OpenTofu / OpenTofu
Merged upstreamMaintenanceMerged Jul 2, 2026

Validate large count values before expansion

Fixed OpenTofu count handling so extremely large resource counts are rejected with a validation diagnostic before graph expansion tries to allocate impossible instance lists.

opentofu/opentofu · #4305

Problem

A resource with count = 9223372036854775807 could reach expansion and trigger Go runtime failures instead of returning a user-facing validation error. The existing checks caught negative and non-whole counts, but did not consistently cap upper-bound values before slice-backed expansion paths.

Approach

Introduced a shared maxCount limit, applied it in both count expression evaluation and instance selector compilation, and added validation coverage that rejects values above 2147483647 with a clear diagnostic.

Impact and scope

  • Turns an infrastructure-as-code crash path into a deterministic validation error before planning work expands resource instances.
  • Protects generated OpenTofu configurations where a bad count value could otherwise destabilize validation or apply flows.
  • Keeps the count limit consistent across validation and compilation paths instead of relying on platform-dependent runtime behavior.

Validation

  • Added evaluator and instance selector regression tests for values above the count limit.
  • Added a context validation test proving oversized resource counts fail during validation with the expected diagnostic.
  • PR validation covered the Go count handling paths changed by the fix and upstream review before merge.