{"record":{"id":"43c2f84c8dea8b35","repo":"hashicorp/terraform","slug":"you-are-not-authorized-to-read-the-full-state-vers","errorCode":null,"errorMessage":"You are not authorized to read the full state version containing outputs.\nState versions created by terraform v1.3.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version.","messagePattern":"You are not authorized to read the full state version containing outputs\\.\nState versions created by terraform v1\\.3\\.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version\\.","errorType":"exception","errorClass":"ErrStateVersionUnauthorizedUpgradeState","httpStatus":null,"severity":"error","filePath":"internal/cloud/state.go","lineNumber":81,"sourceCode":"\tworkspace            *tfe.Workspace\n\tstateUploadErr       bool\n\tforcePush            bool\n\tlockInfo             *statemgr.LockInfo\n\n\t// The server can optionally return an X-Terraform-Snapshot-Interval header\n\t// in its response to the \"Create State Version\" operation, which specifies\n\t// a number of seconds the server would prefer us to wait before trying\n\t// to write a new snapshot. If this is non-zero then we'll wait at least\n\t// this long before allowing another intermediate snapshot. This does\n\t// not effect final snapshots after an operation, which will always\n\t// be written to the remote API.\n\tstateSnapshotInterval time.Duration\n\t// If the header X-Terraform-Snapshot-Interval is present then\n\t// we will enable snapshots\n\tenableIntermediateSnapshots bool\n}\n\nvar ErrStateVersionUnauthorizedUpgradeState = errors.New(strings.TrimSpace(`\nYou are not authorized to read the full state version containing outputs.\nState versions created by terraform v1.3.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version.\n`))\n\nvar _ statemgr.Full = (*State)(nil)\nvar _ statemgr.Migrator = (*State)(nil)\nvar _ statemgr.IntermediateStateConditionalPersister = (*State)(nil)\n\n// statemgr.Reader impl.\nfunc (s *State) State() *states.State {\n\ts.mu.Lock()\n\tdefer s.mu.Unlock()\n\n\treturn s.state.DeepCopy()\n}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/state.go#L63-L99","documentation":"ErrStateVersionUnauthorizedUpgradeState is returned by State.GetRootOutputValues when a state version output lacks DetailedType (meaning the state was written by Terraform <1.3.0), forcing a fallback to read the full state, but the caller is not authorized to read the full state and the state comes back nil. Because Terraform >=1.3.0 stores detailed output types that don't require full-state authorization, the message points the user at upgrading the remote state version.","triggerScenarios":"state.go:578-595: output.DetailedType == nil triggers the full-state fallback; s.RefreshState() is called, then s.State() is checked. If state is nil (unauthorized read or empty after refresh), ErrStateVersionUnauthorizedUpgradeState is returned. The token in use lacks 'read full state' permission.","commonSituations":"A workspace whose state was last written by Terraform <1.3.0; a read-only API token / team with limited permissions reading outputs; migrating an old workspace into HCP Terraform without re-running apply under a newer Terraform.","solutions":["Run a 'terraform apply' with Terraform >=1.3.0 against the workspace so a new state version (with detailed output types) is written.","If you cannot apply, grant the API token/team the 'Read Full State' permission on the workspace.","Upgrade the Terraform CLI version locally to >=1.3.0 before reading outputs."],"exampleFix":"# before: outputs read with <1.3.0 state + read-only token -> unauthorized\n# after: write a new state version with >=1.3.0\n$ terraform version          # ensure >= 1.3.0\n$ terraform apply -auto-approve","handlingStrategy":"fallback","validationCode":"// Detect the pre-1.3.0 state early and prompt an upgrade rather than failing on output read.\nfunc ensureDetailedOutputs(client *tfe.Client, ws string) error {\n    outs, err := client.StateVersionOutputs.ReadCurrent(ctx, ws)\n    if err != nil { return err }\n    for _, o := range outs.Items {\n        if o.DetailedType == nil {\n            return errors.New(\"state predates v1.3.0 outputs; run 'terraform apply' with TF >= 1.3.0 to upgrade the state version\")\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Fall back gracefully: if outputs can't be read, surface upgrade guidance.\noutputs, err := state.GetRootOutputValues(ctx)\nif errors.Is(err, cloud.ErrStateVersionUnauthorizedUpgradeState) {\n    log.Println(\"upgrade the remote state version with Terraform >= 1.3.0, or grant read-full-state permission\")\n    return nil, errUpgradeRequired\n}","preventionTips":["Keep Terraform CLI >= 1.3.0 so new state versions carry detailed output types.","Grant 'Read Full State' to service tokens that must read legacy state.","After upgrading Terraform, run an apply to write a new-format state version."],"tags":["cloud-state","outputs","authorization","version-migration","state-version"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}