hashicorp/terraform · warning

%q cannot be lower than %d: %d

Error message

%q cannot be lower than %d: %d

What it means

Produced by validateIntegerInRange (cos/backend.go:256), used to validate assume_role.session_duration (range 0..43200). It fires when the configured integer is below the minimum, indicating a misconfigured assume-role session length.

Source

Thrown at internal/backend/remote-state/cos/backend.go:256

				Type:        schema.TypeString,
				Optional:    true,
				DefaultFunc: schema.EnvDefaultFunc(PROVIDER_CAM_ROLE_NAME, nil),
				Description: "The name of the CVM instance CAM role. It can be sourced from the `TENCENTCLOUD_CAM_ROLE_NAME` environment variable.",
			},
		},
	}

	result := &Backend{Backend: s}
	result.Backend.ConfigureFunc = result.configure

	return result
}

func validateIntegerInRange(min, max int64) schema.SchemaValidateFunc {
	return func(v interface{}, k string) (ws []string, errors []error) {
		value := int64(v.(int))
		if value < min {
			errors = append(errors, fmt.Errorf(
				"%q cannot be lower than %d: %d", k, min, value))
		}
		if value > max {
			errors = append(errors, fmt.Errorf(
				"%q cannot be higher than %d: %d", k, max, value))
		}
		return
	}
}

// configure init cos client
func (b *Backend) configure(ctx context.Context) error {
	if b.cosClient != nil {
		return nil
	}

	b.cosContext = ctx
	data := schema.FromContextBackendConfig(b.cosContext)

View on GitHub (pinned to c9def3e214)

Solutions

1. Set session_duration to a value between 0 and 43200 seconds.
2. Use the default of 7200 seconds unless you need shorter/longer STS sessions.
3. Double-check TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION if set via environment.

Example fix

// before
assume_role {
  role_arn         = "qcs::cam::uin/1:roleName/tfrole"
  session_name     = "tf"
  session_duration = -100
}
// after
assume_role {
  role_arn         = "qcs::cam::uin/1:roleName/tfrole"
  session_name     = "tf"
  session_duration = 7200
}

// Validate session_duration is within [min,max] before configuring
func validateRange(name string, v, minV, maxV int64) error {
    if v < minV { return fmt.Errorf("%q cannot be lower than %d: %d", name, minV, v) }
    if v > maxV { return fmt.Errorf("%q cannot be higher than %d: %d", name, maxV, v) }
    return nil
}

When it happens

Trigger: Setting assume_role.session_duration to a negative value (or via TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION env var below 0) triggers the < min branch.

Common situations: Typo producing a negative number; confusing units (minutes vs seconds); env var set to an invalid string that Atoi turns into a negative.

Related errors

• %q cannot be higher than %d: %d
• prefix must not start with '/' or './'
• key can not start and end with '/'
• acl value invalid, expected %s or %s, got %s
• Invalid URL: %v must be: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/43e7c1d77bb6a760. Report an issue: GitHub.