What causes "tag elements must be strings" in hashicorp/terraform?

Make every element a string, e.g. tags = ["a", "1"].

tag elements must be strings

Error message

tag elements must be strings

What it means

Config-parsing diagnostic from the cloud backend when workspaces.tags is a tuple/set type but an element's cty type is not cty.String. All set/tuple tag elements must be strings so they can be collected into []string.

Source

Thrown at internal/cloud/backend.go:523

			if val.Type().IsObjectType() || val.Type().IsMapType() {
				for k, v := range val.AsValueMap() {
					if v.Type() != cty.String {
						diags = diags.Append(errors.New("tag object values must be strings"))
						return ret, diags
					}
					tagsAsMap[k] = v.AsString()
				}
				log.Printf("[TRACE] cloud: using tags %q from cloud config block", tagsAsMap)
				ret.workspaceMapping.TagsAsMap = tagsAsMap
			} else if val.Type().IsTupleType() || val.Type().IsSetType() {
				var tagsAsSet []string
				length := val.LengthInt()
				if length > 0 {
					it := val.ElementIterator()
					for it.Next() {
						_, v := it.Element()
						if !v.Type().Equals(cty.String) {
							diags = diags.Append(errors.New("tag elements must be strings"))
							return ret, diags
						}
						if vs := v.AsString(); vs != "" {
							tagsAsSet = append(tagsAsSet, vs)
						}
					}
				}

				log.Printf("[TRACE] cloud: using tags %q from cloud config block", tagsAsSet)
				ret.workspaceMapping.TagsAsSet = tagsAsSet
			} else {
				diags = diags.Append(fmt.Errorf("tags must be a set or object, not %s", val.Type().FriendlyName()))
				return ret, diags
			}
		}
		if val := workspaces.GetAttr("project"); !val.IsNull() {
			project = val.AsString()
			log.Printf("[TRACE] cloud: found project name %q in cloud config block", project)

View on GitHub (pinned to c9def3e214)

Solutions

Make every element a string, e.g. tags = ["a", "1"].
Type the variable as set(string) or list(string).

Example fix

// before
workspaces {
  tags = ["Environment:prod", 42]
}
// after
workspaces {
  tags = ["Environment:prod", "42"]
}

Defensive patterns

Strategy: validation

Validate before calling

# Type the tags variable as set(string)/list(string):
variable "tags" { type = set(string) }
# Then: workspaces { tags = var.tags }

Prevention

Type tag-set variables as set(string).
Avoid list(any) for tag collections.
Validate configuration in CI.

When it happens

Trigger: workspaces { tags = ["a", 1] } — a non-string element in a set-type tags value; or a list(any) variable containing a non-string.

Common situations: Mixing types in a tags list; a variable typed as list(any).

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/7d910d9ef84af5e7. Report an issue: GitHub.