Ah! Thanks for spotting this bug!

It makes me wonder if all the providers that use IncrementalDiff will have the same problem.

(Fundamentally we need to rewrite this provider to not use the backwards compatibility mode. Using diff2 would make all that code much cleaner.)

I'd guess it depends on how the provider is handling the messages coming from IncrementalDiff. GCLOUD used to just copy all of the message strings from IncrementalDiff into a separate []string and print them all out as a single correction. I had actually implemented differ.ChangedGroups for the GCLOUD provider in a private fork of 2.x, which worked well, but then reverted to IncrementalDiff when I contributed #2482 in an effort to reduce the number of changes and because of the ongoing efforts with diff2 (ByRecordSet looked like it could be used for this provider, but based on the docs I'm unsure if the provider API conforms with the intent of that function). That's where this message display bug was originally introduced.
Thanks for the quick review!

@asn-iac Sounds fair!

By the way... would you be interested in taking a try at rewriting it with diff2? I'd be glad to collaborate on it. For example, if ByRecordSet is insufficient, I'd be glad to fix it or provide a new By function that matches the API.