diff --git a/builtin/providers/aws/resource_aws_instance.go b/builtin/providers/aws/resource_aws_instance.go
index 57446d349..173a032de 100644
--- a/builtin/providers/aws/resource_aws_instance.go
+++ b/builtin/providers/aws/resource_aws_instance.go
@@ -202,13 +202,18 @@ func resource_aws_instance_diff(
 
 		ComputedAttrs: []string{
 			"availability_zone",
+			"key_name",
 			"public_dns",
 			"public_ip",
 			"private_dns",
 			"private_ip",
+			"security_groups",
+			"subnet_id",
 		},
 	}
 
+	// TODO(mitchellh): figure out way to diff user_data_hash
+
 	return b.Diff(s, c)
 }
 
diff --git a/helper/diff/resource_builder.go b/helper/diff/resource_builder.go
index e365bd806..62575f689 100644
--- a/helper/diff/resource_builder.go
+++ b/helper/diff/resource_builder.go
@@ -120,6 +120,13 @@ func (b *ResourceBuilder) Diff(
 					comp = true
 					break
 				}
+
+				// If the key is prefixed with the computed key, don't
+				// mark it for delete, ever.
+				if strings.HasPrefix(k, ck+".") {
+					comp = true
+					break
+				}
 			}
 			if comp {
 				continue
diff --git a/helper/diff/resource_builder_test.go b/helper/diff/resource_builder_test.go
index b9e3b3509..d7e220a4f 100644
--- a/helper/diff/resource_builder_test.go
+++ b/helper/diff/resource_builder_test.go
@@ -37,6 +37,34 @@ func TestResourceBuilder_attrSetComputed(t *testing.T) {
 	}
 }
 
+func TestResourceBuilder_attrSetComputedComplex(t *testing.T) {
+	rb := &ResourceBuilder{
+		Attrs: map[string]AttrType{
+			"foo": AttrTypeCreate,
+		},
+		ComputedAttrs: []string{
+			"foo",
+		},
+	}
+
+	state := &terraform.ResourceState{
+		ID: "foo",
+		Attributes: map[string]string{
+			"foo.#": "0",
+		},
+	}
+
+	c := testConfig(t, map[string]interface{}{}, nil)
+
+	diff, err := rb.Diff(state, c)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if diff != nil {
+		t.Fatalf("diff shold be nil: %s", diff)
+	}
+}
+
 func TestResourceBuilder_replaceComputed(t *testing.T) {
 	rb := &ResourceBuilder{
 		Attrs: map[string]AttrType{