provider/aws: Fix ModifyInstanceAttribute on new instances

Previously `ModifyInstanceAttribute` permissions were required on creating a new instance with an unmodified `source_dest_check` attribute, as we forced the `ModifyInstanceAttribute` set on a new AWS instance.

This change only calls `ModifyInstanceAttribute` if `source_dest_check` was changed from default on a new instance, or if `source_dest_check` was modified.

```
$ make testacc TEST=./builtin/providers/aws TESTARGS="-run=TestAccAWSInstance_sourceDestCheck"
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/06/01 11:18:31 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSInstance_sourceDestCheck -timeout 120m
=== RUN   TestAccAWSInstance_sourceDestCheck
--- PASS: TestAccAWSInstance_sourceDestCheck (172.28s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    172.308s
```

builtin/providers/aws/resource_aws_instance.go

@@ -815,14 +815,19 @@ func resourceAwsInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 	// SourceDestCheck can only be modified on an instance without manually specified network interfaces.
 	// SourceDestCheck, in that case, is configured at the network interface level
 	if _, ok := d.GetOk("network_interface"); !ok {
-		if d.HasChange("source_dest_check") || d.IsNewResource() {
-			// SourceDestCheck can only be set on VPC instances	// AWS will return an error of InvalidParameterCombination if we attempt
+
+		// If we have a new resource and source_dest_check is still true, don't modify
+		sourceDestCheck := d.Get("source_dest_check").(bool)
+
+		if d.HasChange("source_dest_check") || d.IsNewResource() && !sourceDestCheck {
+			// SourceDestCheck can only be set on VPC instances
+			// AWS will return an error of InvalidParameterCombination if we attempt
 			// to modify the source_dest_check of an instance in EC2 Classic
 			log.Printf("[INFO] Modifying `source_dest_check` on Instance %s", d.Id())
 			_, err := conn.ModifyInstanceAttribute(&ec2.ModifyInstanceAttributeInput{
 				InstanceId: aws.String(d.Id()),
 				SourceDestCheck: &ec2.AttributeBooleanValue{
-					Value: aws.Bool(d.Get("source_dest_check").(bool)),
+					Value: aws.Bool(sourceDestCheck),
 				},
 			})
 			if err != nil {