{"record":{"id":"272ff3c488041220","repo":"hashicorp/terraform","slug":"expected-s-to-be-in-the-range-d-d-got-d","errorCode":null,"errorMessage":"expected %s to be in the range (%d - %d), got %d","messagePattern":"expected (.+?) to be in the range \\((.+?) - (.+?)\\), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":79,"sourceCode":"\t\t\t\t\"policy\": {\n\t\t\t\t\tType:        schema.TypeString,\n\t\t\t\t\tOptional:    true,\n\t\t\t\t\tDescription: \"The permissions applied when assuming a role. You cannot use this policy to grant permissions which exceed those of the role that is being assumed.\",\n\t\t\t\t},\n\t\t\t\t\"session_expiration\": {\n\t\t\t\t\tType:        schema.TypeInt,\n\t\t\t\t\tOptional:    true,\n\t\t\t\t\tDescription: \"The time after which the established session for assuming role expires.\",\n\t\t\t\t\tValidateFunc: func(v interface{}, k string) ([]string, []error) {\n\t\t\t\t\t\tmin := 900\n\t\t\t\t\t\tmax := 3600\n\t\t\t\t\t\tvalue, ok := v.(int)\n\t\t\t\t\t\tif !ok {\n\t\t\t\t\t\t\treturn nil, []error{fmt.Errorf(\"expected type of %s to be int\", k)}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif value < min || value > max {\n\t\t\t\t\t\t\treturn nil, []error{fmt.Errorf(\"expected %s to be in the range (%d - %d), got %d\", k, min, max, v)}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\treturn nil, nil\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n}\n\n// New creates a new backend for OSS remote state.\nfunc New() backend.Backend {\n\ts := &schema.Backend{\n\t\tSchema: map[string]*schema.Schema{\n\t\t\t\"access_key\": {\n\t\t\t\tType:        schema.TypeString,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Alibaba Cloud Access Key ID\",","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L61-L97","documentation":"Returned by the ValidateFunc of session_expiration (deprecated assume_role block) when the integer is outside the inclusive range 900–3600 seconds. Alibaba Cloud STS requires AssumeRole DurationSeconds to be between 900 and 3600; this validator rejects the value at plan/init time before any STS call.","triggerScenarios":"Setting assume_role.session_expiration to a number < 900 or > 3600 in the oss backend config, or via the deprecated assume_role block. Commonly 0, 7200, or a value copied from a different cloud's docs.","commonSituations":"Copy-pasting AWS-style session durations (AWS allows up to 43200); setting 0 hoping for 'default'; using a variable default that exceeds 3600.","solutions":["Set session_expiration to an integer between 900 and 3600 inclusive (3600 is the safest default).","If you do not need a custom duration, omit the attribute — configure() defaults it to 3600 when unset.","Check any ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION env override is also within range."],"exampleFix":"# before\nassume_role {\n  session_expiration = 7200   # > 3600\n}\n\n# after\nassume_role {\n  session_expiration = 3600\n}","handlingStrategy":"validation","validationCode":"func validateSessionExpiration(v int) error {\n    const min, max = 900, 3600\n    if v < min || v > max {\n        return fmt.Errorf(\"session_expiration must be in [%d, %d], got %d\", min, max, v)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to 3600 when unsure.","Do not reuse AWS durations (which allow up to 43200).","Omit the attribute to accept the safe default."],"tags":["oss","assume-role","validation","config","range","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}