diff --git a/terraform/eval_context_builtin.go b/terraform/eval_context_builtin.go
index bda5676d0..af46a23bb 100644
--- a/terraform/eval_context_builtin.go
+++ b/terraform/eval_context_builtin.go
@@ -198,6 +198,12 @@ func (ctx *BuiltinEvalContext) ProviderInput(pc addrs.ProviderConfig) map[string
 func (ctx *BuiltinEvalContext) SetProviderInput(pc addrs.ProviderConfig, c map[string]cty.Value) {
 	absProvider := pc.Absolute(ctx.Path())
 
+	if !ctx.Path().IsRoot() {
+		// Only root module provider configurations can have input.
+		log.Printf("[WARN] BuiltinEvalContext: attempt to SetProviderInput for non-root module")
+		return
+	}
+
 	// Save the configuration
 	ctx.ProviderLock.Lock()
 	ctx.ProviderInputConfig[absProvider.String()] = c
diff --git a/terraform/eval_context_builtin_test.go b/terraform/eval_context_builtin_test.go
index 2e2081a0c..da1382e0f 100644
--- a/terraform/eval_context_builtin_test.go
+++ b/terraform/eval_context_builtin_test.go
@@ -28,17 +28,17 @@ func TestBuiltinEvalContextProviderInput(t *testing.T) {
 	expected1 := map[string]cty.Value{"value": cty.StringVal("foo")}
 	ctx1.SetProviderInput(providerAddr, expected1)
 
-	expected2 := map[string]cty.Value{"value": cty.StringVal("bar")}
-	ctx2.SetProviderInput(providerAddr, expected2)
+	try2 := map[string]cty.Value{"value": cty.StringVal("bar")}
+	ctx2.SetProviderInput(providerAddr, try2) // ignored because not a root module
 
 	actual1 := ctx1.ProviderInput(providerAddr)
 	actual2 := ctx2.ProviderInput(providerAddr)
 
 	if !reflect.DeepEqual(actual1, expected1) {
-		t.Fatalf("bad: %#v %#v", actual1, expected1)
+		t.Errorf("wrong result 1\ngot:  %#v\nwant: %#v", actual1, expected1)
 	}
-	if !reflect.DeepEqual(actual2, expected2) {
-		t.Fatalf("bad: %#v %#v", actual2, expected2)
+	if actual2 != nil {
+		t.Errorf("wrong result 2\ngot:  %#v\nwant: %#v", actual2, nil)
 	}
 }