{"record":{"id":"0ddd28e294426e51","repo":"hashicorp/terraform","slug":"must-be-eight-hexadecimal-digits","errorCode":null,"errorMessage":"must be eight hexadecimal digits","messagePattern":"must be eight hexadecimal digits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/addrs/resource.go","lineNumber":620,"sourceCode":"// key.\nconst NotDeposed = DeposedKey(\"\")\n\nvar deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))\n\n// NewDeposedKey generates a pseudo-random deposed key. Because of the short\n// length of these keys, uniqueness is not a natural consequence and so the\n// caller should test to see if the generated key is already in use and generate\n// another if so, until a unique key is found.\nfunc NewDeposedKey() DeposedKey {\n\tv := deposedKeyRand.Uint32()\n\treturn DeposedKey(fmt.Sprintf(\"%08x\", v))\n}\n\n// ParseDeposedKey parses a string that is expected to be a deposed key,\n// returning an error if it doesn't conform to the expected syntax.\nfunc ParseDeposedKey(raw string) (DeposedKey, error) {\n\tif len(raw) != 8 {\n\t\treturn \"00000000\", fmt.Errorf(\"must be eight hexadecimal digits\")\n\t}\n\tif raw != strings.ToLower(raw) {\n\t\treturn \"00000000\", fmt.Errorf(\"must use lowercase hex digits\")\n\t}\n\t_, err := hex.DecodeString(raw)\n\tif err != nil {\n\t\treturn \"00000000\", fmt.Errorf(\"must be eight hexadecimal digits\")\n\t}\n\treturn DeposedKey(raw), nil\n}\n\nfunc (k DeposedKey) String() string {\n\treturn string(k)\n}\n\nfunc (k DeposedKey) GoString() string {\n\tks := string(k)\n\tswitch {","sourceCodeStart":602,"sourceCodeEnd":638,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/addrs/resource.go#L602-L638","documentation":"Returned by addrs.ParseDeposedKey when the raw string is not exactly 8 characters long, OR when it is 8 chars but hex.DecodeString rejects it (non-hex characters). A DeposedKey must be exactly eight lowercase hexadecimal digits (e.g. 'a1b2c3d4'). On failure the function returns the zero key \"00000000\".","triggerScenarios":"ParseDeposedKey at resource.go:619-621 (length != 8) or resource.go:625-627 (hex.DecodeString error). Reached when parsing a deposed key from CLI args, state, or serialized addresses.","commonSituations":"Manually typed deposed key of wrong length; truncated/extra characters from copy-paste; key passed with surrounding whitespace; non-hex characters (e.g. 'g' or 'z'); uppercase letters fall through to a different message (115).","solutions":["Supply exactly 8 lowercase hex digits (0-9, a-f).","Trim whitespace and strip any surrounding quotes/punctuation before parsing.","If you generated the key yourself, use NewDeposedKey() which always produces a valid key.","Validate with a regex like ^[0-9a-f]{8}$ before calling ParseDeposedKey."],"exampleFix":"// before\nk, err := addrs.ParseDeposedKey(strings.TrimSpace(input))\n\n// after\ninput = strings.TrimSpace(input)\nif !regexp.MustCompile(`^[0-9a-f]{8}$`).MatchString(input) {\n    return addrs.DeposedKey(\"\"), fmt.Errorf(\"invalid deposed key %q: need 8 lowercase hex digits\", input)\n}\nk, err := addrs.ParseDeposedKey(input)","handlingStrategy":"validation","validationCode":"raw := strings.TrimSpace(input)\nif !regexp.MustCompile(`^[0-9a-f]{8}$`).MatchString(raw) {\n    return fmt.Errorf(\"deposed key must be 8 lowercase hex digits\")\n}","typeGuard":"func isValidDeposedKey(s string) bool {\n    return regexp.MustCompile(`^[0-9a-f]{8}$`).MatchString(strings.TrimSpace(s))\n}","tryCatchPattern":"if !isValidDeposedKey(input) {\n    return fmt.Errorf(\"invalid deposed key %q\", input)\n}\nk, err := addrs.ParseDeposedKey(input)","preventionTips":["Prefer NewDeposedKey() over hand-typed keys.","Trim whitespace and validate with ^[0-9a-f]{8}$ before parsing.","Display deposed keys in lowercase to avoid round-trip issues."],"tags":["addrs","deposed-key","validation","terraform"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}