{"record":{"id":"0ddd28e294426e51","repo":"hashicorp/terraform","slug":"must-be-eight-hexadecimal-digits","errorCode":null,"errorMessage":"must be eight hexadecimal digits","messagePattern":"must be eight hexadecimal digits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/addrs/resource.go","lineNumber":620,"sourceCode":"// key.\nconst NotDeposed = DeposedKey(\"\")\n\nvar deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))\n\n// NewDeposedKey generates a pseudo-random deposed key. Because of the short\n// length of these keys, uniqueness is not a natural consequence and so the\n// caller should test to see if the generated key is already in use and generate\n// another if so, until a unique key is found.\nfunc NewDeposedKey() DeposedKey {\n\tv := deposedKeyRand.Uint32()\n\treturn DeposedKey(fmt.Sprintf(\"%08x\", v))\n}\n\n// ParseDeposedKey parses a string that is expected to be a deposed key,\n// returning an error if it doesn't conform to the expected syntax.\nfunc ParseDeposedKey(raw string) (DeposedKey, error) {\n\tif len(raw) != 8 {\n\t\treturn \"00000000\", fmt.Errorf(\"must be eight hexadecimal digits\")\n\t}\n\tif raw != strings.ToLower(raw) {\n\t\treturn \"00000000\", fmt.Errorf(\"must use lowercase hex digits\")\n\t}\n\t_, err := hex.DecodeString(raw)\n\tif err != nil {\n\t\treturn \"00000000\", fmt.Errorf(\"must be eight hexadecimal digits\")\n\t}\n\treturn DeposedKey(raw), nil\n}\n\nfunc (k DeposedKey) String() string {\n\treturn string(k)\n}\n\nfunc (k DeposedKey) GoString() string {\n\tks := string(k)\n\tswitch {","sourceCodeStart":602,"sourceCodeEnd":638,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/addrs/resource.go#L602-L638","documentation":"Returned by ParseDeposedKey when the raw string's length is not exactly 8. A DeposedKey must be exactly eight lowercase hex characters (NewDeposedKey formats a uint32 as %08x). This first length check catches anything that isn't 8 chars before format validation.","triggerScenarios":"Returned at internal/addrs/resource.go:620 when len(raw) != 8. ParseDeposedKey is called from stackplan/from_proto.go:458/495 (parsing deposed keys out of stack plan protos) and stackstate/statekeys/resources.go:38, plus the states.ParseDeposedKey alias.","commonSituations":"A stack plan/state proto carries a deposed key that is empty, truncated, or a full SHA-style string. State migration or hand-editing produced an invalid key. External tooling generated a deposed key without the %08x formatting. Corrupted or partial state import.","solutions":["Regenerate the deposed key with addrs.NewDeposedKey() (which always yields 8 lowercase hex chars) rather than constructing strings manually.","If the value comes from a proto/external source, validate len==8 before passing to ParseDeposedKey.","Inspect the offending state/plan to find which resource instance has the bad deposed key and repair it (e.g. `terraform state` operations or re-running the plan).","Round-trip state through a supported Terraform version to normalize keys."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(raw) != 8 {\n    return fmt.Errorf(\"deposed key must be 8 chars, got %d\", len(raw))\n}","typeGuard":"func isDeposedKeyParseError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"eight hexadecimal digits\") && strings.Contains(err.Error(), \"must be\")\n}","tryCatchPattern":"k, err := addrs.ParseDeposedKey(raw)\nif err != nil {\n    // regenerate a valid key rather than propagate bad input\n    k = addrs.NewDeposedKey()\n}","preventionTips":["Always generate deposed keys with NewDeposedKey().","Validate len==8 before parsing external input.","Normalize state through supported versions."],"tags":["deposed-key","state","validation","parsing"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}