diff --git a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall.go b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall.go
index 3eef7be14..d5b9d80bd 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall.go
@@ -397,6 +397,11 @@ func resourceCloudStackEgressFirewallDeleteRule(
 	uuids := rule["uuids"].(map[string]interface{})
 
 	for k, id := range uuids {
+		// We don't care about the count here, so just continue
+		if k == "#" {
+			continue
+		}
+
 		// Create the parameter struct
 		p := cs.Firewall.NewDeleteEgressFirewallRuleParams(id.(string))
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
index e68397a0d..8e70901d9 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_egress_firewall_test.go
@@ -111,7 +111,7 @@ func testAccCheckCloudStackEgressFirewallRulesExist(n string) resource.TestCheck
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}
 
@@ -144,7 +144,7 @@ func testAccCheckCloudStackEgressFirewallDestroy(s *terraform.State) error {
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}
 
@@ -165,25 +165,23 @@ resource "cloudstack_egress_firewall" "foo" {
   ipaddress = "%s"
 
   rule {
-    source_cidr = "10.0.0.0/24"
+    source_cidr = "%s/32"
     protocol = "tcp"
     ports = ["80", "1000-2000"]
   }
-}`, CLOUDSTACK_NETWORK_1)
+}`,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_NETWORK_1_IPADDRESS)
 
 var testAccCloudStackEgressFirewall_update = fmt.Sprintf(`
 resource "cloudstack_egress_firewall" "foo" {
   ipaddress = "%s"
 
   rule {
-    source_cidr = "10.0.0.0/24"
+    source_cidr = "%s/32"
     protocol = "tcp"
-    ports = ["80", "1000-2000"]
+    ports = ["80", "443", 1000-2000"]
   }
-
-  rule {
-    source_cidr = "172.16.100.0/24"
-    protocol = "tcp"
-    ports = ["80", "443"]
-  }
-}`, CLOUDSTACK_NETWORK_1)
+}`,
+	CLOUDSTACK_NETWORK_1,
+	CLOUDSTACK_NETWORK_1_IPADDRESS)
diff --git a/builtin/providers/cloudstack/resource_cloudstack_firewall.go b/builtin/providers/cloudstack/resource_cloudstack_firewall.go
index 7de4da2a6..75f0410e6 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_firewall.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_firewall.go
@@ -393,6 +393,11 @@ func resourceCloudStackFirewallDeleteRule(
 	uuids := rule["uuids"].(map[string]interface{})
 
 	for k, id := range uuids {
+		// We don't care about the count here, so just continue
+		if k == "#" {
+			continue
+		}
+
 		// Create the parameter struct
 		p := cs.Firewall.NewDeleteFirewallRuleParams(id.(string))
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
index f2fa8a78b..bb629cfab 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_firewall_test.go
@@ -111,7 +111,7 @@ func testAccCheckCloudStackFirewallRulesExist(n string) resource.TestCheckFunc {
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}
 
@@ -144,7 +144,7 @@ func testAccCheckCloudStackFirewallDestroy(s *terraform.State) error {
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
index d2c9b56fd..6e13e90c9 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule.go
@@ -417,6 +417,11 @@ func resourceCloudStackNetworkACLRuleDeleteRule(
 	uuids := rule["uuids"].(map[string]interface{})
 
 	for k, id := range uuids {
+		// We don't care about the count here, so just continue
+		if k == "#" {
+			continue
+		}
+
 		// Create the parameter struct
 		p := cs.NetworkACL.NewDeleteNetworkACLParams(id.(string))
 
diff --git a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
index 5b71ec5de..1a577ac7f 100644
--- a/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
+++ b/builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go
@@ -123,7 +123,7 @@ func testAccCheckCloudStackNetworkACLRulesExist(n string) resource.TestCheckFunc
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}
 
@@ -156,7 +156,7 @@ func testAccCheckCloudStackNetworkACLRuleDestroy(s *terraform.State) error {
 		}
 
 		for k, uuid := range rs.Primary.Attributes {
-			if !strings.Contains(k, "uuids") {
+			if !strings.Contains(k, ".uuids.") || strings.HasSuffix(k, ".uuids.#") {
 				continue
 			}