{"record":{"id":"5d05cf02725e65aa","repo":"hashicorp/terraform","slug":"at-most-1-action-can-be-invoked-per-operation","errorCode":null,"errorMessage":"at most 1 action can be invoked per operation","messagePattern":"at most 1 action can be invoked per operation","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_plan.go","lineNumber":186,"sourceCode":"\tif len(op.Targets) != 0 {\n\t\trunOptions.TargetAddrs = make([]string, 0, len(op.Targets))\n\t\tfor _, addr := range op.Targets {\n\t\t\trunOptions.TargetAddrs = append(runOptions.TargetAddrs, addr.String())\n\t\t}\n\t}\n\n\tif len(op.ActionTargets) != 0 {\n\t\tif len(op.ActionTargets) > 1 {\n\t\t\t// For now, we only support a single action from the command line.\n\t\t\t// We've future proofed the API and inputs so we can send multiple\n\t\t\t// but versions of Terraform will enforce this both here, and\n\t\t\t// on the other side.\n\t\t\t//\n\t\t\t// It shouldn't actually be possible to reach here anyway - we're\n\t\t\t// validating at the point the flag is read that it only has a\n\t\t\t// single entry. But, we'll check again to be safe.\n\t\t\treturn nil, b.generalError(\"Invalid arguments\",\n\t\t\t\terrors.New(\"at most 1 action can be invoked per operation\"))\n\t\t}\n\n\t\tfor _, target := range op.ActionTargets {\n\t\t\trunOptions.InvokeActionAddrs = append(runOptions.InvokeActionAddrs, target.String())\n\t\t}\n\n\t}\n\n\tif len(op.ForceReplace) != 0 {\n\t\trunOptions.ReplaceAddrs = make([]string, 0, len(op.ForceReplace))\n\t\tfor _, addr := range op.ForceReplace {\n\t\t\trunOptions.ReplaceAddrs = append(runOptions.ReplaceAddrs, addr.String())\n\t\t}\n\t}\n\n\tif len(op.PolicyPaths) != 0 {\n\t\trunOptions.PolicyPaths = append(runOptions.PolicyPaths, op.PolicyPaths...)\n\t}","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_plan.go#L168-L204","documentation":"Defensive validation in the cloud backend Operation path: op.ActionTargets (resources to invoke via -invoke-action) may contain at most one address. Although flag parsing already enforces a single entry, this check guards against programmatic/embedded callers that bypass the CLI parser.","triggerScenarios":"Calling the cloud backend Operation with op.ActionTargets containing 2+ resource addresses — only reachable by embedding terraform or a future CLI change; the terraform CLI flag layer rejects multiple values first.","commonSituations":"Programmatic terraform embedding that populates ActionTargets directly; an experimental CLI flag allowing multiple -invoke-action values.","solutions":["Pass at most one -invoke-action target per operation.","If embedding, ensure len(op.ActionTargets) <= 1 before calling Operation.","Run separate plan/apply operations for each action invocation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// If embedding terraform, cap ActionTargets before calling Operation:\nif len(op.ActionTargets) > 1 {\n    return errors.New(\"at most 1 action can be invoked per operation\")\n}\n// From the CLI, the -invoke-action flag already rejects multiple values.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass at most one -invoke-action per run from the CLI.","Validate len(ActionTargets) <= 1 in embedding code.","Run separate operations for multiple actions."],"tags":["terraform","cloud-backend","actions","defensive","cli"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}