diff --git a/builtin/providers/aws/config.go b/builtin/providers/aws/config.go
index 10c80a90e..8861b260f 100644
--- a/builtin/providers/aws/config.go
+++ b/builtin/providers/aws/config.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform/helper/logging"
 	"github.com/hashicorp/terraform/terraform"
 
 	"crypto/tls"
@@ -151,6 +152,11 @@ func (c *Config) Client() (interface{}, error) {
 			HTTPClient:  cleanhttp.DefaultClient(),
 		}
 
+		if logging.IsDebugOrHigher() {
+			awsConfig.LogLevel = aws.LogLevel(aws.LogDebugWithHTTPBody)
+			awsConfig.Logger = awsLogger{}
+		}
+
 		if c.Insecure {
 			transport := awsConfig.HTTPClient.Transport.(*http.Transport)
 			transport.TLSClientConfig = &tls.Config{
@@ -433,3 +439,15 @@ var addTerraformVersionToUserAgent = request.NamedHandler{
 	Fn: request.MakeAddToUserAgentHandler(
 		"terraform", terraform.Version, terraform.VersionPrerelease),
 }
+
+type awsLogger struct{}
+
+func (l awsLogger) Log(args ...interface{}) {
+	tokens := make([]string, 0, len(args))
+	for _, arg := range args {
+		if token, ok := arg.(string); ok {
+			tokens = append(tokens, token)
+		}
+	}
+	log.Printf("[DEBUG] [aws-sdk-go] %s", strings.Join(tokens, " "))
+}
diff --git a/helper/logging/logging.go b/helper/logging/logging.go
index b8de7a37f..bff2c7254 100644
--- a/helper/logging/logging.go
+++ b/helper/logging/logging.go
@@ -22,8 +22,9 @@ var validLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
 // LogOutput determines where we should send logs (if anywhere) and the log level.
 func LogOutput() (logOutput io.Writer, err error) {
 	logOutput = ioutil.Discard
-	envLevel := os.Getenv(EnvLog)
-	if envLevel == "" {
+
+	logLevel := LogLevel()
+	if logLevel == "" {
 		return
 	}
 
@@ -37,23 +38,38 @@ func LogOutput() (logOutput io.Writer, err error) {
 	}
 
 	// This was the default since the beginning
-	logLevel := logutils.LogLevel("TRACE")
+	logOutput = &logutils.LevelFilter{
+		Levels:   validLevels,
+		MinLevel: logutils.LogLevel(logLevel),
+		Writer:   logOutput,
+	}
 
+	return
+}
+
+// LogLevel returns the current log level string based the environment vars
+func LogLevel() string {
+	envLevel := os.Getenv(EnvLog)
+	if envLevel == "" {
+		return ""
+	}
+
+	logLevel := "TRACE"
 	if isValidLogLevel(envLevel) {
 		// allow following for better ux: info, Info or INFO
-		logLevel = logutils.LogLevel(strings.ToUpper(envLevel))
+		logLevel = strings.ToUpper(envLevel)
 	} else {
 		log.Printf("[WARN] Invalid log level: %q. Defaulting to level: TRACE. Valid levels are: %+v",
 			envLevel, validLevels)
 	}
 
-	logOutput = &logutils.LevelFilter{
-		Levels:   validLevels,
-		MinLevel: logLevel,
-		Writer:   logOutput,
-	}
+	return logLevel
+}
 
-	return
+// IsDebugOrHigher returns whether or not the current log level is debug or trace
+func IsDebugOrHigher() bool {
+	level := string(LogLevel())
+	return level == "DEBUG" || level == "TRACE"
 }
 
 func isValidLogLevel(level string) bool {