{"record":{"id":"7fedd4ebb1e28a7f","repo":"hashicorp/terraform","slug":"couldn-t-read-plan-data-for-cloud-run-s-make-sur","errorCode":null,"errorMessage":"couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run","messagePattern":"couldn't read plan data for cloud run (.+?); make sure you've run `terraform login` and that you have permission to view the run","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_show.go","lineNumber":70,"sourceCode":"\t\t// Good to go, but alert the renderer if it has no changes.\n\t\tif !r.Plan.HasChanges {\n\t\t\topts = append(opts, plans.NoChanges)\n\t\t}\n\tdefault:\n\t\t// Bail, we can't use this.\n\t\terr = fmt.Errorf(\"can't display a cloud plan that is currently %s\", r.Plan.Status)\n\t\treturn nil, err\n\t}\n\n\t// Fetch the json plan!\n\tif redacted {\n\t\tjsonBytes, err = readRedactedPlan(ctx, b.client.BaseURL(), b.Token, r.Plan.ID)\n\t} else {\n\t\tjsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)\n\t}\n\tif err == tfe.ErrResourceNotFound {\n\t\tif redacted {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run\", runID)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace\", runID)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s: %w\", runID, err)\n\t}\n\n\t// Format a run header and footer\n\theader := strings.TrimSpace(fmt.Sprintf(runHeader, b.Hostname, b.Organization, r.Workspace.Name, r.ID))\n\tfooter := strings.TrimSpace(statusFooter(r.Status, r.Actions.IsConfirmable, r.Workspace.Locked))\n\n\tout := &cloudplan.RemotePlanJSON{\n\t\tJSONBytes: jsonBytes,\n\t\tRedacted:  redacted,\n\t\tMode:      mode,\n\t\tQualities: opts,\n\t\tRunHeader: header,\n\t\tRunFooter: footer,","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_show.go#L52-L88","documentation":"Returned by ShowPlanForRun when fetching the REDACTED plan JSON (readRedactedPlan) returns tfe.ErrResourceNotFound. For a redacted plan a 404 usually means the token lacks read permission on the workspace rather than the plan literally being absent.","triggerScenarios":"redacted == true path: readRedactedPlan returns 404 because the token cannot read plan output for the workspace, or the plan output was purged.","commonSituations":"Token has no workspace read access; plan output retention expired; showing a plan from a workspace the user is not a member of; forgot `terraform login`.","solutions":["Run `terraform login` against the correct hostname and ensure the token has read access to the workspace.","Confirm the plan output is still retained (re-run the plan if retention lapsed).","Request read permission on the workspace from an org admin."],"exampleFix":"# before: guest token with no workspace read\nterraform show plan-from-run run-xxxx\n# after: log in with a token that has workspace read\nterraform login app.terraform.io\nterraform show plan-from-run run-xxxx","handlingStrategy":"validation","validationCode":"if b.Token == \"\" {\n    return fmt.Errorf(\"not logged in; cannot read redacted plan\")\n}\nif !canReadWorkspace(b.Token, r.Workspace) {\n    return fmt.Errorf(\"token lacks read access to workspace %s\", r.Workspace.Name)\n}","typeGuard":null,"tryCatchPattern":"if err == tfe.ErrResourceNotFound && redacted {\n    // treat as permission/login issue, not a hard failure; prompt re-login\n}","preventionTips":["Ensure read access on the workspace before showing redacted plans.","Log in via terraform login before show.","Re-run the plan if output retention may have expired."],"tags":["terraform","cloud-backend","permissions","show","not-found","plan-output"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}