hashicorp/terraform · error

expected %s to be in the range (%d - %d), got %d

Error message

expected %s to be in the range (%d - %d), got %d

What it means

Returned by the ValidateFunc of session_expiration (deprecated assume_role block) when the integer is outside the inclusive range 900–3600 seconds. Alibaba Cloud STS requires AssumeRole DurationSeconds to be between 900 and 3600; this validator rejects the value at plan/init time before any STS call.

Source

Thrown at internal/backend/remote-state/oss/backend.go:79

				"policy": {
					Type:        schema.TypeString,
					Optional:    true,
					Description: "The permissions applied when assuming a role. You cannot use this policy to grant permissions which exceed those of the role that is being assumed.",
				},
				"session_expiration": {
					Type:        schema.TypeInt,
					Optional:    true,
					Description: "The time after which the established session for assuming role expires.",
					ValidateFunc: func(v interface{}, k string) ([]string, []error) {
						min := 900
						max := 3600
						value, ok := v.(int)
						if !ok {
							return nil, []error{fmt.Errorf("expected type of %s to be int", k)}
						}

						if value < min || value > max {
							return nil, []error{fmt.Errorf("expected %s to be in the range (%d - %d), got %d", k, min, max, v)}
						}

						return nil, nil
					},
				},
			},
		},
	}
}

// New creates a new backend for OSS remote state.
func New() backend.Backend {
	s := &schema.Backend{
		Schema: map[string]*schema.Schema{
			"access_key": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "Alibaba Cloud Access Key ID",

View on GitHub (pinned to c9def3e214)

Solutions

1. Set session_expiration to an integer between 900 and 3600 inclusive (3600 is the safest default).
2. If you do not need a custom duration, omit the attribute — configure() defaults it to 3600 when unset.
3. Check any ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION env override is also within range.

Example fix

# before
assume_role {
  session_expiration = 7200   # > 3600
}

# after
assume_role {
  session_expiration = 3600
}

func validateSessionExpiration(v int) error {
    const min, max = 900, 3600
    if v < min || v > max {
        return fmt.Errorf("session_expiration must be in [%d, %d], got %d", min, max, v)
    }
    return nil
}

When it happens

Trigger: Setting assume_role.session_expiration to a number < 900 or > 3600 in the oss backend config, or via the deprecated assume_role block. Commonly 0, 7200, or a value copied from a different cloud's docs.

Common situations: Copy-pasting AWS-style session durations (AWS allows up to 43200); setting 0 hoping for 'default'; using a variable default that exceeds 3600.

Related errors

• expected type of %s to be int
• workspace_key_prefix must not start with '/' or './'
• key can not start and end with '/'
• %q must be a valid ACL value , expected %s, %s or %s, got %q
• missing state name

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/272ff3c488041220. Report an issue: GitHub.