How to fix Error: Error parsing timestamp in Terraform

Verify which AWS CLI version you're using, as this is the most common cause of the timestamp parsing error. Versions between 1.17.0-1.19.40 or earlier versions before 2.1.13 generated timestamps in a format that Terraform cannot parse.

aws --version

If you're on AWS CLI 2.1.13 or later, the issue may be in your SSO cache file. If you're on an older problematic version, upgrading to the latest version should fix the issue.

The AWS SSO cache file may contain malformed timestamps from a previous authentication. Clear it and re-authenticate to generate fresh, properly-formatted credentials.

# Remove SSO cache directory
rm -rf ~/.aws/sso/cache

# Re-authenticate with AWS SSO
aws sso login --profile your-profile-name

This forces AWS CLI to create a new cache file with correctly formatted timestamps in RFC3339 format.

If using Terraform's time provider, ensure all timestamps conform to RFC3339 format. Valid formats include:

# Valid RFC3339 formats:
"2023-07-25T23:43:16Z"           # Zulu time (UTC)
"2023-07-25T23:43:16-05:00"      # With timezone offset
"2023-07-25T23:43:16+00:00"      # Positive offset

# Use the rfc3339_parse function for parsing:
provider::time::rfc3339_parse("2023-07-25T23:43:16Z")

Check any custom timestamp strings or data source outputs for proper formatting.

The timestamp() function changes every second, causing perpetual diffs in Terraform plans. Use time_offset resource instead for more stable time handling:

# Instead of: local-exec provisioner with timestamp()
resource "time_offset" "example" {
  base_rfc3339 = "2023-07-25T23:43:16Z"
  # Or leave blank to use current time
}

output "creation_time" {
  value = time_offset.example.rfc3339
}

This creates a fixed timestamp once and avoids the parsing issues associated with dynamic timestamp generation.

If you cannot upgrade AWS CLI immediately, you can manually edit the SSO cache file to fix the timestamp format. Locate and edit the cache file:

# Find your SSO cache file (replace 'profile-name' with your actual profile)
cat ~/.aws/sso/cache/*.json | grep -l "expiresAt"

# Edit the file and change malformed timestamps from:
# "expiresAt": "2021-05-04T18:07:34UTC"
# To proper RFC3339 format:
# "expiresAt": "2021-05-04T18:07:34Z"

Warning: This is a temporary workaround. Upgrade AWS CLI to the latest version for a permanent fix.

Run Terraform validate to ensure no configuration issues:

terraform validate

Then test with a plan before applying to confirm the timestamp parsing error is resolved:

terraform plan
terraform apply

If using AWS provider with SSO, verify credentials are being loaded correctly by checking the AWS profile in use.