providers/aws: test tag removal

builtin/providers/aws/resource_aws_vpc_test.go

@@ -48,6 +48,15 @@ func TestAccVpc_tags(t *testing.T) {
 					testAccCheckTags(&vpc.Tags, "foo", "bar"),
 				),
 			},
+
+			resource.TestStep{
+				Config: testAccVpcConfigTagsUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVpcExists("aws_vpc.foo", &vpc),
+					testAccCheckTags(&vpc.Tags, "foo", ""),
+					testAccCheckTags(&vpc.Tags, "bar", "baz"),
+				),
+			},
 		},
 	})
 }
@@ -170,3 +179,13 @@ resource "aws_vpc" "foo" {
 	}
 }
 `
+
+const testAccVpcConfigTagsUpdate = `
+resource "aws_vpc" "foo" {
+	cidr_block = "10.1.0.0/16"
+
+	tags {
+		bar = "baz"
+	}
+}
+`

builtin/providers/aws/tags_test.go

@@ -14,9 +14,15 @@ func testAccCheckTags(
 	return func(s *terraform.State) error {
 		m := tagsToMap(*ts)
 		v, ok := m[key]
-		if !ok {
+		if value != "" && !ok {
 			return fmt.Errorf("Missing tag: %s", key)
+		} else if value == "" && ok {
+			return fmt.Errorf("Extra tag: %s", key)
 		}
+		if value == "" {
+			return nil
+		}
+
 		if v != value {
 			return fmt.Errorf("%s: bad value: %s", key, v)
 		}

helper/schema/resource_data.go

@@ -373,6 +373,7 @@ func (d *ResourceData) getMap(
 	if d.config != nil && source == getSourceConfig {
 		// For config, we always set the result to exactly what was requested
 		if mraw, ok := d.config.Get(k); ok {
+			result = make(map[string]interface{})
 			switch m := mraw.(type) {
 			case []interface{}:
 				for _, innerRaw := range m {

helper/schema/schema.go

@@ -143,6 +143,10 @@ func (s *Schema) finalizeDiff(
 		return d
 	}
 
+	if d.NewRemoved {
+		return d
+	}
+
 	if s.Computed {
 		if d.Old != "" && d.New == "" {
 			// This is a computed value with an old value set already,