diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 57c0ffa..69b2e34 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,6 +59,8 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
+cd /tmp/kubeform/terraform/aws/public-cloud
+terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 
diff --git a/terraform/aws/elb/main.tf b/terraform/aws/elb/main.tf
index d0c3c52..a3a83b1 100644
--- a/terraform/aws/elb/main.tf
+++ b/terraform/aws/elb/main.tf
@@ -1,7 +1,7 @@
 variable "elb_name" { default = "kube-master" }
 variable "health_check_target" { default = "HTTP:8080/healthz" }
-variable "instances" {}
-variable "subnets" {}
+variable "instances" { type = "list" }
+variable "subnets" { type = "list" }
 variable "security_groups" {}
 
 resource "aws_elb" "kube_master" {
diff --git a/terraform/aws/iam/main.tf b/terraform/aws/iam/main.tf
index 64079a2..84a9fe3 100644
--- a/terraform/aws/iam/main.tf
+++ b/terraform/aws/iam/main.tf
@@ -2,13 +2,13 @@
 resource "aws_iam_role" "master_role" {
   name               = "master_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/master-role.json\")}"
+  assume_role_policy = "${file("${path.module}/master-role.json")}"
 }
 
 resource "aws_iam_role_policy" "master_policy" {
   name   = "master_policy"
   role   = "${aws_iam_role.master_role.id}"
-  policy = "${file(\"${path.module}/master-policy.json\")}"
+  policy = "${file("${path.module}/master-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "master_profile" {
@@ -20,13 +20,13 @@ resource "aws_iam_instance_profile" "master_profile" {
 resource "aws_iam_role" "worker_role" {
   name               = "worker_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/worker-role.json\")}"
+  assume_role_policy = "${file("${path.module}/worker-role.json")}"
 }
 
 resource "aws_iam_role_policy" "worker_policy" {
   name   = "worker_policy"
   role   = "${aws_iam_role.worker_role.id}"
-  policy = "${file(\"${path.module}/worker-policy.json\")}"
+  policy = "${file("${path.module}/worker-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "worker_profile" {
@@ -38,13 +38,13 @@ resource "aws_iam_instance_profile" "worker_profile" {
 resource "aws_iam_role" "edge-router_role" {
   name               = "edge-router_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/edge-router-role.json\")}"
+  assume_role_policy = "${file("${path.module}/edge-router-role.json")}"
 }
 
 resource "aws_iam_role_policy" "edge-router_policy" {
   name   = "edge-router_policy"
   role   = "${aws_iam_role.edge-router_role.id}"
-  policy = "${file(\"${path.module}/edge-router-policy.json\")}"
+  policy = "${file("${path.module}/edge-router-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "edge-router_profile" {
diff --git a/terraform/aws/private-cloud/bastion-server.tf b/terraform/aws/private-cloud/bastion-server.tf
index 8a30e94..d672fa8 100644
--- a/terraform/aws/private-cloud/bastion-server.tf
+++ b/terraform/aws/private-cloud/bastion-server.tf
@@ -11,9 +11,9 @@ module "bastion_ami" {
   virttype = "${module.bastion_amitype.prefer_hvm}"
 }
 
-resource "template_file" "bastion_cloud_init" {
+data "template_file" "bastion_cloud_init" {
   template   = "bastion-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -31,7 +31,7 @@ resource "aws_instance" "bastion" {
   security_groups   = ["${module.sg-default.security_group_id}", "${aws_security_group.bastion.id}"]
   key_name          = "${module.aws-keypair.keypair_name}"
   source_dest_check = false
-  user_data         = "${template_file.bastion_cloud_init.rendered}"
+  user_data         = "${data.template_file.bastion_cloud_init.rendered}"
   tags = {
     Name = "kube-bastion"
     role = "bastion"
diff --git a/terraform/aws/private-cloud/etcd_discovery_url.txt b/terraform/aws/private-cloud/etcd_discovery_url.txt
deleted file mode 100644
index 8b13789..0000000
--- a/terraform/aws/private-cloud/etcd_discovery_url.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index 26ff833..8678909 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -52,20 +52,20 @@ module "elb" {
   source = "../elb"
 
   security_groups = "${module.sg-default.security_group_id}"
-  instances       = "${join(\",\", aws_instance.worker.*.id)}"
+  instances       = "${join(",", aws_instance.worker.*.id)}"
   subnets         = "${module.vpc.public_subnets}"
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
-  template = "/dev/null"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes, we include the bastion here
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # This will regenerate the discovery URL if the cluster size changes
+    triggers {
+        size = "${var.masters}"
+    }
 }
 
 # outputs
diff --git a/terraform/aws/private-cloud/masters.tf b/terraform/aws/private-cloud/masters.tf
index 139e8d8..cffda24 100644
--- a/terraform/aws/private-cloud/masters.tf
+++ b/terraform/aws/private-cloud/masters.tf
@@ -10,9 +10,9 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "master-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -29,7 +29,7 @@ resource "aws_instance" "mmaster" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-master-${count.index}"
     role = "masters"
diff --git a/terraform/aws/private-cloud/workers.tf b/terraform/aws/private-cloud/workers.tf
index 10e0a2d..f3b135e 100644
--- a/terraform/aws/private-cloud/workers.tf
+++ b/terraform/aws/private-cloud/workers.tf
@@ -10,9 +10,9 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "worker-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -33,7 +33,7 @@ resource "aws_instance" "worker" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion", "aws_instance.master"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-worker-${count.index}"
     role = "workers"
diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index 3a539d6..46d8d19 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -10,16 +10,16 @@ module "edge-router_ami" {
   virttype = "${module.edge-router_amitype.prefer_hvm}"
 }
 
-resource "template_file" "edge-router_cloud_init" {
+data "template_file" "edge-router_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,11 +29,11 @@ resource "aws_instance" "edge-router" {
   iam_instance_profile = "${module.iam.edge-router_profile_name}"
   count                = "${var.edge-routers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.edge-router_cloud_init.rendered}"
+  user_data            = "${data.template_file.edge-router_cloud_init.rendered}"
   tags = {
     Name   = "kube-edge-router-${count.index}"
     role   = "edge-routers"
diff --git a/terraform/aws/public-cloud/etcd_discovery_url.txt b/terraform/aws/public-cloud/etcd_discovery_url.txt
index 6fe5f6a..e69de29 100644
--- a/terraform/aws/public-cloud/etcd_discovery_url.txt
+++ b/terraform/aws/public-cloud/etcd_discovery_url.txt
@@ -1 +0,0 @@
-https://discovery.etcd.io/5a6cb41d2a91517447cb738d7e2cf898
\ No newline at end of file
diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index fd37141..c4bf846 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -2,7 +2,17 @@ variable "access_key" {}
 variable "secret_key" {}
 variable "organization" { default = "kubeform" }
 variable "region" { default = "eu-west-1" }
-variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
+
+# length(availability_zones) must == length(vpc_public_cidrs_list)
+variable "availability_zones" {
+    type = "list"
+    default = [ "eu-west-1a", "eu-west-1b", "eu-west-1c" ]
+}
+variable "vpc_public_cidrs_list" {
+    type = "list"
+    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
+}
+
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
@@ -25,6 +35,9 @@ resource "aws_vpc" "default" {
   cidr_block           = "${var.vpc_cidr_block}"
   enable_dns_support   = true
   enable_dns_hostnames = true
+  tags {
+      Name = "${var.organization} VPC"
+  }
   lifecycle {
     create_before_destroy = true
   }
@@ -51,27 +64,27 @@ module "aws-keypair" {
 
 # certificates
 module "ca" {
-  source            = "github.com/Capgemini/tf_tls/ca"
+  source            = "github.com/tamsky/tf_tls/ca"
   organization      = "${var.organization}"
   ca_count          = "${var.masters + var.workers + var.edge-routers}"
-  deploy_ssh_hosts  = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  deploy_ssh_hosts  = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   ssh_user          = "core"
   ssh_private_key   = "${tls_private_key.ssh.private_key_pem}"
 }
 
 module "etcd_cert" {
-  source             = "github.com/Capgemini/tf_tls/etcd"
+  source             = "github.com/tamsky/tf_tls/etcd"
   ca_cert_pem        = "${module.ca.ca_cert_pem}"
   ca_private_key_pem = "${module.ca.ca_private_key_pem}"
 }
 
 module "kube_master_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/master"
+  source                = "github.com/tamsky/tf_tls/kubernetes/master"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}"
-  dns_names             = "${compact(module.master_elb.elb_dns_name)}"
-  deploy_ssh_hosts      = "${compact(aws_instance.master.*.public_ip)}"
+  ip_addresses          = [ "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}" ]
+  dns_names             = [ "${module.master_elb.elb_dns_name}" ]
+  deploy_ssh_hosts      = [ "${aws_instance.master.*.public_ip}" ]
   master_count          = "${var.masters}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -80,11 +93,11 @@ module "kube_master_certs" {
 }
 
 module "kube_kubelet_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/kubelet"
+  source                = "github.com/tamsky/tf_tls/kubernetes/kubelet"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses          = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   kubelet_count         = "${var.masters + var.workers + var.edge-routers}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -93,35 +106,35 @@ module "kube_kubelet_certs" {
 }
 
 module "kube_admin_cert" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/admin"
+  source                = "github.com/tamsky/tf_tls/kubernetes/admin"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
   kubectl_server_ip     = "${module.master_elb.elb_dns_name}"
 }
 
 module "docker_daemon_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/daemon"
+  source                = "github.com/tamsky/tf_tls/docker/daemon"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_daemon_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
 module "docker_client_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/client"
+  source                = "github.com/tamsky/tf_tls/docker/client"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_client_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
@@ -134,10 +147,10 @@ module "igw" {
 
 # public subnets
 module "public_subnet" {
-  source = "github.com/terraform-community-modules/tf_aws_public_subnet?ref=b7659c06cba6a545b83f569bc73560b266e6c9c1"
+  source = "github.com/terraform-community-modules/tf_aws_public_subnet"
   name   = "public"
-  cidrs  = "10.0.1.0/24,10.0.2.0/24,10.0.3.0/24"
-  azs    = "${var.availability_zones}"
+  cidrs  = [ "${var.vpc_public_cidrs_list}" ]
+  azs    = [ "${var.availability_zones}" ]
   vpc_id = "${aws_vpc.default.id}"
   igw_id = "${module.igw.igw_id}"
 }
@@ -154,13 +167,11 @@ module "iam" {
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
-  template = "${file("/dev/null")}"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # To change the cluster size of an existing live cluster, please read:
+    # https://coreos.com/etcd/docs/latest/etcd-live-cluster-reconfiguration.html
 }
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index 7f6668b..e2cb6f0 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -10,16 +10,16 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "${file("master-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,10 +29,10 @@ resource "aws_instance" "master" {
   iam_instance_profile = "${module.iam.master_profile_name}"
   count                = "${var.masters}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
-  user_data            = "${template_file.master_cloud_init.rendered}"
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
+  user_data            = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name   = "kube-master-${count.index}"
     role   = "masters"
@@ -60,8 +60,8 @@ resource "aws_instance" "master" {
 module "master_elb" {
   source             = "../elb"
   security_groups    = "${module.sg-default.security_group_id}"
-  instances          = "${compact(aws_instance.master.*.id)}"
-  subnets            = "${compact(split(",", module.public_subnet.subnet_ids))}"
+  instances          = [ "${aws_instance.master.*.id}" ]
+  subnets            = [ "${module.public_subnet.subnet_ids}" ]
 }
 
 output "master_ips" {
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 69eaeef..1cef81f 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -10,16 +10,16 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,11 +29,11 @@ resource "aws_instance" "worker" {
   iam_instance_profile = "${module.iam.worker_profile_name}"
   count                = "${var.workers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.worker_cloud_init.rendered}"
+  user_data            = "${data.template_file.worker_cloud_init.rendered}"
   tags = {
     Name   = "kube-worker-${count.index}"
     role   = "workers"