How to fix Error: Error parsing timestamp in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 104 views

This error occurs when Terraform cannot parse a timestamp string in RFC3339 format, commonly from AWS SSO credentials or invalid time provider usage. Fixing it involves updating credentials, correcting timestamp formats, or using the time provider correctly.

Quick fix

Fixes Error: Error parsing timestamp

aws --version
  1. Check your AWS CLI and SDK versions
  2. Clear SSO credentials cache and re-authenticate
  3. Verify RFC3339 timestamp format in configuration
  4. Use the time_offset resource instead of timestamp() function
terraform — error
aws --version
Error: Error parsing timestamp

What this error means

The "Error parsing timestamp" error indicates that Terraform encountered a timestamp string that doesn't conform to RFC3339 format (e.g., "2006-01-02T15:04:05Z07:00"). This typically happens in two scenarios: 1. **AWS SSO Token Format Issue**: The AWS CLI credentials cache file contains malformed timestamps like "2021-05-04T18:07:34UTC" instead of proper RFC3339 format like "2021-05-04T18:07:34Z" or "2021-05-04T18:07:34-03:00". 2. **Time Provider Misconfiguration**: Using Terraform's time provider functions with incorrectly formatted timestamp strings, or using the `timestamp()` function in contexts where it causes unexpected behavior. The error prevents Terraform from parsing credentials, managing state, or executing operations that depend on time-based values.

Typical symptoms

  • Terraform plan or apply fails with 'Error: Error parsing timestamp' message
  • AWS SSO authentication fails with 'SSOProviderInvalidToken' after successful AWS CLI login
  • Terraform operations timeout or fail when using time provider resources
  • State operations fail with timestamp parsing errors related to credentials expiration

Common causes

  1. AWS CLI or SSO SDK creates credentials cache with malformed 'expiresAt' timestamps using 'UTC' suffix instead of 'Z' or timezone offset
  2. Terraform time provider functions receive timestamps not in RFC3339 format
  3. Mixing different timestamp format conventions in configuration or data sources
  4. Outdated AWS CLI version (2.1.13 or later) that generates incorrect SSO cache timestamps

How to fix "Error: Error parsing timestamp"

1Check your AWS CLI and SDK versions

Verify which AWS CLI version you're using, as this is the most common cause of the timestamp parsing error. Versions between 1.17.0-1.19.40 or earlier versions before 2.1.13 generated timestamps in a format that Terraform cannot parse.

bash
aws --version

If you're on AWS CLI 2.1.13 or later, the issue may be in your SSO cache file. If you're on an older problematic version, upgrading to the latest version should fix the issue.

2Clear SSO credentials cache and re-authenticate

The AWS SSO cache file may contain malformed timestamps from a previous authentication. Clear it and re-authenticate to generate fresh, properly-formatted credentials.

bash
# Remove SSO cache directory
rm -rf ~/.aws/sso/cache

# Re-authenticate with AWS SSO
aws sso login --profile your-profile-name

This forces AWS CLI to create a new cache file with correctly formatted timestamps in RFC3339 format.

3Verify RFC3339 timestamp format in configuration

If using Terraform's time provider, ensure all timestamps conform to RFC3339 format. Valid formats include:

hcl
# Valid RFC3339 formats:
"2023-07-25T23:43:16Z"           # Zulu time (UTC)
"2023-07-25T23:43:16-05:00"      # With timezone offset
"2023-07-25T23:43:16+00:00"      # Positive offset

# Use the rfc3339_parse function for parsing:
provider::time::rfc3339_parse("2023-07-25T23:43:16Z")

Check any custom timestamp strings or data source outputs for proper formatting.

4Use the time_offset resource instead of timestamp() function

The timestamp() function changes every second, causing perpetual diffs in Terraform plans. Use time_offset resource instead for more stable time handling:

hcl
# Instead of: local-exec provisioner with timestamp()
resource "time_offset" "example" {
  base_rfc3339 = "2023-07-25T23:43:16Z"
  # Or leave blank to use current time
}

output "creation_time" {
  value = time_offset.example.rfc3339
}

This creates a fixed timestamp once and avoids the parsing issues associated with dynamic timestamp generation.

5Manually fix SSO cache file (temporary workaround)

If you cannot upgrade AWS CLI immediately, you can manually edit the SSO cache file to fix the timestamp format. Locate and edit the cache file:

bash
# Find your SSO cache file (replace 'profile-name' with your actual profile)
cat ~/.aws/sso/cache/*.json | grep -l "expiresAt"

# Edit the file and change malformed timestamps from:
# "expiresAt": "2021-05-04T18:07:34UTC"
# To proper RFC3339 format:
# "expiresAt": "2021-05-04T18:07:34Z"

Warning: This is a temporary workaround. Upgrade AWS CLI to the latest version for a permanent fix.

6Validate Terraform configuration with proper timestamp handling

Run Terraform validate to ensure no configuration issues:

bash
terraform validate

Then test with a plan before applying to confirm the timestamp parsing error is resolved:

bash
terraform plan
terraform apply

If using AWS provider with SSO, verify credentials are being loaded correctly by checking the AWS profile in use.

Advanced notes

AWS CLI Version Details: The issue stems from AWS CLI 2.1.13 introducing changes to how SSO tokens are cached. Earlier versions (1.17.0-1.19.40) are known to work, as are versions after this was fixed. Always keep AWS CLI updated to get the latest bug fixes.

RFC3339 Format Explained: RFC3339 is a standardized timestamp format used throughout Terraform for consistency. It always includes date, time, and timezone information. Terraform's time provider requires strict compliance to this format.

Time Provider Best Practices: When working with timestamps in Terraform, prefer time_offset or time_static resources over the timestamp() function. These resources create fixed values in state, preventing perpetual diffs and parsing issues.

SELinux and Permissions: On Linux systems with SELinux enabled, ensure proper permissions on the ~/.aws/sso/cache directory. File permission issues can cause credential cache corruption leading to malformed timestamps.

Frequently asked questions

What does "Error: Error parsing timestamp" mean?
, "2006-01-02T15:04:05Z07:00"). This typically happens in two scenarios: 1. AWS SSO Token Format Issue: The AWS CLI credentials cache file contains malformed timestamps like "2021-05-04T18:07:34UTC" instead of proper RFC3339 format like "2021-05-04T18:07:34Z" or "2021-05-04T18:07:34-03:00".
How do I fix "Error: Error parsing timestamp"?
This error occurs when Terraform cannot parse a timestamp string in RFC3339 format, commonly from AWS SSO credentials or invalid time provider usage. Fixing it involves updating credentials, correcting timestamp formats, or using the time provider correctly.
What causes "Error: Error parsing timestamp"?
AWS CLI or SSO SDK creates credentials cache with malformed 'expiresAt' timestamps using 'UTC' suffix instead of 'Z' or timezone offset Terraform time provider functions receive timestamps not in RFC3339 format Mixing different timestamp format conventions in configuration or data sources
Is the "Error: Error parsing timestamp" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading