diff --git a/terraform/eval_validate.go b/terraform/eval_validate.go
index 9331143c5..6b809a281 100644
--- a/terraform/eval_validate.go
+++ b/terraform/eval_validate.go
@@ -112,11 +112,12 @@ func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
 // the configuration of a provisioner belonging to a resource. The provisioner
 // config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-	ResourceAddr     addrs.Resource
-	Provisioner      *provisioners.Interface
-	Schema           **configschema.Block
-	Config           *configs.Provisioner
-	ResourceHasCount bool
+	ResourceAddr       addrs.Resource
+	Provisioner        *provisioners.Interface
+	Schema             **configschema.Block
+	Config             *configs.Provisioner
+	ResourceHasCount   bool
+	ResourceHasForEach bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -198,6 +199,19 @@ func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body,
 		// expected type since none of these elements are known at this
 		// point anyway.
 		selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
+	} else if n.ResourceHasForEach {
+		// For a resource that has for_each, we allow each.value and each.key
+		// but don't know at this stage what it will return.
+		keyData = InstanceKeyEvalData{
+			EachKey:   cty.UnknownVal(cty.String),
+			EachValue: cty.DynamicVal,
+		}
+
+		// "self" can't point to an unknown key, but we'll force it to be
+		// key "" here, which should return an unknown value of the
+		// expected type since none of these elements are known at
+		// this point anyway.
+		selfAddr = n.ResourceAddr.Instance(addrs.StringKey(""))
 	}
 
 	return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
diff --git a/terraform/node_resource_validate.go b/terraform/node_resource_validate.go
index 734ec9e2b..efa657bf0 100644
--- a/terraform/node_resource_validate.go
+++ b/terraform/node_resource_validate.go
@@ -54,6 +54,7 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
 
 	if managed := n.Config.Managed; managed != nil {
 		hasCount := n.Config.Count != nil
+		hasForEach := n.Config.ForEach != nil
 
 		// Validate all the provisioners
 		for _, p := range managed.Provisioners {
@@ -74,11 +75,12 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
 					Schema: &provisionerSchema,
 				},
 				&EvalValidateProvisioner{
-					ResourceAddr:     addr.Resource,
-					Provisioner:      &provisioner,
-					Schema:           &provisionerSchema,
-					Config:           p,
-					ResourceHasCount: hasCount,
+					ResourceAddr:       addr.Resource,
+					Provisioner:        &provisioner,
+					Schema:             &provisionerSchema,
+					Config:             p,
+					ResourceHasCount:   hasCount,
+					ResourceHasForEach: hasForEach,
 				},
 			)
 		}