From 5b0b1a13a5464da4d53db80c6ddcecd624dbff96 Mon Sep 17 00:00:00 2001
From: Pam Selle <204372+pselle@users.noreply.github.com>
Date: Fri, 4 Sep 2020 12:59:54 -0400
Subject: [PATCH] Update object compatible check to unmark

The hack approach appears consistent,
as we can remove marks before calling the
value validation
---
 plans/objchange/compatible.go | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/plans/objchange/compatible.go b/plans/objchange/compatible.go
index 80987bbcf8..181a044f61 100644
--- a/plans/objchange/compatible.go
+++ b/plans/objchange/compatible.go
@@ -51,11 +51,17 @@ func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Valu
 		actualV := actual.GetAttr(name)
 
 		path := append(path, cty.GetAttrStep{Name: name})
-
-		// HACK Unmark the values here so we can get past this testing in Apply
-		unmarked, _ := plannedV.UnmarkDeep()
-		unmarkedActual, _ := actualV.UnmarkDeep()
-		moreErrs := assertValueCompatible(unmarked, unmarkedActual, path)
+		// If our value is marked, unmark it here before
+		// checking value assertions
+		unmarkedActualV := actualV
+		if actualV.ContainsMarked() {
+			unmarkedActualV, _ = actualV.UnmarkDeep()
+		}
+		unmarkedPlannedV := plannedV
+		if plannedV.ContainsMarked() {
+			unmarkedPlannedV, _ = actualV.UnmarkDeep()
+		}
+		moreErrs := assertValueCompatible(unmarkedPlannedV, unmarkedActualV, path)
 		if attrS.Sensitive {
 			if len(moreErrs) > 0 {
 				// Use a vague placeholder message instead, to avoid disclosing