{"record":{"id":"871e22d27d2096aa","repo":"hashicorp/terraform","slug":"cannot-override-soft-failed-policy-checks-when-in","errorCode":null,"errorMessage":"Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.","messagePattern":"Cannot override soft failed policy checks when -input=false\\. Please open the run in the UI to override\\.","errorType":"exception","errorClass":"errPolicyOverrideNeedsUIConfirmation","httpStatus":null,"severity":"error","filePath":"internal/cloud/errors.go","lineNumber":23,"sourceCode":"\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/hashicorp/terraform/internal/tfdiags\"\n\t\"github.com/zclconf/go-cty/cty\"\n)\n\n// String based errors\nvar (\n\terrApplyDiscarded                    = errors.New(\"Apply discarded.\")\n\terrDestroyDiscarded                  = errors.New(\"Destroy discarded.\")\n\terrRunApproved                       = errors.New(\"approved using the UI or API\")\n\terrRunDiscarded                      = errors.New(\"discarded using the UI or API\")\n\terrRunOverridden                     = errors.New(\"overridden using the UI or API\")\n\terrApplyNeedsUIConfirmation          = errors.New(\"Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.\")\n\terrPolicyOverrideNeedsUIConfirmation = errors.New(\"Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.\")\n)\n\n// Diagnostic error messages\nvar (\n\tinvalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(\n\t\ttfdiags.Error,\n\t\t\"Invalid workspaces configuration\",\n\t\tfmt.Sprintf(\"Missing workspace mapping strategy. Either workspace \\\"tags\\\" or \\\"name\\\" is required.\\n\\n%s\", workspaceConfigurationHelp),\n\t\tcty.Path{cty.GetAttrStep{Name: \"workspaces\"}},\n\t)\n\n\tinvalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(\n\t\ttfdiags.Error,\n\t\t\"Invalid workspaces configuration\",\n\t\tfmt.Sprintf(\"Only one of workspace \\\"tags\\\" or \\\"name\\\" is allowed.\\n\\n%s\", workspaceConfigurationHelp),\n\t\tcty.Path{cty.GetAttrStep{Name: \"workspaces\"}},\n\t)\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/errors.go#L5-L41","documentation":"errPolicyOverrideNeedsUIConfirmation is returned when a soft-failed Sentinel/OPA policy check is overridable but the CLI cannot prompt for override because -input=false and -auto-approve was not set. Defined in errors.go:23, returned at backend_common.go:409. Terraform will not auto-override policy failures silently; the user must override in the UI.","triggerScenarios":"backend_common.go:404-409: a policy check is overridable and soft-failed; op.AutoApprove is false and b.input is false (-input=false). The error is returned immediately so the operator handles the override in the HCP Terraform UI.","commonSituations":"A Sentinel policy soft-fails during a CI run with -input=false; the pipeline doesn't pass -auto-approve so Terraform cannot auto-override and asks the operator to use the UI.","solutions":["If the soft failure is acceptable, re-run with -auto-approve to let Terraform override programmatically: 'terraform apply -auto-approve'.","Or open the run in the HCP Terraform UI and click 'Override' on the soft-failed policy check.","Fix the policy violation in configuration so the check passes, removing the need to override."],"exampleFix":"# before\n$ terraform apply -input=false   # policy soft-failed, can't prompt\n# after (accept override automatically)\n$ terraform apply -auto-approve","handlingStrategy":"validation","validationCode":"// Decide upfront whether to auto-override soft policy failures.\nfunc planApplyFlags(allowPolicyOverride, inputEnabled bool) []string {\n    args := []string{\"apply\"}\n    if !inputEnabled {\n        args = append(args, \"-input=false\")\n    }\n    if allowPolicyOverride {\n        // -auto-approve lets Terraform auto-override soft-failed policy checks\n        args = append(args, \"-auto-approve\")\n    }\n    return args\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use -auto-approve when soft-policy overrides are an accepted part of your pipeline.","Tighten Sentinel policies to hard-fail for cases that must never be overridden.","Monitor policy soft-fail rates and address root causes rather than routinely overriding."],"tags":["cloud-backend","policy","override","input-disabled","ui-confirmation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}