Merged upstreamMaintenanceMerged Jul 2, 2026
Validate large count values before expansion
Fixed OpenTofu count handling so extremely large resource counts are rejected with a validation diagnostic before graph expansion tries to allocate impossible instance lists.
opentofu/opentofu · #4305
Problem
A resource with count = 9223372036854775807 could reach expansion and trigger Go runtime failures instead of returning a user-facing validation error. The existing checks caught negative and non-whole counts, but did not consistently cap upper-bound values before slice-backed expansion paths.
Approach
Introduced a shared maxCount limit, applied it in both count expression evaluation and instance selector compilation, and added validation coverage that rejects values above 2147483647 with a clear diagnostic.
Impact and scope
- Turns an infrastructure-as-code crash path into a deterministic validation error before planning work expands resource instances.
- Protects generated OpenTofu configurations where a bad count value could otherwise destabilize validation or apply flows.
- Keeps the count limit consistent across validation and compilation paths instead of relying on platform-dependent runtime behavior.
Validation
- Added evaluator and instance selector regression tests for values above the count limit.
- Added a context validation test proving oversized resource counts fail during validation with the expected diagnostic.
- PR validation covered the Go count handling paths changed by the fix and upstream review before merge.