{"record":{"id":"492d238357a0758d","repo":"hashicorp/terraform","slug":"s-errored-492d23","errorCode":null,"errorMessage":"%s errored.","messagePattern":"(.+?) errored\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_common.go","lineNumber":393,"sourceCode":"\t\t\t\t\t\tnext = false\n\t\t\t\t\t}\n\t\t\t\t\tline = append(line, l...)\n\t\t\t\t}\n\n\t\t\t\tif next || len(line) > 0 {\n\t\t\t\t\tb.CLI.Output(b.Colorize().Color(string(line)))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tswitch pc.Status {\n\t\tcase tfe.PolicyPasses:\n\t\t\tif (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {\n\t\t\t\tb.CLI.Output(\"\\n------------------------------------------------------------------------\")\n\t\t\t}\n\t\t\tcontinue\n\t\tcase tfe.PolicyErrored:\n\t\t\treturn fmt.Errorf(\"%s errored.\", msgPrefix)\n\t\tcase tfe.PolicyHardFailed:\n\t\t\treturn fmt.Errorf(\"%s hard failed.\", msgPrefix)\n\t\tcase tfe.PolicySoftFailed:\n\t\t\trunURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)\n\n\t\t\tif op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||\n\t\t\t\t!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {\n\t\t\t\treturn fmt.Errorf(\"%s soft failed.\\n%s\", msgPrefix, runURL)\n\t\t\t}\n\n\t\t\tif op.AutoApprove {\n\t\t\t\tif _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {\n\t\t\t\t\treturn b.generalError(fmt.Sprintf(\"Failed to override policy check.\\n%s\", runURL), err)\n\t\t\t\t}\n\t\t\t} else if !b.input {\n\t\t\t\treturn errPolicyOverrideNeedsUIConfirmation\n\t\t\t} else {\n\t\t\t\topts := &terraform.InputOpts{","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_common.go#L375-L411","documentation":"checkPolicy (backend_common.go:392-393) returns this when a policy check ends in tfe.PolicyErrored. 'Errored' means the policy evaluation itself crashed or could not complete (e.g. OPA/ Sentinel runtime failure, malformed policy, timeout), distinct from a policy that evaluated and failed.","triggerScenarios":"After streaming policy logs, pc.Status == tfe.PolicyErrored is hit in the switch at backend_common.go:386. The policy framework failed to execute the rule set, not that a rule failed.","commonSituations":"Malformed or buggy Sentinel/OPA policy in the org/workspace. Policy execution timeout on a very large plan. Policy server outage on the TFE side. Upgrading policy framework that breaks an existing policy.","solutions":["Inspect the policy check logs streamed just before this error for the runtime exception.","Fix or disable the offending policy in the HCP/TFE policy set.","Retry the run after confirming the policy service is healthy.","If caused by plan size, scope the plan with -target or split the workspace."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-validate policy sets compile before relying on them.\n// (Perform via HCP/TFE policy set validation tooling.)","typeGuard":null,"tryCatchPattern":"// On PolicyErrored, surface logs and abort gracefully.\nif pc.Status == tfe.PolicyErrored {\n    logPolicyFailure(pc); return structuredPolicyError(err)\n}","preventionTips":["Test Sentinel/OPA policies in the policy set sandbox before promoting.","Keep policy execution timeouts generous for large plans.","Monitor policy-service health on the TFE side."],"tags":["terraform","tfe","policy","sentinel","cloud-backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}