opentofu/opentofu · error

invalid deposed key in element %d: %w

Error message

invalid deposed key in element %d: %w

What it means

The DeposedKey element at index N failed to decode: the stored deposed key string is not a valid addrs.DeposedKey (deposed keys have a fixed expected format). The wrapped error identifies exactly why the key is invalid.

Source

Thrown at internal/engine/internal/execgraph/graph_unmarshal.go:87

		case execgraphproto.Element_ConstantValue_case:
			val, err := unmarshalConstantValueElem(elem.GetConstantValue())
			if err != nil {
				return nil, fmt.Errorf("invalid constant value in element %d: %w", idx, err)
			}
			results[idx] = builder.ConstantValue(val)

		case execgraphproto.Element_ConstantResourceInstAddr_case:
			addr, err := unmarshalConstantResourceInstAddr(elem.GetConstantResourceInstAddr())
			if err != nil {
				return nil, fmt.Errorf("invalid resource instance address in element %d: %w", idx, err)
			}
			results[idx] = builder.ConstantResourceInstAddr(addr)

		case execgraphproto.Element_DeposedKey_case:
			key, err := unmarshalConstantDeposedKey(elem.GetDeposedKey())
			if err != nil {
				return nil, fmt.Errorf("invalid deposed key in element %d: %w", idx, err)
			}
			results[idx] = builder.ConstantDeposedKey(key)

		case execgraphproto.Element_ConstantProviderInstAddr_case:
			addr, err := unmarshalConstantProviderInstAddr(elem.GetConstantProviderInstAddr())
			if err != nil {
				return nil, fmt.Errorf("invalid provider instance address in element %d: %w", idx, err)
			}
			results[idx] = builder.ConstantProviderInstAddr(addr)

		default:
			// The above cases should cover all of the valid values of
			// execgraphproto.case_Element_Request, so we should not get here
			// for any serialized graph that was produced by this version
			// of OpenTofu.
			return nil, fmt.Errorf("unrecognized request type %#v for element %d", reqType, idx)
		}
	}

View on GitHub (pinned to 3561785c48)

Solutions

1. Regenerate the serialized graph from a fresh run
2. Use matching OpenTofu versions on both ends of the exchange
3. File an issue with the artifact if same-version Marshal/Unmarshal round-trip fails

g, err := execgraph.UnmarshalGraph(src)
if err != nil && strings.Contains(err.Error(), "invalid deposed key in element") {
	return fmt.Errorf("serialized graph contains an invalid deposed key: %w", err)
}

When it happens

Trigger: A deposed key in the serialized graph is empty or not in the canonical 12-hex-digit-like DeposedKey format, from corruption or an incompatible producer.

Common situations: Hand-edited or truncated graph artifacts; cross-version artifacts written by code with different key validation rules.

Related errors

• invalid operation in element %d: %w
• invalid constant value in element %d: %w
• invalid resource instance address in element %d: %w
• invalid provider instance address in element %d: %w
• invalid resource instance address %q: %w

AI-assisted analysis of opentofu/opentofu@3561785c48 (2026-08-15). Data as JSON: /api/errors/bc700fd317a3ec59. Report an issue: GitHub.