diff --git a/command/build_test.go b/command/build_test.go
index ef751003085..25683868b8c 100644
--- a/command/build_test.go
+++ b/command/build_test.go
@@ -465,6 +465,20 @@ func TestBuild(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "hcl - unknown ",
+			args: []string{
+				testFixture("hcl", "data-source-validation.pkr.hcl"),
+			},
+			fileCheck: fileCheck{
+				expectedContent: map[string]string{
+					"foo.txt": "foo",
+				},
+				expected: []string{
+					"s3cr3t",
+				},
+			},
+		},
 	}
 
 	for _, tt := range tc {
diff --git a/command/test-fixtures/hcl/data-source-validation.pkr.hcl b/command/test-fixtures/hcl/data-source-validation.pkr.hcl
new file mode 100644
index 00000000000..3a0d5a7a1f1
--- /dev/null
+++ b/command/test-fixtures/hcl/data-source-validation.pkr.hcl
@@ -0,0 +1,39 @@
+
+data "null" "secret" {
+  input = "s3cr3t"
+}
+
+locals {
+  secret = data.null.secret.output
+}
+
+source "file" "foo" {
+  content = "foo"
+  target = "foo.txt"
+}
+
+build {
+  sources = ["file.foo"]
+  provisioner "shell-local" {
+    only_on = ["darwin", "freebsd", "linux", "openbsd", "solaris"]
+    # original bug in :
+    # environment_vars = ["MY_SECRET=${local.secret}"]
+    env = {
+      "MY_SECRET":"${local.secret}",
+    }
+    inline           = [
+      "echo yo, my secret is $MY_SECRET",
+      "echo '' > $MY_SECRET",
+    ]
+  }
+  provisioner "shell-local" {
+    only_on = ["windows"]
+    env = {
+      "MY_SECRET":"${local.secret}",
+    }
+    inline           = [
+      "echo yo, my secret is %MY_SECRET%",
+      "echo '' > %MY_SECRET%",
+    ]
+  }
+}
diff --git a/command/test_utils.go b/command/test_utils.go
index 1ad3cc8f34d..ab901bef971 100644
--- a/command/test_utils.go
+++ b/command/test_utils.go
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/packer/builder/null"
 	hcppackerimagedatasource "github.com/hashicorp/packer/datasource/hcp-packer-image"
 	hcppackeriterationdatasource "github.com/hashicorp/packer/datasource/hcp-packer-iteration"
+	nulldatasource "github.com/hashicorp/packer/datasource/null"
 	"github.com/hashicorp/packer/packer"
 	"github.com/hashicorp/packer/post-processor/manifest"
 	shell_local_pp "github.com/hashicorp/packer/post-processor/shell-local"
@@ -51,6 +52,7 @@ func testCoreConfigBuilder(t *testing.T) *packer.CoreConfig {
 			},
 			DataSources: packer.MapOfDatasource{
 				"mock":                 func() (packersdk.Datasource, error) { return &packersdk.MockDatasource{}, nil },
+				"null":                 func() (packersdk.Datasource, error) { return &nulldatasource.Datasource{}, nil },
 				"hcp-packer-image":     func() (packersdk.Datasource, error) { return &hcppackerimagedatasource.Datasource{}, nil },
 				"hcp-packer-iteration": func() (packersdk.Datasource, error) { return &hcppackeriterationdatasource.Datasource{}, nil },
 			},
diff --git a/command/validate_test.go b/command/validate_test.go
index 52e4ef5ea93..051b9c3eecb 100644
--- a/command/validate_test.go
+++ b/command/validate_test.go
@@ -36,6 +36,9 @@ func TestValidateCommand(t *testing.T) {
 
 		// Should return multiple errors,
 		{path: filepath.Join(testFixture("validate", "circular_error.pkr.hcl")), exitCode: 1},
+
+		// datasource could be unknown at that moment
+		{path: filepath.Join(testFixture("hcl", "data-source-validation.pkr.hcl")), exitCode: 0},
 	}
 
 	for _, tc := range tt {
diff --git a/go.mod b/go.mod
index dd5c42d349c..26cb44a6ef6 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.11.1
 	github.com/hashicorp/hcp-sdk-go v0.15.1-0.20220112153249-f565607d7cc4
 	github.com/hashicorp/packer-plugin-amazon v1.0.6
-	github.com/hashicorp/packer-plugin-sdk v0.2.11
+	github.com/hashicorp/packer-plugin-sdk v0.2.12-0.20220216103740-f7d4bf877a45
 	github.com/jehiah/go-strftime v0.0.0-20171201141054-1d33003b3869
 	github.com/klauspost/compress v1.13.5 // indirect
 	github.com/klauspost/pgzip v1.2.5
diff --git a/go.sum b/go.sum
index a251796fec4..f2fd2dabff5 100644
--- a/go.sum
+++ b/go.sum
@@ -766,8 +766,9 @@ github.com/hashicorp/packer-plugin-sdk v0.2.3/go.mod h1:MAOhxLneNh27t6N6SMyRcIR5
 github.com/hashicorp/packer-plugin-sdk v0.2.5/go.mod h1:ii9ub5UNAp30RGod3i3W8qj7wA+H7kpURnD+Jt7oDkQ=
 github.com/hashicorp/packer-plugin-sdk v0.2.7/go.mod h1:ii9ub5UNAp30RGod3i3W8qj7wA+H7kpURnD+Jt7oDkQ=
 github.com/hashicorp/packer-plugin-sdk v0.2.9/go.mod h1:ii9ub5UNAp30RGod3i3W8qj7wA+H7kpURnD+Jt7oDkQ=
-github.com/hashicorp/packer-plugin-sdk v0.2.11 h1:FsL2oOfLJmXC9F6W9eMFe0eUi3+ggFuqkLGX41fyPE0=
 github.com/hashicorp/packer-plugin-sdk v0.2.11/go.mod h1:DI8REf9TEIcVkYPErI/nedo6zS2h81ze7sKuc/mIlTE=
+github.com/hashicorp/packer-plugin-sdk v0.2.12-0.20220216103740-f7d4bf877a45 h1:NOEkBi0iohcGGVFjM8QBlZS69AbrXCuv5Vx+41CG34A=
+github.com/hashicorp/packer-plugin-sdk v0.2.12-0.20220216103740-f7d4bf877a45/go.mod h1:DI8REf9TEIcVkYPErI/nedo6zS2h81ze7sKuc/mIlTE=
 github.com/hashicorp/packer-plugin-tencentcloud v1.0.3 h1:8U2vMFyIE+pizoMDsSLyMBsbNdB1HzRAIaTJNIELyi4=
 github.com/hashicorp/packer-plugin-tencentcloud v1.0.3/go.mod h1:TCSlq9lCFU8H8eMMWNtwdnCeyHmaQ1A13PR11EJoJh0=
 github.com/hashicorp/packer-plugin-triton v1.0.0 h1:Uvh8fjEKqlii61BzIt1VEgSyJXL+UYfuMHCj44aVpU8=
diff --git a/provisioner/powershell/provisioner.hcl2spec.go b/provisioner/powershell/provisioner.hcl2spec.go
index ce4a84c3354..cbeb427ce74 100644
--- a/provisioner/powershell/provisioner.hcl2spec.go
+++ b/provisioner/powershell/provisioner.hcl2spec.go
@@ -23,6 +23,7 @@ type FlatConfig struct {
 	Scripts                []string          `cty:"scripts" hcl:"scripts"`
 	ValidExitCodes         []int             `mapstructure:"valid_exit_codes" cty:"valid_exit_codes" hcl:"valid_exit_codes"`
 	Vars                   []string          `mapstructure:"environment_vars" cty:"environment_vars" hcl:"environment_vars"`
+	Env                    map[string]string `mapstructure:"env" cty:"env" hcl:"env"`
 	EnvVarFormat           *string           `mapstructure:"env_var_format" cty:"env_var_format" hcl:"env_var_format"`
 	Binary                 *bool             `cty:"binary" hcl:"binary"`
 	RemotePath             *string           `mapstructure:"remote_path" cty:"remote_path" hcl:"remote_path"`
@@ -63,6 +64,7 @@ func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
 		"scripts":                    &hcldec.AttrSpec{Name: "scripts", Type: cty.List(cty.String), Required: false},
 		"valid_exit_codes":           &hcldec.AttrSpec{Name: "valid_exit_codes", Type: cty.List(cty.Number), Required: false},
 		"environment_vars":           &hcldec.AttrSpec{Name: "environment_vars", Type: cty.List(cty.String), Required: false},
+		"env":                        &hcldec.AttrSpec{Name: "env", Type: cty.Map(cty.String), Required: false},
 		"env_var_format":             &hcldec.AttrSpec{Name: "env_var_format", Type: cty.String, Required: false},
 		"binary":                     &hcldec.AttrSpec{Name: "binary", Type: cty.Bool, Required: false},
 		"remote_path":                &hcldec.AttrSpec{Name: "remote_path", Type: cty.String, Required: false},
diff --git a/provisioner/shell/provisioner.hcl2spec.go b/provisioner/shell/provisioner.hcl2spec.go
index d287215b44c..4ea77be55fa 100644
--- a/provisioner/shell/provisioner.hcl2spec.go
+++ b/provisioner/shell/provisioner.hcl2spec.go
@@ -23,6 +23,7 @@ type FlatConfig struct {
 	Scripts             []string          `cty:"scripts" hcl:"scripts"`
 	ValidExitCodes      []int             `mapstructure:"valid_exit_codes" cty:"valid_exit_codes" hcl:"valid_exit_codes"`
 	Vars                []string          `mapstructure:"environment_vars" cty:"environment_vars" hcl:"environment_vars"`
+	Env                 map[string]string `mapstructure:"env" cty:"env" hcl:"env"`
 	EnvVarFormat        *string           `mapstructure:"env_var_format" cty:"env_var_format" hcl:"env_var_format"`
 	Binary              *bool             `cty:"binary" hcl:"binary"`
 	RemotePath          *string           `mapstructure:"remote_path" cty:"remote_path" hcl:"remote_path"`
@@ -62,6 +63,7 @@ func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
 		"scripts":                    &hcldec.AttrSpec{Name: "scripts", Type: cty.List(cty.String), Required: false},
 		"valid_exit_codes":           &hcldec.AttrSpec{Name: "valid_exit_codes", Type: cty.List(cty.Number), Required: false},
 		"environment_vars":           &hcldec.AttrSpec{Name: "environment_vars", Type: cty.List(cty.String), Required: false},
+		"env":                        &hcldec.AttrSpec{Name: "env", Type: cty.Map(cty.String), Required: false},
 		"env_var_format":             &hcldec.AttrSpec{Name: "env_var_format", Type: cty.String, Required: false},
 		"binary":                     &hcldec.AttrSpec{Name: "binary", Type: cty.Bool, Required: false},
 		"remote_path":                &hcldec.AttrSpec{Name: "remote_path", Type: cty.String, Required: false},
diff --git a/provisioner/windows-shell/provisioner.hcl2spec.go b/provisioner/windows-shell/provisioner.hcl2spec.go
index abcbcee217f..34e7e1921b5 100644
--- a/provisioner/windows-shell/provisioner.hcl2spec.go
+++ b/provisioner/windows-shell/provisioner.hcl2spec.go
@@ -23,6 +23,7 @@ type FlatConfig struct {
 	Scripts             []string          `cty:"scripts" hcl:"scripts"`
 	ValidExitCodes      []int             `mapstructure:"valid_exit_codes" cty:"valid_exit_codes" hcl:"valid_exit_codes"`
 	Vars                []string          `mapstructure:"environment_vars" cty:"environment_vars" hcl:"environment_vars"`
+	Env                 map[string]string `mapstructure:"env" cty:"env" hcl:"env"`
 	EnvVarFormat        *string           `mapstructure:"env_var_format" cty:"env_var_format" hcl:"env_var_format"`
 	Binary              *bool             `cty:"binary" hcl:"binary"`
 	RemotePath          *string           `mapstructure:"remote_path" cty:"remote_path" hcl:"remote_path"`
@@ -55,6 +56,7 @@ func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
 		"scripts":                    &hcldec.AttrSpec{Name: "scripts", Type: cty.List(cty.String), Required: false},
 		"valid_exit_codes":           &hcldec.AttrSpec{Name: "valid_exit_codes", Type: cty.List(cty.Number), Required: false},
 		"environment_vars":           &hcldec.AttrSpec{Name: "environment_vars", Type: cty.List(cty.String), Required: false},
+		"env":                        &hcldec.AttrSpec{Name: "env", Type: cty.Map(cty.String), Required: false},
 		"env_var_format":             &hcldec.AttrSpec{Name: "env_var_format", Type: cty.String, Required: false},
 		"binary":                     &hcldec.AttrSpec{Name: "binary", Type: cty.Bool, Required: false},
 		"remote_path":                &hcldec.AttrSpec{Name: "remote_path", Type: cty.String, Required: false},
diff --git a/website/content/docs/post-processors/shell-local.mdx b/website/content/docs/post-processors/shell-local.mdx
index f2fe6fbb78f..0d4d77d31b2 100644
--- a/website/content/docs/post-processors/shell-local.mdx
+++ b/website/content/docs/post-processors/shell-local.mdx
@@ -94,6 +94,11 @@ Exactly _one_ of the following is required:
 
 Optional parameters:
 
+- `env` (map of strings) - A map of key/value pairs to inject prior to the
+  execute_command. Packer injects some environmental variables by default into
+  the environment, as well, which are covered in the section below. Duplciate
+  `env` settings override `environment_vars` settings.
+
 - `environment_vars` (array of strings) - An array of key/value pairs to
   inject prior to the `execute_command`. The format should be `key=value`.
   Packer injects some environmental variables by default into the
diff --git a/website/content/docs/provisioners/powershell.mdx b/website/content/docs/provisioners/powershell.mdx
index df2423ce8a6..f0402121b9b 100644
--- a/website/content/docs/provisioners/powershell.mdx
+++ b/website/content/docs/provisioners/powershell.mdx
@@ -17,8 +17,8 @@ The PowerShell Packer provisioner runs PowerShell scripts on Windows machines.
 It assumes that the communicator in use is WinRM. However, the provisioner can
 work equally well (with a few caveats) when combined with the SSH communicator.
 See the [section
-below](/docs/provisioners/powershell#combining-the-powershell-provisioner-with-the-ssh-communicator)
-for details.
+below](#combining-the-powershell-provisioner-with-the-ssh-communicator) for
+details.
 
 `@include 'path/separator-note.mdx'`
 
@@ -75,6 +75,12 @@ provisioner "powershell" {
   - `Vars`: The location of a temp file containing the list of
     `environment_vars`, if configured.
 
+- `env` (map of strings) - A map of key/value pairs to inject prior to the
+  execute_command. Packer injects some environmental variables by default into
+  the environment, as well, which are covered in the section below. Duplciate
+  `env` settings override `environment_vars` settings. This is not a JSON
+  template engine enabled function. HCL interpolation works as usual.
+
 - `environment_vars` (array of strings) - An array of key/value pairs to
   inject prior to the execute_command. The format should be `key=value`.
   Packer injects some environmental variables by default into the
diff --git a/website/content/docs/provisioners/shell-local.mdx b/website/content/docs/provisioners/shell-local.mdx
index 088351e5244..7aa172de311 100644
--- a/website/content/docs/provisioners/shell-local.mdx
+++ b/website/content/docs/provisioners/shell-local.mdx
@@ -103,6 +103,11 @@ Exactly _one_ of the following is required:
 
 Optional parameters:
 
+- `env` (map of strings) - A map of key/value pairs to inject prior to the
+  execute_command. Packer injects some environmental variables by default into
+  the environment, as well, which are covered in the section below. Duplciate
+  `env` settings override `environment_vars` settings.
+
 - `environment_vars` (array of strings) - An array of key/value pairs to
   inject prior to the `execute_command`. The format should be `key=value`.
   Packer injects some environmental variables by default into the
diff --git a/website/content/docs/provisioners/shell.mdx b/website/content/docs/provisioners/shell.mdx
index c94eda2cad7..d00081f0057 100644
--- a/website/content/docs/provisioners/shell.mdx
+++ b/website/content/docs/provisioners/shell.mdx
@@ -52,6 +52,11 @@ provisioner "shell" {
 
 @include 'provisioners/shell-config.mdx'
 
+- `env` (map of strings) - A map of key/value pairs to inject prior to the
+  execute_command. Packer injects some environmental variables by default into
+  the environment, as well, which are covered in the section below. Duplciate
+  `env` settings override `environment_vars` settings.
+
 - `environment_vars` (array of strings) - An array of key/value pairs to
   inject prior to the execute_command. The format should be `key=value`.
   Packer injects some environmental variables by default into the
diff --git a/website/content/docs/provisioners/windows-shell.mdx b/website/content/docs/provisioners/windows-shell.mdx
index e38c47e3428..f2b5d3adb3a 100644
--- a/website/content/docs/provisioners/windows-shell.mdx
+++ b/website/content/docs/provisioners/windows-shell.mdx
@@ -46,6 +46,11 @@ provisioner "windows-shell" {
 
 @include 'provisioners/shell-config.mdx'
 
+- `env` (map of strings) - A map of key/value pairs to inject prior to the
+  execute_command. Packer injects some environmental variables by default into
+  the environment, as well, which are covered in the section below. Duplciate
+  `env` settings override `environment_vars` settings.
+
 - `environment_vars` (array of strings) - An array of key/value pairs to
   inject prior to the execute_command. The format should be `key=value`.
   Packer injects some environmental variables by default into the