diff --git a/common/resources.tf b/common/resources.tf
index 7a9fc7f..5ef47d1 100644
--- a/common/resources.tf
+++ b/common/resources.tf
@@ -15,7 +15,7 @@ locals {
   kms_key_name = format("%s%s", local._prefixes["kms"], local.name)
 
   kms_admin_root  = format("arn:%v:iam::%v:root", local.partition, local.account_id)
-  kms_admin_roles = compact(concat(local.kms_admin_root, var.kms_admin_roles))
+  kms_admin_roles = compact(concat(tolist(local.kms_admin_root), var.kms_admin_roles))
 
   condition_allowed_cidr = {
     "test" : "NotIpAddress"