Issue with slice Function in keys_by_name Local Variable Leading to Out-of-Bounds Error

[rbijja]

TL;DR

I hope you're doing well. I'm currently using the kms_configs module, and I encountered an issue that I'd like to bring to your attention.

Recently, I needed to reimport some of my Terraform resources, including a KMS module, and during this process, I encountered an issue with the module when the keys_by_name local variable is being calculated. Specifically, the problem occurs within the following code snippet:

keys_by_name = zipmap(
  var.keys,
  var.prevent_destroy 
    ? slice(google_kms_crypto_key.key[*].id, 0, length(var.keys)) 
    : slice(google_kms_crypto_key.key_ephemeral[*].id, 0, length(var.keys))
)

Expected behavior

I expected the Terraform configuration to handle a single-element list for var.keys without errors during the import process, allowing me to import the KMS resources successfully.

Observed behavior

Instead, I encountered the following error when attempting to run terraform plan after reimporting the KMS module:
Invalid value for "end_index" parameter: end index must not be greater than the length of the list.

When var.keys contains only a single element, the slice function throws an "Invalid value for end_index parameter" error because length(var.keys) is equal to 1. This results in an out-of-bounds error since the list index starts at 0, and the maximum valid index for slicing should be 0.

Terraform Configuration

locals {
  keys_by_name = zipmap(
    var.keys,
    var.prevent_destroy 
      ? slice(google_kms_crypto_key.key[*].id, 0, length(var.keys)) 
      : slice(google_kms_crypto_key.key_ephemeral[*].id, 0, length(var.keys))
  )
}

variable "keys" {
  type    = list(string)
  default = ["google-secrets"]
}

Terraform Version

The issue was observed with the following Terraform version: v1.1.4

Additional information

To avoid this error, I am assuming modifying the slice function to use the minimum of the list length and length(var.keys):

keys_by_name = zipmap(
var.keys,
var.prevent_destroy
? slice(google_kms_crypto_key.key[].id, 0, min(length(google_kms_crypto_key.key[].id), length(var.keys)))
: slice(google_kms_crypto_key.key_ephemeral[].id, 0, min(length(google_kms_crypto_key.key_ephemeral[].id), length(var.keys)))
)

[rbijja]

#44