{"record":{"id":"a78932f384d8629c","repo":"hashicorp/terraform","slug":"couldn-t-read-unredacted-json-plan-data-for-cloud","errorCode":null,"errorMessage":"couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace","messagePattern":"couldn't read unredacted JSON plan data for cloud run (.+?); make sure you've run `terraform login` and that you have admin permissions on the workspace","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_show.go","lineNumber":72,"sourceCode":"\t\t\topts = append(opts, plans.NoChanges)\n\t\t}\n\tdefault:\n\t\t// Bail, we can't use this.\n\t\terr = fmt.Errorf(\"can't display a cloud plan that is currently %s\", r.Plan.Status)\n\t\treturn nil, err\n\t}\n\n\t// Fetch the json plan!\n\tif redacted {\n\t\tjsonBytes, err = readRedactedPlan(ctx, b.client.BaseURL(), b.Token, r.Plan.ID)\n\t} else {\n\t\tjsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)\n\t}\n\tif err == tfe.ErrResourceNotFound {\n\t\tif redacted {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run\", runID)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace\", runID)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"couldn't read plan data for cloud run %s: %w\", runID, err)\n\t}\n\n\t// Format a run header and footer\n\theader := strings.TrimSpace(fmt.Sprintf(runHeader, b.Hostname, b.Organization, r.Workspace.Name, r.ID))\n\tfooter := strings.TrimSpace(statusFooter(r.Status, r.Actions.IsConfirmable, r.Workspace.Locked))\n\n\tout := &cloudplan.RemotePlanJSON{\n\t\tJSONBytes: jsonBytes,\n\t\tRedacted:  redacted,\n\t\tMode:      mode,\n\t\tQualities: opts,\n\t\tRunHeader: header,\n\t\tRunFooter: footer,\n\t}\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/cloud/backend_show.go#L54-L90","documentation":"Thrown by Cloud.ShowPlanForRun when b.client.Plans.ReadJSONOutput returns tfe.ErrResourceNotFound while requesting the UNREDACTED plan JSON. Unredacted plan output contains sensitive values and requires admin permissions on the workspace; a 404 here specifically signals insufficient privilege or missing auth.","triggerScenarios":"redacted=false path; ReadJSONOutput returns 404. The caller requested the full unredacted plan but the token's team lacks admin permissions on the workspace, so TFE hides the resource (404 instead of 403).","commonSituations":"Using `terraform show` with a flag requesting unredacted output as a non-admin; token from a read-only team; workspace admin role not granted to the caller's team.","solutions":["Have a workspace admin perform the unredacted show, or grant admin permission to your team.","Use the redacted plan output instead (default path) if you only need the structural diff.","Run `terraform login` to ensure a valid token is used."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only request unredacted output when admin permission is confirmed.\nif !callerIsAdmin { /* use redacted path */ }","typeGuard":null,"tryCatchPattern":"jsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, planID)\nif err == tfe.ErrResourceNotFound {\n    // not admin or not authenticated; fall back to redacted or surface\n}","preventionTips":["Grant workspace admin only to users who need unredacted output.","Prefer the redacted path for non-admin workflows.","Run `terraform login` to ensure a valid token."],"tags":["terraform","show","cloud-plan","unredacted","auth","admin","permissions","not-found"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}