{"record":{"id":"5922a727bb7f2c61","repo":"hashicorp/terraform","slug":"errpolicyoverrideneedsuiconfirmation","errorCode":"errPolicyOverrideNeedsUIConfirmation","errorMessage":"Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.","messagePattern":"Cannot override soft failed policy checks when -input=false\\. Please open the run in the UI to override\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/errors.go","lineNumber":23,"sourceCode":"\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/hashicorp/terraform/internal/tfdiags\"\n\t\"github.com/zclconf/go-cty/cty\"\n)\n\n// String based errors\nvar (\n\terrApplyDiscarded                    = errors.New(\"Apply discarded.\")\n\terrDestroyDiscarded                  = errors.New(\"Destroy discarded.\")\n\terrRunApproved                       = errors.New(\"approved using the UI or API\")\n\terrRunDiscarded                      = errors.New(\"discarded using the UI or API\")\n\terrRunOverridden                     = errors.New(\"overridden using the UI or API\")\n\terrApplyNeedsUIConfirmation          = errors.New(\"Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.\")\n\terrPolicyOverrideNeedsUIConfirmation = errors.New(\"Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.\")\n)\n\n// Diagnostic error messages\nvar (\n\tinvalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(\n\t\ttfdiags.Error,\n\t\t\"Invalid workspaces configuration\",\n\t\tfmt.Sprintf(\"Missing workspace mapping strategy. Either workspace \\\"tags\\\" or \\\"name\\\" is required.\\n\\n%s\", workspaceConfigurationHelp),\n\t\tcty.Path{cty.GetAttrStep{Name: \"workspaces\"}},\n\t)\n\n\tinvalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(\n\t\ttfdiags.Error,\n\t\t\"Invalid workspaces configuration\",\n\t\tfmt.Sprintf(\"Only one of workspace \\\"tags\\\" or \\\"name\\\" is allowed.\\n\\n%s\", workspaceConfigurationHelp),\n\t\tcty.Path{cty.GetAttrStep{Name: \"workspaces\"}},\n\t)\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/cloud/errors.go#L5-L41","documentation":"Returned at backend_common.go:409 when a soft policy check fails, the operation is not running with AutoApprove, and interactive input is disabled (!b.input). The backend cannot prompt the user to override the soft policy failure, so it directs them to the TFC/TFE UI to perform the override manually.","triggerScenarios":"Running 'terraform apply -input=false' (without -auto-approve) with a cloud backend where a sentinel/soft policy check fails. backend_common.go:408 checks '!b.input' in the policy soft-failure branch and returns this error instead of prompting for an override decision.","commonSituations":"CI/CD pipelines with -input=false that encounter soft policy failures; cost-control or compliance sentinel policies that soft-fail and need human override; operators unfamiliar with TFC policy override workflow.","solutions":["Use -auto-approve to automatically override soft-failed policy checks (if permissions allow).","Open the run in the Terraform Cloud UI and click 'Override' on the soft-failed policy check.","Use the TFC API to override the policy check programmatically.","Fix the policy violation in the configuration so the check passes."],"exampleFix":"// before\nterraform apply -input=false\n// error: Cannot override soft failed policy checks when -input=false\n\n// after (option 1: auto-approve overrides soft failures)\nterraform apply -input=false -auto-approve\n// after (option 2: override in TFC UI or API)","handlingStrategy":"validation","validationCode":"// Before running apply, check if policies might soft-fail:\n// if policyEnforced && !canOverride {\n//     log.Warn(\"soft policy may fail; ensure -auto-approve or UI override access\")\n// }\n// Use: terraform apply -input=false -auto-approve","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use -auto-approve to allow automatic override of soft policy failures.","Ensure CI service accounts have policy override permissions in TFC.","Review sentinel policy sets to understand which checks can soft-fail."],"tags":["terraform","cloud","policy","sentinel","input-mode","ci-cd","override"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}