diff --git a/config/config_test.go b/config/config_test.go
index 8e93cd43d..1c7463b4d 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -29,6 +29,18 @@ func TestConfigResourceGraph(t *testing.T) {
 	}
 }
 
+func TestConfigResourceGraph_cycle(t *testing.T) {
+	c, err := Load(filepath.Join(fixtureDir, "resource_graph_cycle.tf"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	graph := c.ResourceGraph()
+	if err := graph.Validate(); err == nil {
+		t.Fatal("graph should be invalid")
+	}
+}
+
 func TestNewResourceVariable(t *testing.T) {
 	v, err := NewResourceVariable("foo.bar.baz")
 	if err != nil {
diff --git a/config/test-fixtures/resource_graph_cycle.tf b/config/test-fixtures/resource_graph_cycle.tf
new file mode 100644
index 000000000..135a35af8
--- /dev/null
+++ b/config/test-fixtures/resource_graph_cycle.tf
@@ -0,0 +1,18 @@
+variable "foo" {
+    default = "bar";
+    description = "bar";
+}
+
+provider "aws" {
+    foo = "${aws_security_group.firewall.value}"
+}
+
+resource "aws_security_group" "firewall" {}
+
+resource "aws_instance" "web" {
+    ami = "${var.foo}"
+    security_groups = [
+        "foo",
+        "${aws_security_group.firewall.foo}"
+    ]
+}