diff --git a/terraform/context_plan_test.go b/terraform/context_plan_test.go
index 2cadb5ab8..d2c3dbb3b 100644
--- a/terraform/context_plan_test.go
+++ b/terraform/context_plan_test.go
@@ -841,6 +841,27 @@ func TestContext2Plan_preventDestroy_destroyPlan(t *testing.T) {
 	}
 }
 
+func TestContext2Plan_provisionerCycle(t *testing.T) {
+	m := testModule(t, "plan-provisioner-cycle")
+	p := testProvider("aws")
+	p.DiffFn = testDiffFn
+	pr := testProvisioner()
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		Provisioners: map[string]ResourceProvisionerFactory{
+			"local-exec": testProvisionerFuncFixed(pr),
+		},
+	})
+
+	_, err := ctx.Plan()
+	if err == nil {
+		t.Fatalf("should error")
+	}
+}
+
 func TestContext2Plan_computed(t *testing.T) {
 	m := testModule(t, "plan-computed")
 	p := testProvider("aws")
diff --git a/terraform/graph_config_node_resource.go b/terraform/graph_config_node_resource.go
index 1c45289a9..0e35d4b38 100644
--- a/terraform/graph_config_node_resource.go
+++ b/terraform/graph_config_node_resource.go
@@ -188,7 +188,7 @@ func (n *GraphNodeConfigResource) DynamicExpand(ctx EvalContext) (*Graph, error)
 	steps = append(steps, &RootTransformer{})
 
 	// Build the graph
-	b := &BasicGraphBuilder{Steps: steps}
+	b := &BasicGraphBuilder{Steps: steps, Validate: true}
 	return b.Build(ctx.Path())
 }
 
diff --git a/terraform/test-fixtures/plan-provisioner-cycle/main.tf b/terraform/test-fixtures/plan-provisioner-cycle/main.tf
new file mode 100644
index 000000000..ed65c0918
--- /dev/null
+++ b/terraform/test-fixtures/plan-provisioner-cycle/main.tf
@@ -0,0 +1,7 @@
+resource "aws_instance" "foo" {
+    count = 3
+
+    provisioner "local-exec" {
+        command = "echo ${aws_instance.foo.0.id} ${aws_instance.foo.1.id} ${aws_instance.foo.2.id}"
+    }
+}