{"record":{"id":"f21976b0db780e41","repo":"hashicorp/terraform","slug":"impersonate-service-account-delegates-elements-mus","errorCode":null,"errorMessage":"impersonate_service_account_delegates elements must not be null","messagePattern":"impersonate_service_account_delegates elements must not be null","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/gcs/backend.go","lineNumber":223,"sourceCode":"\t\t\t)\n\t\t}\n\n\t\tcredOptions = append(credOptions, option.WithCredentialsJSON([]byte(contents)))\n\t}\n\n\t// Service Account Impersonation\n\tif v := data.String(\"impersonate_service_account\"); v != \"\" {\n\t\tServiceAccount := v\n\t\tvar delegates []string\n\n\t\tdelegatesVal := data.GetAttr(\"impersonate_service_account_delegates\", cty.List(cty.String))\n\t\tif !delegatesVal.IsNull() && delegatesVal.LengthInt() != 0 {\n\t\t\tdelegates = make([]string, 0, delegatesVal.LengthInt())\n\t\t\tfor it := delegatesVal.ElementIterator(); it.Next(); {\n\t\t\t\t_, v := it.Element()\n\t\t\t\tif v.IsNull() {\n\t\t\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\t\t\tfmt.Errorf(\"impersonate_service_account_delegates elements must not be null\"),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t\tdelegates = append(delegates, v.AsString())\n\t\t\t}\n\t\t}\n\n\t\tts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: ServiceAccount,\n\t\t\tScopes:          []string{storage.ScopeReadWrite},\n\t\t\tDelegates:       delegates,\n\t\t}, credOptions...)\n\n\t\tif err != nil {\n\t\t\treturn backendbase.ErrorAsDiagnostics(err)\n\t\t}\n\n\t\topts = append(opts, option.WithTokenSource(ts))\n","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/gcs/backend.go#L205-L241","documentation":"This error is emitted by the GCS backend's Configure() while iterating over the 'impersonate_service_account_delegates' list. Terraform walks each element of that list and rejects any element that is a null cty.Value, because the impersonation API needs a concrete service-account email string for every hop in the delegation chain. A null element would later cause google.golang.org/api/impersonate to fail with a less helpful message, so the backend validates eagerly.","triggerScenarios":"Set 'impersonate_service_account' to a non-empty string AND 'impersonate_service_account_delegates' to a list containing a null element (e.g. [null], [\"projects/-/serviceAccounts/a@x.iam.gserviceaccount.com\", null]). Triggered during terraform init when the backend block is configured in this way.","commonSituations":"HCL authored with an unknown/variable placeholder that resolves to null (e.g. impersonate_service_account_delegates = [var.delegate] where var.delegate has no default), or a list literal typo, or generated config from tfvars that left a slot empty.","solutions":["Open the backend block and inspect every entry of impersonate_service_account_delegates; remove or replace any null element with a full service-account delegate email like 'projects/-/serviceAccounts/SA_NAME@PROJECT.iam.gserviceaccount.com'.","If the list is built from variables, give each variable a concrete non-null default or guard it with a coalesce() so the value is never null at plan/init time.","Run 'terraform init -backend=false' to confirm the config parses, then fix the offending element and re-run 'terraform init'."],"exampleFix":"// before\nimpersonate_service_account = \"deployer@proj.iam.gserviceaccount.com\"\nimpersonate_service_account_delegates = [var.delegate]   // var.delegate defaults to null\n\n// after\nvariable \"delegate\" { default = \"projects/-/serviceAccounts/originator@proj.iam.gserviceaccount.com\" }\nimpersonate_service_account = \"deployer@proj.iam.gserviceaccount.com\"\nimpersonate_service_account_delegates = [var.delegate]","handlingStrategy":"validation","validationCode":"// Validate before passing to the backend\nfunc validateDelegates(del cty.Value) error {\n    if del.IsNull() { return nil }\n    for it := del.ElementIterator(); it.Next(); {\n        _, v := it.Element()\n        if v.IsNull() {\n            return fmt.Errorf(\"impersonate_service_account_delegates contains a null element\")\n        }\n    }\n    return nil\n}","typeGuard":"// Terraform HCL: never produce null via coalesce\n// impersonate_service_account_delegates = [coalesce(var.delegate, \"projects/-/serviceAccounts/fallback@proj.iam.gserviceaccount.com\")]","tryCatchPattern":null,"preventionTips":["Give every variable feeding impersonate_service_account_delegates a concrete non-null default.","Lint the backend block with terraform validate before init.","Avoid [var.x] patterns unless var.x is guaranteed non-null."],"tags":["gcs","gcp","backend","impersonation","config-validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}