hashicorp/terraform · error

at most 1 action can be invoked per operation

Error message

at most 1 action can be invoked per operation

What it means

Defensive validation in the cloud backend Operation path: op.ActionTargets (resources to invoke via -invoke-action) may contain at most one address. Although flag parsing already enforces a single entry, this check guards against programmatic/embedded callers that bypass the CLI parser.

Source

Thrown at internal/cloud/backend_plan.go:186

	if len(op.Targets) != 0 {
		runOptions.TargetAddrs = make([]string, 0, len(op.Targets))
		for _, addr := range op.Targets {
			runOptions.TargetAddrs = append(runOptions.TargetAddrs, addr.String())
		}
	}

	if len(op.ActionTargets) != 0 {
		if len(op.ActionTargets) > 1 {
			// For now, we only support a single action from the command line.
			// We've future proofed the API and inputs so we can send multiple
			// but versions of Terraform will enforce this both here, and
			// on the other side.
			//
			// It shouldn't actually be possible to reach here anyway - we're
			// validating at the point the flag is read that it only has a
			// single entry. But, we'll check again to be safe.
			return nil, b.generalError("Invalid arguments",
				errors.New("at most 1 action can be invoked per operation"))
		}

		for _, target := range op.ActionTargets {
			runOptions.InvokeActionAddrs = append(runOptions.InvokeActionAddrs, target.String())
		}

	}

	if len(op.ForceReplace) != 0 {
		runOptions.ReplaceAddrs = make([]string, 0, len(op.ForceReplace))
		for _, addr := range op.ForceReplace {
			runOptions.ReplaceAddrs = append(runOptions.ReplaceAddrs, addr.String())
		}
	}

	if len(op.PolicyPaths) != 0 {
		runOptions.PolicyPaths = append(runOptions.PolicyPaths, op.PolicyPaths...)
	}

View on GitHub (pinned to c9def3e214)

Solutions

1. Pass at most one -invoke-action target per operation.
2. If embedding, ensure len(op.ActionTargets) <= 1 before calling Operation.
3. Run separate plan/apply operations for each action invocation.

// If embedding terraform, cap ActionTargets before calling Operation:
if len(op.ActionTargets) > 1 {
    return errors.New("at most 1 action can be invoked per operation")
}
// From the CLI, the -invoke-action flag already rejects multiple values.

When it happens

Trigger: Calling the cloud backend Operation with op.ActionTargets containing 2+ resource addresses — only reachable by embedding terraform or a future CLI change; the terraform CLI flag layer rejects multiple values first.

Common situations: Programmatic terraform embedding that populates ActionTargets directly; an experimental CLI flag allowing multiple -invoke-action values.

Related errors

• source and content cannot both be null
• your version of Terraform Enterprise does not support key-va
• tag object values must be strings
• tag elements must be strings
• operation timed out

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/5d05cf02725e65aa. Report an issue: GitHub.