10.1.2.0/25"
+    }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the virtual network. Changing this forces a
+    new resource to be created.
+
+* `address_space` - (Required) The address space that is used the virtual
+    network. You can supply more than one address space. Changing this forces
+    a new resource to be created.
+
+* `location` - (Required) The location/region where the virtual network is
+    created. Changing this forces a new resource to be created.
+
+* `dns_servers` - (Optional) List of names of DNS servers previously registered
+    on Azure.
+
+* `subnet` - (Required) Can be specified multiple times to define multiple
+    subnets. Each `subnet` block supports fields documented below.
+
+The `subnet` block supports:
+
+* `name` - (Required) The name of the subnet.
+
+* `address_prefix` - (Required) The address prefix to use for the subnet.
+
+* `security_group` - (Optional) The Network Security Group to associate with
+    the subnet.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The virtual NetworkConfiguration ID.
diff --git a/website/source/docs/providers/cloudstack/index.html.markdown b/website/source/docs/providers/cloudstack/index.html.markdown
index 3fe42b98a..0738370b6 100644
--- a/website/source/docs/providers/cloudstack/index.html.markdown
+++ b/website/source/docs/providers/cloudstack/index.html.markdown
@@ -43,3 +43,8 @@ The following arguments are supported:
 
 * `secret_key` - (Required) This is the CloudStack secret key. It must be provided,
   but it can also be sourced from the `CLOUDSTACK_SECRET_KEY` environment variable.
+
+* `timeout` - (Optional) A value in seconds. This is the time allowed for Cloudstack 
+  to complete each asynchronous job triggered. If unset, this can be sourced from the
+  `CLOUDSTACK_TIMEOUT` environment variable. Otherwise, this will default to 300 
+  seconds.
diff --git a/website/source/docs/providers/cloudstack/r/instance.html.markdown b/website/source/docs/providers/cloudstack/r/instance.html.markdown
index e09cd6c6e..f97c67283 100644
--- a/website/source/docs/providers/cloudstack/r/instance.html.markdown
+++ b/website/source/docs/providers/cloudstack/r/instance.html.markdown
@@ -32,21 +32,29 @@ The following arguments are supported:
 
 * `display_name` - (Optional) The display name of the instance.
 
-* `service_offering` - (Required) The name or ID of the service offering used for this instance.
+* `service_offering` - (Required) The name or ID of the service offering used
+    for this instance.
 
-* `network` - (Optional) The name or ID of the network to connect this instance to.
-    Changing this forces a new resource to be created.
+* `network` - (Optional) The name or ID of the network to connect this instance
+    to. Changing this forces a new resource to be created.
 
 * `ipaddress` - (Optional) The IP address to assign to this instance. Changing
     this forces a new resource to be created.
 
-* `template` - (Required) The name or ID of the template used for this instance.
-    Changing this forces a new resource to be created.
+* `template` - (Required) The name or ID of the template used for this
+    instance. Changing this forces a new resource to be created.
+
+* `project` - (Optional) The name or ID of the project to deploy this
+    instance to. Changing this forces a new resource to be created.
 
 * `zone` - (Required) The name of the zone where this instance will be created.
     Changing this forces a new resource to be created.
 
-* `user_data` - (Optional) The user data to provide when launching the instance.
+* `user_data` - (Optional) The user data to provide when launching the
+    instance.
+
+* `keypair` - (Optional) The name of the SSH key pair that will be used to
+    access this instance.
 
 * `expunge` - (Optional) This determines if the instance is expunged when it is
     destroyed (defaults false)
diff --git a/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown b/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown
new file mode 100644
index 000000000..a7a57bb27
--- /dev/null
+++ b/website/source/docs/providers/cloudstack/r/ssh_keypair.html.markdown
@@ -0,0 +1,40 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_ssh_keypair"
+sidebar_current: "docs-cloudstack-resource-ssh-keypair"
+description: |-
+  Creates or registers an SSH key pair.
+---
+
+# cloudstack\_ssh\_keypair
+
+Creates or registers an SSH key pair.
+
+## Example Usage
+
+```
+resource "cloudstack_ssh_keypair" "default" {
+  name = "myKey"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the SSH key pair. This is a unique value
+    within a CloudStack account. Changing this forces a new resource to be
+    created.
+
+* `public_key` - (Optional) The path to a public key that will be uploaded
+    the remote machine. If this is omitted, CloudStack will generate a new
+    key pair. Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The key pair ID.
+* `fingerprint` - The fingerprint of the public key specified or created.
+* `private_key` - The private key generated by CloudStack. Only available
+    if CloudStack generated the key pair.
diff --git a/website/source/docs/providers/docker/r/container.html.markdown b/website/source/docs/providers/docker/r/container.html.markdown
index d5a4c823e..5653f139a 100644
--- a/website/source/docs/providers/docker/r/container.html.markdown
+++ b/website/source/docs/providers/docker/r/container.html.markdown
@@ -21,7 +21,7 @@ resource "docker_container" "ubuntu" {
 
 # Find the latest Ubuntu precise image.
 resource "docker_image" "ubuntu" {
-    image = "ubuntu:precise"
+  name = "ubuntu:precise"
 }
 ```
 
@@ -46,6 +46,7 @@ The following arguments are supported:
   kept running. If false, then as long as the container exists, Terraform
   assumes it is successful.
 * `ports` - (Optional) See [Ports](#ports) below for details.
+* `privileged` - (Optional, bool) Run container in privileged mode.
 * `publish_all_ports` - (Optional, bool) Publish all ports of the container.
 * `volumes` - (Optional) See [Volumes](#volumes) below for details.
 
diff --git a/website/source/docs/providers/docker/r/image.html.markdown b/website/source/docs/providers/docker/r/image.html.markdown
index 7a79ad083..f859ef1a9 100644
--- a/website/source/docs/providers/docker/r/image.html.markdown
+++ b/website/source/docs/providers/docker/r/image.html.markdown
@@ -18,7 +18,7 @@ them.
 ```
 # Find the latest Ubuntu precise image.
 resource "docker_image" "ubuntu" {
-    image = "ubuntu:precise"
+    name = "ubuntu:precise"
 }
 
 # Access it somewhere else with ${docker_image.ubuntu.latest}
@@ -28,7 +28,7 @@ resource "docker_image" "ubuntu" {
 
 The following arguments are supported:
 
-* `image` - (Required) The name of the Docker image, including any tags.
+* `name` - (Required) The name of the Docker image, including any tags.
 * `keep_updated` - (Optional) If true, then the Docker image will always
   be updated on the host to the latest. If this is false, as long as an
   image is downloaded with the correct tag, it won't be redownloaded if
diff --git a/website/source/docs/providers/google/r/storage_bucket.html.markdown b/website/source/docs/providers/google/r/storage_bucket.html.markdown
new file mode 100644
index 000000000..b5aa15353
--- /dev/null
+++ b/website/source/docs/providers/google/r/storage_bucket.html.markdown
@@ -0,0 +1,32 @@
+---
+layout: "google"
+page_title: "Google: google_storage_bucket"
+sidebar_current: "docs-google-resource-storage"
+description: |-
+  Creates a new bucket in Google Cloud Storage.
+---
+
+# google\_storage\_bucket
+
+Creates a new bucket in Google cloud storage service(GCS). Currently, it will not change location nor ACL once a bucket has been created with Terraform. For more information see [the official documentation](https://cloud.google.com/storage/docs/overview) and [API](https://cloud.google.com/storage/docs/json_api).
+
+
+## Example Usage
+
+Example creating a private bucket in standard storage, in the EU region. 
+
+```
+resource "google_storage_bucket" "image-store" {
+	name = "image-store-bucket"
+	predefined_acl = "projectPrivate"
+	location = "EU"
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the bucket.
+* `predefined_acl` - (Optional, Default: 'private') The [canned GCS ACL](https://cloud.google.com/storage/docs/access-control#predefined-acl) to apply.
+* `location` - (Optional, Default: 'US') The [GCS location](https://cloud.google.com/storage/docs/bucket-locations) 
+* `force_destroy` - (Optional, Default: false) When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. 
diff --git a/website/source/docs/providers/openstack/index.html.markdown b/website/source/docs/providers/openstack/index.html.markdown
index 808b71d1e..be918a465 100644
--- a/website/source/docs/providers/openstack/index.html.markdown
+++ b/website/source/docs/providers/openstack/index.html.markdown
@@ -60,6 +60,10 @@ The following arguments are supported:
 * `insecure` - (Optional) Explicitly allow the provider to perform
     "insecure" SSL requests. If omitted, default value is `false`
 
+* `endpoint_type` - (Optional) Specify which type of endpoint to use from the
+    service catalog. It can be set using the OS_ENDPOINT_TYPE environment
+    variable. If not set, public endpoints is used.
+
 ## Testing
 
 In order to run the Acceptance Tests for development, the following environment
diff --git a/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown b/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
index 29ea9a29e..27ea7fe64 100644
--- a/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
+++ b/website/source/docs/providers/openstack/r/compute_instance_v2.html.markdown
@@ -83,6 +83,9 @@ The following arguments are supported:
 * `volume` - (Optional) Attach an existing volume to the instance. The volume
     structure is described below.
 
+* `scheduler_hints` - (Optional) Provider the Nova scheduler with hints on how
+    the instance should be launched. The available hints are described below.
+
 The `network` block supports:
 
 * `uuid` - (Required unless `port`  or `name` is provided) The network UUID to
@@ -119,6 +122,25 @@ The `volume` block supports:
     example:  `/dev/vdc`. Omit this option to allow the volume to be
     auto-assigned a device.
 
+The `scheduler_hints` block supports:
+
+* `group` - (Optional) A UUID of a Server Group. The instance will be placed
+    into that group.
+
+* `different_host` - (Optional) A list of instance UUIDs. The instance will
+    be scheduled on a different host than all other instances.
+
+* `same_host` - (Optional) A list of instance UUIDs. The instance will be
+    scheduled on the same host of those specified.
+
+* `query` - (Optional) A conditional query that a compute node must pass in
+    order to host an instance.
+
+* `target_cell` - (Optional) The name of a cell to host the instance.
+
+* `build_near_host_ip` - (Optional) An IP Address in CIDR form. The instance
+    will be placed on a compute node that is in the same subnet.
+
 ## Attributes Reference
 
 The following attributes are exported:
diff --git a/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown b/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown
new file mode 100644
index 000000000..0e64db81f
--- /dev/null
+++ b/website/source/docs/providers/openstack/r/compute_servergroup_v2.html.markdown
@@ -0,0 +1,53 @@
+---
+layout: "openstack"
+page_title: "OpenStack: openstack_compute_servergroup_v2"
+sidebar_current: "docs-openstack-resource-compute-servergroup-v2"
+description: |-
+  Manages a V2 Server Group resource within OpenStack.
+---
+
+# openstack\_compute\_servergroup_v2
+
+Manages a V2 Server Group resource within OpenStack.
+
+## Example Usage
+
+```
+resource "openstack_compute_servergroup_v2" "test-sg" {
+  name = "my-sg"
+  policies = ["anti-affinity"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `region` - (Required) The region in which to obtain the V2 Compute client.
+    If omitted, the `OS_REGION_NAME` environment variable is used. Changing
+    this creates a new server group.
+
+* `name` - (Required) A unique name for the server group. Changing this creates
+    a new server group.
+
+* `policies` - (Required) The set of policies for the server group. Only two
+    two policies are available right now, and both are mutually exclusive. See
+    the Policies section for more information. Changing this creates a new
+    server group.
+
+## Policies
+
+* `affinity` - All instances/servers launched in this group will be hosted on
+    the same compute node.
+
+* `anti-affinity` - All instances/servers launched in this group will be
+    hosted on different compute nodes.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `region` - See Argument Reference above.
+* `name` - See Argument Reference above.
+* `policies` - See Argument Reference above.
+* `members` - The instances that are part of this server group.
diff --git a/website/source/docs/providers/template/r/file.html.md b/website/source/docs/providers/template/r/file.html.md
index a2e176f38..8fc13823b 100644
--- a/website/source/docs/providers/template/r/file.html.md
+++ b/website/source/docs/providers/template/r/file.html.md
@@ -41,3 +41,6 @@ The following attributes are exported:
 * `vars` - See Argument Reference above.
 * `rendered` - The final rendered template.
 
+## Template files syntax
+
+The syntax of the template files is [documented here](/docs/configuration/interpolation.html), under the "Templates" section.
diff --git a/website/source/docs/provisioners/chef.html.markdown b/website/source/docs/provisioners/chef.html.markdown
index 006478682..24a682b55 100644
--- a/website/source/docs/provisioners/chef.html.markdown
+++ b/website/source/docs/provisioners/chef.html.markdown
@@ -67,6 +67,13 @@ The following arguments are supported:
 
 * `node_name (string)` - (Required) The name of the node to register with the Chef Server.
 
+* `ohai_hints (array)` - (Optional) A list with
+  [Ohai hints](https://docs.chef.io/ohai.html#hints) to upload to the node.
+
+* `os_type (string)` - (Optional) The OS type of the node. Valid options are: `linux` and
+  `windows`. If not supplied the connection type will be used to determine the OS type (`ssh`
+  will asume `linux` and `winrm` will assume `windows`).
+
 * `prevent_sudo (boolean)` - (Optional) Prevent the use of sudo while installing, configuring
   and running the initial Chef Client run. This option is only used with `ssh` type
   [connections](/docs/provisioners/connection.html).
diff --git a/website/source/docs/provisioners/connection.html.markdown b/website/source/docs/provisioners/connection.html.markdown
index 8012b2c86..6efd73e83 100644
--- a/website/source/docs/provisioners/connection.html.markdown
+++ b/website/source/docs/provisioners/connection.html.markdown
@@ -71,7 +71,7 @@ provisioner "file" {
 * `key_file` - The SSH key to use for the connection. This takes preference over the
   password if provided.
 
-* `agent` - Set to true to enable using ssh-agent to authenticate.
+* `agent` - Set to false to disable using ssh-agent to authenticate.
 
 **Additional arguments only supported by the "winrm" connection type:**
 
@@ -80,3 +80,24 @@ provisioner "file" {
 * `insecure` - Set to true to not validate the HTTPS certificate chain.
 
 * `cacert` - The CA certificate to validate against.
+
+<a id="bastion"></a>
+## Connecting through a Bastion Host with SSH
+
+The `ssh` connection additionally supports the following fields to facilitate a
+[bastion host](https://en.wikipedia.org/wiki/Bastion_host) connection.
+
+* `bastion_host` - Setting this enables the bastion Host connection. This host
+  will be connected to first, and the `host` connection will be made from there.
+
+* `bastion_port` - The port to use connect to the bastion host. Defaults to the
+  value of `port`.
+
+* `bastion_user` - The user to use to connect to the bastion host. Defaults to
+  the value of `user`.
+
+* `bastion_password` - The password we should use for the bastion host.
+  Defaults to the value of `password`.
+
+* `bastion_key_file` - The SSH key to use for the bastion host. Defaults to the
+  value of `key_file`.
diff --git a/website/source/docs/state/remote.html.md b/website/source/docs/state/remote.html.md
index 483526c96..3ab01fa79 100644
--- a/website/source/docs/state/remote.html.md
+++ b/website/source/docs/state/remote.html.md
@@ -47,7 +47,7 @@ An example is shown below:
 resource "terraform_remote_state" "vpc" {
     backend = "atlas"
     config {
-        path = "hashicorp/vpc-prod"
+        name = "hashicorp/vpc-prod"
     }
 }
 
diff --git a/website/source/downloads.html.erb b/website/source/downloads.html.erb
index 834e18af3..1eb63cc22 100644
--- a/website/source/downloads.html.erb
+++ b/website/source/downloads.html.erb
@@ -17,6 +17,12 @@ description: |-
 			operating system and architecture. You can find SHA256 checksums
 			for packages <a href="https://dl.bintray.com/mitchellh/terraform/terraform_<%= latest_version %>_SHA256SUMS?direct">here</a>.
 			</p>
+
+			<p>
+			Each release archive is a <code>zip</code> file containing the Terraform binary
+			executables at the top level. These executables are meant to be extracted
+			to a location where they can be found by your shell.
+			</p>
 		</div>
 	</div>
 	<% product_versions.each do |os, versions| %>
diff --git a/website/source/intro/examples/index.html.markdown b/website/source/intro/examples/index.html.markdown
index 8ac1e0d45..11e2c24dc 100644
--- a/website/source/intro/examples/index.html.markdown
+++ b/website/source/intro/examples/index.html.markdown
@@ -50,6 +50,9 @@ This will put the example files within your working directory. You can then
 use your own editor to read and browse the configurations. This command will
 not _run_ any code.
 
+~> If you want to browse the files before downloading them, you can [view
+them on GitHub](https://github.com/hashicorp/terraform/tree/master/examples/aws-two-tier).
+
 If you want to run the example, just run `terraform apply`:
 
 ```
diff --git a/website/source/intro/getting-started/install.html.markdown b/website/source/intro/getting-started/install.html.markdown
index 629e97a57..2392e3549 100644
--- a/website/source/intro/getting-started/install.html.markdown
+++ b/website/source/intro/getting-started/install.html.markdown
@@ -57,4 +57,10 @@ If you get an error that `terraform` could not be found, then your PATH
 environment variable was not setup properly. Please go back and ensure
 that your PATH variable contains the directory where Terraform was installed.
 
-Otherwise, Terraform is installed and ready to go!
+Otherwise, Terraform is installed and ready to go! Nice!
+
+## Next Step
+
+Time to [build infrastructure](/intro/getting-started/build.html)
+using a minimal Terraform configuration file. You will be able to
+examine Terraform's execution plan before you deploy it to AWS.
diff --git a/website/source/layouts/aws.erb b/website/source/layouts/aws.erb
index 22358e010..938feab7a 100644
--- a/website/source/layouts/aws.erb
+++ b/website/source/layouts/aws.erb
@@ -13,8 +13,23 @@
 				<li<%= sidebar_current(/^docs-aws-resource/) %>>
 					<a href="#">Resources</a>
 					<ul class="nav nav-visible">
-						<li<%= sidebar_current("docs-aws-resource-autoscale") %>>
-							<a href="/docs/providers/aws/r/autoscale.html">aws_autoscaling_group</a>
+						<li<%= sidebar_current("docs-aws-app-cookie-stickiness-policy") %>>
+							<a href="/docs/providers/aws/r/app_cookie_stickiness_policy.html">aws_app_cookie_stickiness_policy</a>
+						</li>
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-group") %>>
+							<a href="/docs/providers/aws/r/autoscaling_group.html">aws_autoscaling_group</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-notification") %>>
+							<a href="/docs/providers/aws/r/autoscaling_notification.html">aws_autoscaling_notification</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-autoscaling-policy") %>>
+							<a href="/docs/providers/aws/r/autoscaling_policy.html">aws_autoscaling_policy</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-cloudwatch-metric-alarm") %>>
+							<a href="/docs/providers/aws/r/cloudwatch_metric_alarm.html">aws_cloudwatch_metric_alarm</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-customer-gateway") %>>
@@ -25,6 +40,10 @@
 							<a href="/docs/providers/aws/r/db_instance.html">aws_db_instance</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-db-parameter-group") %>>
+							<a href="/docs/providers/aws/r/db_parameter_group.html">aws_db_parameter_group</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-db-security-group") %>>
 							<a href="/docs/providers/aws/r/db_security_group.html">aws_db_security_group</a>
 						</li>
@@ -33,14 +52,26 @@
 							<a href="/docs/providers/aws/r/db_subnet_group.html">aws_db_subnet_group</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-db-parameter-group") %>>
-							<a href="/docs/providers/aws/r/db_parameter_group.html">aws_db_parameter_group</a>
+						<li<%= sidebar_current("docs-aws-resource-dynamodb-table") %>>
+							<a href="/docs/providers/aws/r/dynamodb_table.html">aws_dynamodb_table</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-ebs-volume") %>>
 							<a href="/docs/providers/aws/r/ebs_volume.html">aws_ebs_volume</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-ecs-cluster") %>>
+							<a href="/docs/providers/aws/r/ecs_cluster.html">aws_ecs_cluster</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-ecs-service") %>>
+							<a href="/docs/providers/aws/r/ecs_service.html">aws_ecs_service</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-ecs-task-definition") %>>
+							<a href="/docs/providers/aws/r/ecs_task_definition.html">aws_ecs_task_definition</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-eip") %>>
 							<a href="/docs/providers/aws/r/eip.html">aws_eip</a>
 						</li>
@@ -49,6 +80,10 @@
 							<a href="/docs/providers/aws/r/elasticache_cluster.html">aws_elasticache_cluster</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-elasticache-parameter-group") %>>
+							<a href="/docs/providers/aws/r/elasticache_parameter_group.html">aws_elasticache_parameter_group</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-elasticache-security-group") %>>
 							<a href="/docs/providers/aws/r/elasticache_security_group.html">aws_elasticache_security_group</a>
 						</li>
@@ -61,6 +96,10 @@
 							<a href="/docs/providers/aws/r/elb.html">aws_elb</a>
 						</li>
 
+                                                <li<%= sidebar_current("docs-aws-resource-flow-log") %>>
+                                                        <a href="/docs/providers/aws/r/flow_log.html">aws_flow_log</a>
+                                                </li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-access-key") %>>
 							<a href="/docs/providers/aws/r/iam_access_key.html">aws_iam_access_key</a>
 						</li>
@@ -73,6 +112,10 @@
 							<a href="/docs/providers/aws/r/iam_group_policy.html">aws_iam_group_policy</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-iam-group-membership") %>>
+							<a href="/docs/providers/aws/r/iam_group_membership.html">aws_iam_group_membership</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-instance-profile") %>>
 							<a href="/docs/providers/aws/r/iam_instance_profile.html">aws_iam_instance_profile</a>
 						</li>
@@ -80,6 +123,9 @@
 						<li<%= sidebar_current("docs-aws-resource-iam-policy") %>>
 							<a href="/docs/providers/aws/r/iam_policy.html">aws_iam_policy</a>
 						</li>
+						<li<%= sidebar_current("docs-aws-resource-iam-policy-attachment") %>>
+							<a href="/docs/providers/aws/r/iam_policy_attachment.html">aws_iam_policy_attachment</a>
+						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-iam-role") %>>
 							<a href="/docs/providers/aws/r/iam_role.html">aws_iam_role</a>
@@ -89,6 +135,10 @@
 							<a href="/docs/providers/aws/r/iam_role_policy.html">aws_iam_role_policy</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-iam-server-certificate") %>>
+							<a href="/docs/providers/aws/r/iam_server_certificate.html">aws_iam_server_certificate</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-iam-user") %>>
 							<a href="/docs/providers/aws/r/iam_user.html">aws_iam_user</a>
 						</li>
@@ -105,8 +155,20 @@
 							<a href="/docs/providers/aws/r/internet_gateway.html">aws_internet_gateway</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-launch-config") %>>
-							<a href="/docs/providers/aws/r/launch_config.html">aws_launch_configuration</a>
+						<li<%= sidebar_current("docs-aws-resource-key-pair") %>>
+							<a href="/docs/providers/aws/r/key_pair.html">aws_key_pair</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-kinesis-stream") %>>
+							<a href="/docs/providers/aws/r/kinesis_stream.html">aws_kinesis_stream</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-lambda-function") %>>
+							<a href="/docs/providers/aws/r/lambda_function.html">aws_lambda_function</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-launch-configuration") %>>
+							<a href="/docs/providers/aws/r/launch_configuration.html">aws_launch_configuration</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-lb-cookie-stickiness-policy") %>>
@@ -120,20 +182,21 @@
 						<li<%= sidebar_current("docs-aws-resource-network-acl") %>>
 							<a href="/docs/providers/aws/r/network_acl.html">aws_network_acl</a>
 						</li>
-						<li<%= sidebar_current("docs-aws-resource-key-pair") %>>
-							<a href="/docs/providers/aws/r/key_pair.html">aws_key_pair</a>
+
+						<li<%= sidebar_current("docs-aws-resource-network-interface") %>>
+							<a href="/docs/providers/aws/r/network_interface.html">aws_network_interface</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-proxy-protocol-policy") %>>
 							<a href="/docs/providers/aws/r/proxy_protocol_policy.html">aws_proxy_protocol_policy</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-route-table|") %>>
-							<a href="/docs/providers/aws/r/route_table.html">aws_route_table</a>
+						<li<%= sidebar_current("docs-aws-resource-route53-delegation-set") %>>
+							<a href="/docs/providers/aws/r/route53_delegation_set.html">aws_route53_delegation_set</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-route-table-assoc") %>>
-							<a href="/docs/providers/aws/r/route_table_assoc.html">aws_route_table_association</a>
+						<li<%= sidebar_current("docs-aws-resource-route53-health-check") %>>
+							<a href="/docs/providers/aws/r/route53_health_check.html">aws_route53_health_check</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-route53-record") %>>
@@ -148,6 +211,14 @@
 							<a href="/docs/providers/aws/r/route53_zone_association.html">aws_route53_zone_association</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-route-table|") %>>
+							<a href="/docs/providers/aws/r/route_table.html">aws_route_table</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-route-table-association") %>>
+							<a href="/docs/providers/aws/r/route_table_association.html">aws_route_table_association</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-s3-bucket") %>>
 							<a href="/docs/providers/aws/r/s3_bucket.html">aws_s3_bucket</a>
 						</li>
@@ -160,6 +231,18 @@
 							<a href="/docs/providers/aws/r/security_group_rule.html">aws_security_group_rule</a>
 						</li>
 
+						<li<%= sidebar_current("docs-aws-resource-sns-topic") %>>
+							<a href="/docs/providers/aws/r/sns_topic.html">aws_sns_topic</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-sns-topic-subscription") %>>
+							<a href="/docs/providers/aws/r/sns_topic_subscription.html">aws_sns_topic_subscription</a>
+						</li>
+
+						<li<%= sidebar_current("docs-aws-resource-spot-instance-request") %>>
+							<a href="/docs/providers/aws/r/spot_instance_request.html">aws_spot_instance_request</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-sqs-queue") %>>
 							<a href="/docs/providers/aws/r/sqs_queue.html">aws_sqs_queue</a>
 						</li>
@@ -168,12 +251,12 @@
 							<a href="/docs/providers/aws/r/subnet.html">aws_subnet</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-vpc") %>>
-							<a href="/docs/providers/aws/r/vpc.html">aws_vpc</a>
+						<li<%= sidebar_current("docs-aws-resource-volume-attachment") %>>
+							<a href="/docs/providers/aws/r/volume_attachment.html">aws_volume_attachment</a>
 						</li>
 
-						<li<%= sidebar_current("docs-aws-resource-vpc-peering") %>>
-							<a href="/docs/providers/aws/r/vpc_peering.html">aws_vpc_peering</a>
+						<li<%= sidebar_current("docs-aws-resource-vpc") %>>
+							<a href="/docs/providers/aws/r/vpc.html">aws_vpc</a>
 						</li>
 
 						<li<%= sidebar_current("docs-aws-resource-vpc-dhcp-options") %>>
@@ -183,6 +266,11 @@
 						<li<%= sidebar_current("docs-aws-resource-vpc-dhcp-options-association") %>>
 							<a href="/docs/providers/aws/r/vpc_dhcp_options_association.html">aws_vpc_dhcp_options_association</a>
 
+
+						<li<%= sidebar_current("docs-aws-resource-vpc-peering") %>>
+							<a href="/docs/providers/aws/r/vpc_peering.html">aws_vpc_peering</a>
+						</li>
+
 						<li<%= sidebar_current("docs-aws-resource-vpn-connection") %>>
 							<a href="/docs/providers/aws/r/vpn_connection.html">aws_vpn_connection</a>
 						</li>
diff --git a/website/source/layouts/azure.erb b/website/source/layouts/azure.erb
new file mode 100644
index 000000000..47356cba4
--- /dev/null
+++ b/website/source/layouts/azure.erb
@@ -0,0 +1,86 @@
+<% wrap_layout :inner do %>
+    <% content_for :sidebar do %>
+        <div class="docs-sidebar hidden-print affix-top" role="complementary">
+            <ul class="nav docs-sidenav">
+                <li<%= sidebar_current("docs-home") %>>
+                    <a href="/docs/providers/index.html">&laquo; Documentation Home</a>
+                </li>
+
+                <li<%= sidebar_current("docs-azure-index") %>>
+                    <a href="/docs/providers/azure/index.html">Azure Provider</a>
+                </li>
+
+                <li<%= sidebar_current(/^docs-azure-resource/) %>>
+                    <a href="#">Resources</a>
+                    <ul class="nav nav-visible">
+                        <li<%= sidebar_current("docs-azure-resource-affinity-group") %>>
+                            <a href="/docs/providers/azure/r/affinity_group.html">azure_affinity_group</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-data-disk") %>>
+                            <a href="/docs/providers/azure/r/data_disk.html">azure_data_disk</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-dns-server") %>>
+                            <a href="/docs/providers/azure/r/dns_server.html">azure_dns_server</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-hosted-service") %>>
+                            <a href="/docs/providers/azure/r/hosted_service.html">azure_hosted_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-instance") %>>
+                            <a href="/docs/providers/azure/r/instance.html">azure_instance</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-local-network") %>>
+                            <a href="/docs/providers/azure/r/local_network_connection.html">azure_local_network_connection</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-security-group") %>>
+                            <a href="/docs/providers/azure/r/security_group.html">azure_security_group</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-security-group-rule") %>>
+                            <a href="/docs/providers/azure/r/security_group_rule.html">azure_security_group_rule</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-server") %>>
+                            <a href="/docs/providers/azure/r/sql_database_server.html">azure_sql_database_server</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-server-firewall-rule") %>>
+                            <a href="/docs/providers/azure/r/sql_database_server_firewall_rule.html">azure_sql_database_server_firewall_rule</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-sql-database-service") %>>
+                            <a href="/docs/providers/azure/r/sql_database_service.html">azure_sql_database_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-blob") %>>
+                            <a href="/docs/providers/azure/r/storage_blob.html">azure_storage_blob</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-container") %>>
+                            <a href="/docs/providers/azure/r/storage_container.html">azure_storage_container</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-queue") %>>
+                            <a href="/docs/providers/azure/r/storage_queue.html">azure_storage_queue</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-storage-service") %>>
+                            <a href="/docs/providers/azure/r/storage_service.html">azure_storage_service</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-azure-resource-virtual-network") %>>
+                            <a href="/docs/providers/azure/r/virtual_network.html">azure_virtual_network</a>
+                        </li>
+                    </ul>
+                </li>
+            </ul>
+        </div>
+    <% end %>
+
+    <%= yield %>
+<% end %>
diff --git a/website/source/layouts/cloudstack.erb b/website/source/layouts/cloudstack.erb
index d9830586c..c2051b1b7 100644
--- a/website/source/layouts/cloudstack.erb
+++ b/website/source/layouts/cloudstack.erb
@@ -53,6 +53,10 @@
                             <a href="/docs/providers/cloudstack/r/port_forward.html">cloudstack_port_forward</a>
                         </li>
 
+			<li<%= sidebar_current("docs-cloudstack-resource-ssh-keypair") %>>
+                            <a href="/docs/providers/cloudstack/r/ssh_keypair.html">cloudstack_ssh_keypair</a>
+                        </li>
+
                         <li<%= sidebar_current("docs-cloudstack-resource-template") %>>
                             <a href="/docs/providers/cloudstack/r/template.html">cloudstack_template</a>
                         </li>
diff --git a/website/source/layouts/docs.erb b/website/source/layouts/docs.erb
index dd60cad04..dbbf87b8a 100644
--- a/website/source/layouts/docs.erb
+++ b/website/source/layouts/docs.erb
@@ -119,19 +119,23 @@
                 <ul class="nav">
 					<li<%= sidebar_current("docs-providers-atlas") %>>
 					<a href="/docs/providers/atlas/index.html">Atlas</a>
-                    </li>
+          </li>
 
 					<li<%= sidebar_current("docs-providers-aws") %>>
 					<a href="/docs/providers/aws/index.html">AWS</a>
 					</li>
 
+					<li<%= sidebar_current("docs-providers-azure") %>>
+					<a href="/docs/providers/azure/index.html">Azure</a>
+					</li>
+
 					<li<%= sidebar_current("docs-providers-cloudflare") %>>
 					<a href="/docs/providers/cloudflare/index.html">CloudFlare</a>
-                    </li>
+          </li>
 
           <li<%= sidebar_current("docs-providers-cloudstack") %>>
 					<a href="/docs/providers/cloudstack/index.html">CloudStack</a>
-                    </li>
+          </li>
 
 					<li<%= sidebar_current("docs-providers-consul") %>>
 					<a href="/docs/providers/consul/index.html">Consul</a>
diff --git a/website/source/layouts/google.erb b/website/source/layouts/google.erb
index fc36ea215..1cca724da 100644
--- a/website/source/layouts/google.erb
+++ b/website/source/layouts/google.erb
@@ -60,6 +60,9 @@
 			<li<%= sidebar_current("docs-google-resource-dns-record-set") %>>
 			<a href="/docs/providers/google/r/dns_record_set.html">google_dns_record_set</a>
 			</li>
+			<li<%= sidebar_current("docs-google-resource-storage-bucket") %>>
+			<a href="/docs/providers/google/r/storage_bucket.html">google_storage_bucket</a>
+			</li>
 		</ul>
 		</li>
 	</ul>
diff --git a/website/source/layouts/openstack.erb b/website/source/layouts/openstack.erb
index 318c5875e..052d03cf1 100644
--- a/website/source/layouts/openstack.erb
+++ b/website/source/layouts/openstack.erb
@@ -31,9 +31,6 @@
             <li<%= sidebar_current("docs-openstack-resource-fw-firewall-v1") %>>
               <a href="/docs/providers/openstack/r/fw_firewall_v1.html">openstack_fw_firewall_v1</a>
             </li>
-            <li<%= sidebar_current("docs-openstack-resource-fw-firewall-v1") %>>
-              <a href="/docs/providers/openstack/r/fw_firewall_v1.html">openstack_fw_firewall_v1</a>
-            </li>
             <li<%= sidebar_current("docs-openstack-resource-fw-policy-v1") %>>
               <a href="/docs/providers/openstack/r/fw_policy_v1.html">openstack_fw_policy_v1</a>
             </li>