Keyring import

[unb9rn]

How do I import existing keyring to this module?
I have some terraform code:

module "kms-keys" {
  source  = "terraform-google-modules/kms/google"
  version = "~>2.0"

  project_id              = module.project.project_id

  keyring                 = var.kms_keyring_name
  location                = var.kms_keyring_location
  
  key_algorithm           = "GOOGLE_SYMMETRIC_ENCRYPTION"
  key_protection_level    = var.kms_key_protection
  
  keys                    = tolist([var.kms_gke_key_name])
  
  prevent_destroy         = false
}

And I have a keyring named "main-keyring". I'm trying to import state like this:

terraform import "module.kms-keys.google_kms_key_ring.key_ring" "myproject-631c/europe-west3-a/main-keyring"

And I'm getting an error:

module.kms-keys.google_kms_key_ring.key_ring: Refreshing state... [id=projects/myproject-631c/locations/europe-west3-a/keyRings/main-keyring]
╷
│ Error: Invalid function argument
│ 
│   on .terraform/modules/kms-keys/main.tf line 18, in locals:
│   18:   keys_by_name = zipmap(var.keys, var.prevent_destroy ? slice(google_kms_crypto_key.key[*].self_link, 0, length(var.keys)) : slice(google_kms_crypto_key.key_ephemeral[*].self_link, 0, length(var.keys)))
│     ├────────────────
│     │ var.keys is list of string with 1 element
│ 
│ Invalid value for "end_index" parameter: end index must not be greater than the length of the list.

Is it a bug?

[morgante]

This looks like a minor bug in how we compute the index length when importing. We probably need to use max(length(google_kms_crypto_key.key), length(var.keys)).

[philicious]

I wasnt able to fix it just buy what @morgante suggested. If you only have a keyring to import with no keys, it will complain about google_kms_crypto_key.key is empty tuple

however I was able to work around this and import the keyring:

• use a local copy of this module
• comment out all outputs.tf
• comment out all but the resource google_kms_key_ring.. in main.tf
• import the keyring to tf state
• roll back to using the upstream module and create keys with it as you wish

[hjoh95]

Seeing this issue as well.

I was able to import my keyring and key[0] with no issue, however, any additional keys are giving me this:

module.kms.google_kms_crypto_key.key[1]: Refreshing state... [id=projects/<project>/locations/global/keyRings/<keyring>/cryptoKeys/<key1>]
╷
│ Error: Invalid function argument
│
│   on .terraform/modules/kms/main.tf line 18, in locals:
│   18:   keys_by_name = zipmap(var.keys, var.prevent_destroy ? slice(google_kms_crypto_key.key[*].id, 0, length(var.keys)) : slice(google_kms_crypto_key.key_ephemeral[*].id, 0, length(var.keys)))
│     ├────────────────
│     │ var.keys is list of string with 6 elements
│
│ Invalid value for "end_index" parameter: end index must not be greater than
│ the length of the list.
╵

[CrackerJackMack]

someone provided a fix twice for this and they both went stale. Wonder if the maintainer/author is watching this repo anymore

[moritzschmitz-oviva]

Just ran into this problem as well.

[hjoh95]

I was about to +1 this issue but realized I had already commented 2 years ago. Disappointing that this hasn't been resolved.

With some help from Gemini, I was able to fix this issue (hopefully without introducing new issues) by setting local.keys_by_name to this:

keys_by_name = zipmap(var.keys, [for k in var.keys : "${google_kms_key_ring.key_ring.id}/cryptoKeys/${k}"])

This will pre-construct the full key id instead of trying to slice that value out of the resource blocks. The key ID is identical whether prevent_destroy is true or false