{"record":{"id":"a78932f384d8629c","repo":"hashicorp/terraform","slug":"couldn-t-read-unredacted-json-plan-data-for-cloud","errorCode":null,"errorMessage":"couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace","messagePattern":"couldn't read unredacted JSON plan data for cloud run (.+?); make sure you've run `terraform login` and that you have admin permissions on the workspace","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_show.go","lineNumber":72,"sourceCode":"\t\t\topts = append(opts, plans.NoChanges)\n\t\t}\n\tdefault:\n\t\t// Bail, we can't use this.\n\t\terr = fmt.Errorf(\"can't display a cloud plan that is currently %s\", r.Plan.Status)\n\t\treturn nil, err\n\t}\n\n\t// Fetch the json plan!\n\tif redacted {\n\t\tjsonBytes, err = readRedactedPlan(ctx, b.client.BaseURL(), b.Token, r.Plan.ID)\n\t} else {\n\t\tjsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)\n\t}\n\tif err == tfe.ErrResourceNotFound {\n\t\tif redacted {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run\", runID)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace\", runID)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s: %w\", runID, err)\n\t}\n\n\t// Format a run header and footer\n\theader := strings.TrimSpace(fmt.Sprintf(runHeader, b.Hostname, b.Organization, r.Workspace.Name, r.ID))\n\tfooter := strings.TrimSpace(statusFooter(r.Status, r.Actions.IsConfirmable, r.Workspace.Locked))\n\n\tout := &cloudplan.RemotePlanJSON{\n\t\tJSONBytes: jsonBytes,\n\t\tRedacted:  redacted,\n\t\tMode:      mode,\n\t\tQualities: opts,\n\t\tRunHeader: header,\n\t\tRunFooter: footer,\n\t}\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_show.go#L54-L90","documentation":"Returned by ShowPlanForRun when fetching the UNREDACTED plan JSON (Plans.ReadJSONOutput) returns 404. Unredacted output requires admin permissions on the workspace, so a 404 here typically means insufficient privilege.","triggerScenarios":"redacted == false path: Plans.ReadJSONOutput returns tfe.ErrResourceNotFound because the caller is not an admin of the workspace (sensitive values are hidden from non-admins by returning 404).","commonSituations":"Non-admin team member trying to view an unredacted plan; using a read-only/team token instead of an admin token; showing unredacted plans from a CI service account lacking admin role.","solutions":["Use a token belonging to a workspace admin (or request admin access) when viewing unredacted plans.","Fall back to redacted=true viewing if admin access is not available.","Confirm the workspace's team access policy grants admin to the token's team."],"exampleFix":"// before: non-admin token requesting unredacted plan\njson, _ := b.ShowPlanForRun(ctx, runID, host, false /*unredacted*/)\n// after: use an admin token, or request redacted\nadminJSON, _ := b.ShowPlanForRun(ctx, runID, host, false)   // admin token\nredactedJSON, _ := b.ShowPlanForRun(ctx, runID, host, true) // safe fallback","handlingStrategy":"validation","validationCode":"// Only request unredacted output with an admin token.\nif !isAdminToken(b.Token, r.Workspace) {\n    return fmt.Errorf(\"token is not workspace admin; cannot view unredacted plan\")\n}","typeGuard":null,"tryCatchPattern":"jsonBytes, err := b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)\nif errors.Is(err, tfe.ErrResourceNotFound) && !redacted {\n    // fall back to redacted view if admin access unavailable\n    return b.ShowPlanForRun(ctx, runID, runHostname, true)\n}","preventionTips":["Use an admin-scoped token only when unredacted output is required.","Default to redacted=true and escalate only when needed.","Audit workspace team access to confirm admin roles."],"tags":["terraform","cloud-backend","permissions","admin","show","unredacted"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}