{"record":{"id":"c3904c65a18ff44e","repo":"hashicorp/terraform","slug":"s-errored","errorCode":null,"errorMessage":"%s errored.","messagePattern":"(.+?) errored\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote/backend_common.go","lineNumber":443,"sourceCode":"\t\t\t\t\t\tnext = false\n\t\t\t\t\t}\n\t\t\t\t\tline = append(line, l...)\n\t\t\t\t}\n\n\t\t\t\tif next || len(line) > 0 {\n\t\t\t\t\tb.CLI.Output(b.Colorize().Color(string(line)))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tswitch pc.Status {\n\t\tcase tfe.PolicyPasses:\n\t\t\tif (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {\n\t\t\t\tb.CLI.Output(\"\\n------------------------------------------------------------------------\")\n\t\t\t}\n\t\t\tcontinue\n\t\tcase tfe.PolicyErrored:\n\t\t\treturn fmt.Errorf(\"%s errored.\", msgPrefix)\n\t\tcase tfe.PolicyHardFailed:\n\t\t\treturn fmt.Errorf(\"%s hard failed.\", msgPrefix)\n\t\tcase tfe.PolicySoftFailed:\n\t\t\trunURL := fmt.Sprintf(runHeaderErr, b.hostname, b.organization, op.Workspace, r.ID)\n\n\t\t\tif op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||\n\t\t\t\t!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {\n\t\t\t\treturn fmt.Errorf(\"%s soft failed.\\n%s\", msgPrefix, runURL)\n\t\t\t}\n\n\t\t\tif op.AutoApprove {\n\t\t\t\tif _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {\n\t\t\t\t\treturn generalError(fmt.Sprintf(\"Failed to override policy check.\\n%s\", runURL), err)\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\topts := &terraform.InputOpts{\n\t\t\t\t\tId:          \"override\",\n\t\t\t\t\tQuery:       \"\\nDo you want to override the soft failed policy check?\",","sourceCodeStart":425,"sourceCodeEnd":461,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote/backend_common.go#L425-L461","documentation":"In checkPolicy(), when a policy check's status is tfe.PolicyErrored — the policy evaluation itself crashed or could not complete (infrastructure failure in the policy engine), as opposed to a policy failing on merit (that's PolicySoftFailed/HardFailed). The error aborts the run.","triggerScenarios":"checkPolicy() reads a policy check whose pc.Status == tfe.PolicyErrored; e.g. the Sentinel/OPA policy service errored evaluating rules, a policy rule had a runtime error, or the policy backend was unavailable.","commonSituations":"Sentinel/OPA policy with a bug that raises a runtime error; the policy evaluation service was temporarily unavailable; a malformed policy rule uploaded to the org/workspace.","solutions":["Review the streamed policy logs above the error (checkPolicy prints them before the status switch) to find the rule that errored.","Fix or disable the offending policy rule in the HCP/TFE policy set.","Re-run once the policy service is healthy if it was a transient evaluation failure."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isPolicyErrored(s tfe.PolicyStatus) bool {\n    return s == tfe.PolicyErrored\n}","tryCatchPattern":"if err := b.checkPolicy(stopCtx, cancelCtx, op, r); err != nil {\n    if strings.HasSuffix(err.Error(), \"errored.\") {\n        // policy engine error, not a violation -> fix policy infra\n    }\n    return err\n}","preventionTips":["Test policy sets locally (sentinel/opa) before publishing to the org.","Monitor the policy evaluation service health on TFE.","Review streamed policy logs to catch runtime-erroring rules early."],"tags":["policy","run","sentinel"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}