What causes "%q cannot be higher than %d: %d" in hashicorp/terraform?

Set session_duration to at most 43200 seconds.

%q cannot be higher than %d: %d

Error message

%q cannot be higher than %d: %d

What it means

Produced by validateIntegerInRange (cos/backend.go:260), used to validate assume_role.session_duration (range 0..43200). It fires when the configured integer exceeds the maximum supported STS session length of 43200 seconds (12 hours).

Source

Thrown at internal/backend/remote-state/cos/backend.go:260

			},
		},
	}

	result := &Backend{Backend: s}
	result.Backend.ConfigureFunc = result.configure

	return result
}

func validateIntegerInRange(min, max int64) schema.SchemaValidateFunc {
	return func(v interface{}, k string) (ws []string, errors []error) {
		value := int64(v.(int))
		if value < min {
			errors = append(errors, fmt.Errorf(
				"%q cannot be lower than %d: %d", k, min, value))
		}
		if value > max {
			errors = append(errors, fmt.Errorf(
				"%q cannot be higher than %d: %d", k, max, value))
		}
		return
	}
}

// configure init cos client
func (b *Backend) configure(ctx context.Context) error {
	if b.cosClient != nil {
		return nil
	}

	b.cosContext = ctx
	data := schema.FromContextBackendConfig(b.cosContext)

	b.region = data.Get("region").(string)
	b.bucket = data.Get("bucket").(string)
	b.prefix = data.Get("prefix").(string)

View on GitHub (pinned to c9def3e214)

Solutions

Set session_duration to at most 43200 seconds.
Use 7200 (default) for typical runs; raise only if a long apply needs more time.
Verify TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION units are seconds.

Example fix

// before
assume_role {
  session_duration = 100000
}
// after
assume_role {
  session_duration = 43200
}

Defensive patterns

Strategy: validation

Validate before calling

// Validate session_duration is within [min,max] before configuring
func validateRange(name string, v, minV, maxV int64) error {
    if v < minV { return fmt.Errorf("%q cannot be lower than %d: %d", name, minV, v) }
    if v > maxV { return fmt.Errorf("%q cannot be higher than %d: %d", name, maxV, v) }
    return nil
}

Prevention

Cap session_duration at 43200 seconds (12h STS max).
Do not specify minutes by mistake - the unit is seconds.
Validate env-provided durations in your provisioning scripts.

When it happens

Trigger: Setting assume_role.session_duration above 43200 (or via TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION) triggers the > max branch.

Common situations: Specifying minutes instead of seconds (e.g. 7200 minutes); wanting an overly long session that exceeds STS limits; copy-paste from another cloud's max.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a6800872dceeded4. Report an issue: GitHub.