diff --git a/config/config.go b/config/config.go
index 4e785b37cd..e9f1535eba 100644
--- a/config/config.go
+++ b/config/config.go
@@ -17,6 +17,10 @@ type Config struct {
 	Resources       []*Resource
 	Variables       map[string]*Variable
 	Outputs         map[string]*Output
+
+	// The fields below can be filled in by loaders for validation
+	// purposes.
+	unknownKeys []string
 }
 
 // ProviderConfig is the configuration for a resource provider.
@@ -114,6 +118,11 @@ func (r *Resource) Id() string {
 func (c *Config) Validate() error {
 	var errs []error
 
+	for _, k := range c.unknownKeys {
+		errs = append(errs, fmt.Errorf(
+			"Unknown root level key: %s", k))
+	}
+
 	vars := c.allVariables()
 
 	// Check for references to user variables that do not actually
diff --git a/config/config_test.go b/config/config_test.go
index c64eecde56..f9f5394064 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -29,6 +29,13 @@ func TestConfigValidate_outputBadField(t *testing.T) {
 	}
 }
 
+func TestConfigValidate_unknownThing(t *testing.T) {
+	c := testConfig(t, "validate-unknownthing")
+	if err := c.Validate(); err == nil {
+		t.Fatal("should not be valid")
+	}
+}
+
 func TestConfigValidate_unknownResourceVar(t *testing.T) {
 	c := testConfig(t, "validate-unknown-resource-var")
 	if err := c.Validate(); err == nil {
diff --git a/config/loader_libucl.go b/config/loader_libucl.go
index 78baaf164a..246a1cf67f 100644
--- a/config/loader_libucl.go
+++ b/config/loader_libucl.go
@@ -22,6 +22,13 @@ func (t *libuclConfigurable) Close() error {
 }
 
 func (t *libuclConfigurable) Config() (*Config, error) {
+	validKeys := map[string]struct{}{
+		"output":   struct{}{},
+		"provider": struct{}{},
+		"resource": struct{}{},
+		"variable": struct{}{},
+	}
+
 	type LibuclVariable struct {
 		Default     string
 		Description string
@@ -88,6 +95,20 @@ func (t *libuclConfigurable) Config() (*Config, error) {
 		}
 	}
 
+	// Check for invalid keys
+	iter := t.Object.Iterate(true)
+	defer iter.Close()
+	for o := iter.Next(); o != nil; o = iter.Next() {
+		k := o.Key()
+		o.Close()
+
+		if _, ok := validKeys[k]; ok {
+			continue
+		}
+
+		config.unknownKeys = append(config.unknownKeys, k)
+	}
+
 	return config, nil
 }
 
diff --git a/config/test-fixtures/validate-unknownthing/main.tf b/config/test-fixtures/validate-unknownthing/main.tf
new file mode 100644
index 0000000000..fcfdf72743
--- /dev/null
+++ b/config/test-fixtures/validate-unknownthing/main.tf
@@ -0,0 +1 @@
+what "is this"