terraform: Relax provider config ref constraints

Work in progress, needs tests and the eyes of someone who knows what
they're doing.

Author: alisdair

terraform/eval_provider.go

@@ -49,9 +49,10 @@ func buildProviderConfig(ctx EvalContext, addr addrs.AbsProviderConfig, config *
 // EvalConfigProvider is an EvalNode implementation that configures
 // a provider that is already initialized and retrieved.
 type EvalConfigProvider struct {
-	Addr     addrs.AbsProviderConfig
-	Provider *providers.Interface
-	Config   *configs.Provider
+	Addr                addrs.AbsProviderConfig
+	Provider            *providers.Interface
+	Config              *configs.Provider
+	VerifyConfigIsKnown bool
 }
 
 func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
@@ -78,6 +79,16 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 		return nil, diags.NonFatalErr()
 	}
 
+	if n.VerifyConfigIsKnown && !configVal.IsWhollyKnown() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Invalid provider configuration",
+			Detail:   fmt.Sprintf("The configuration for %s depends on values that cannot be determined until apply.", n.Addr),
+			Subject:  &config.DeclRange,
+		})
+		return nil, diags.NonFatalErr()
+	}
+
 	configDiags := ctx.ConfigureProvider(n.Addr, configVal)
 	configDiags = configDiags.InConfigBody(configBody)
 

terraform/evaltree_provider.go

@@ -18,19 +18,6 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNo
 		Addr: addr,
 	})
 
-	// Input stuff
-	seq = append(seq, &EvalOpFilter{
-		Ops: []walkOperation{walkImport},
-		Node: &EvalSequence{
-			Nodes: []EvalNode{
-				&EvalGetProvider{
-					Addr:   addr,
-					Output: &provider,
-				},
-			},
-		},
-	})
-
 	seq = append(seq, &EvalOpFilter{
 		Ops: []walkOperation{walkValidate},
 		Node: &EvalSequence{
@@ -48,7 +35,6 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNo
 		},
 	})
 
-	// Apply stuff
 	seq = append(seq, &EvalOpFilter{
 		Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkDestroy, walkImport},
 		Node: &EvalSequence{
@@ -64,7 +50,7 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNo
 	// We configure on everything but validate, since validate may
 	// not have access to all the variables.
 	seq = append(seq, &EvalOpFilter{
-		Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkDestroy, walkImport},
+		Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkDestroy},
 		Node: &EvalSequence{
 			Nodes: []EvalNode{
 				&EvalConfigProvider{
@@ -75,6 +61,19 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNo
 			},
 		},
 	})
+	seq = append(seq, &EvalOpFilter{
+		Ops: []walkOperation{walkImport},
+		Node: &EvalSequence{
+			Nodes: []EvalNode{
+				&EvalConfigProvider{
+					Addr:                addr,
+					Provider:            &provider,
+					Config:              config,
+					VerifyConfigIsKnown: true,
+				},
+			},
+		},
+	})
 
 	return &EvalSequence{Nodes: seq}
 }

terraform/graph_builder_import.go

@@ -94,9 +94,6 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
 		// configuration
 		&attachDataResourceDependenciesTransformer{},
 
-		// This validates that the providers only depend on variables
-		&ImportProviderValidateTransformer{},
-
 		// Close opened plugin connections
 		&CloseProviderTransformer{},