diff --git a/config/config.go b/config/config.go
index 99295ab8f..8dd9810eb 100644
--- a/config/config.go
+++ b/config/config.go
@@ -477,6 +477,22 @@ func (c *Config) Validate() error {
 		}
 	}
 
+	// Validate the self variable
+	for source, rc := range c.rawConfigs() {
+		// Ignore provisioners. This is a pretty brittle way to do this,
+		// but better than also repeating all the resources.
+		if strings.Contains(source, "provision") {
+			continue
+		}
+
+		for _, v := range rc.Variables {
+			if _, ok := v.(*SelfVariable); ok {
+				errs = append(errs, fmt.Errorf(
+					"%s: cannot contain self-reference %s", source, v.FullKey()))
+			}
+		}
+	}
+
 	if len(errs) > 0 {
 		return &multierror.Error{Errors: errs}
 	}
diff --git a/config/config_test.go b/config/config_test.go
index 821539ccf..0503d2e66 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -214,6 +214,20 @@ func TestConfigValidate_provSplatSelf(t *testing.T) {
 	}
 }
 
+func TestConfigValidate_resourceProvVarSelf(t *testing.T) {
+	c := testConfig(t, "validate-resource-prov-self")
+	if err := c.Validate(); err != nil {
+		t.Fatalf("should be valid: %s", err)
+	}
+}
+
+func TestConfigValidate_resourceVarSelf(t *testing.T) {
+	c := testConfig(t, "validate-resource-self")
+	if err := c.Validate(); err == nil {
+		t.Fatal("should not be valid")
+	}
+}
+
 func TestConfigValidate_unknownThing(t *testing.T) {
 	c := testConfig(t, "validate-unknownthing")
 	if err := c.Validate(); err == nil {
diff --git a/config/test-fixtures/validate-resource-prov-self/main.tf b/config/test-fixtures/validate-resource-prov-self/main.tf
new file mode 100644
index 000000000..4a55ac24e
--- /dev/null
+++ b/config/test-fixtures/validate-resource-prov-self/main.tf
@@ -0,0 +1,11 @@
+resource "aws_instance" "foo" {
+    foo = "bar"
+
+    connection {
+        host = "${self.foo}"
+    }
+
+    provisioner "shell" {
+        value = "${self.foo}"
+    }
+}
diff --git a/config/test-fixtures/validate-resource-self/main.tf b/config/test-fixtures/validate-resource-self/main.tf
new file mode 100644
index 000000000..20049d55b
--- /dev/null
+++ b/config/test-fixtures/validate-resource-self/main.tf
@@ -0,0 +1,3 @@
+resource "aws_instance" "foo" {
+    foo = "${self.bar}"
+}