{"record":{"id":"655b9b5c8901c6e0","repo":"hashicorp/terraform","slug":"overridden-using-the-ui-or-api","errorCode":null,"errorMessage":"overridden using the UI or API","messagePattern":"overridden using the UI or API","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"internal/backend/remote/backend_common.go","lineNumber":30,"sourceCode":"\t\"math\"\n\t\"strconv\"\n\t\"strings\"\n\t\"time\"\n\n\ttfe \"github.com/hashicorp/go-tfe\"\n\n\t\"github.com/hashicorp/terraform/internal/backend/backendrun\"\n\t\"github.com/hashicorp/terraform/internal/logging\"\n\t\"github.com/hashicorp/terraform/internal/plans\"\n\t\"github.com/hashicorp/terraform/internal/terraform\"\n)\n\nvar (\n\terrApplyDiscarded   = errors.New(\"Apply discarded.\")\n\terrDestroyDiscarded = errors.New(\"Destroy discarded.\")\n\terrRunApproved      = errors.New(\"approved using the UI or API\")\n\terrRunDiscarded     = errors.New(\"discarded using the UI or API\")\n\terrRunOverridden    = errors.New(\"overridden using the UI or API\")\n)\n\nvar (\n\tbackoffMin = 1000.0\n\tbackoffMax = 3000.0\n\n\trunPollInterval = 3 * time.Second\n)\n\n// backoff will perform exponential backoff based on the iteration and\n// limited by the provided min and max (in milliseconds) durations.\nfunc backoff(min, max float64, iter int) time.Duration {\n\tbackoff := math.Pow(2, float64(iter)/5) * min\n\tif backoff > max {\n\t\tbackoff = max\n\t}\n\treturn time.Duration(backoff) * time.Millisecond\n}","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote/backend_common.go#L12-L48","documentation":"Sentinel error produced by the remote backend confirm() loop during soft-policy override prompting. When the polled run leaves the tfe.RunPolicyOverride status and is not discarded, the run was overridden via the UI/API, so the CLI skips its own PolicyChecks.Override call.","triggerScenarios":"A soft-failed policy check prompts for override ('override' keyword) and, while the CLI waits, the override is performed in the TFE/HCP UI or via POST /policy-checks/{id}/override.","commonSituations":"A security/compliance team member overrides a policy from the UI while the operator is reviewing; an automated policy-override bot acts first.","solutions":["No action required — the CLI recognizes the external override and continues.","Review the policy override audit log if the override was not intended.","Restrict who can override policies via workspace/team permissions to prevent surprise overrides."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := b.confirm(ctx, op, opts, run, \"override\"); err != nil && !errors.Is(err, errRunOverridden) {\n    return fmt.Errorf(\"Failed to override: %w\", err)\n}\n// errRunOverridden means it was overridden via UI/API — skip local PolicyChecks.Override","preventionTips":["Restrict policy-override permissions to a known set of teams.","Log policy overrides centrally so out-of-band overrides are auditable.","Treat errRunOverridden as success-equivalent control flow."],"tags":["terraform","remote-backend","tfe","hcp","policy"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}