{"record":{"id":"e171ced9f2c07bc0","repo":"hashicorp/terraform","slug":"a-network-issue-prevented-cloud-configuration-w","errorCode":null,"errorMessage":"a network issue prevented cloud configuration; %w","messagePattern":"a network issue prevented cloud configuration; %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend.go","lineNumber":278,"sourceCode":"\t// We want to handle errors from URL normalization and service discovery in\n\t// the same way. So we only perform each step if there wasn't a previous\n\t// error, and use the same block to handle errors from anywhere in the\n\t// process.\n\thostname, err := svchost.ForComparison(b.Hostname)\n\tif err == nil {\n\t\thost, err = b.services.Discover(hostname)\n\n\t\tif err == nil {\n\t\t\t// The discovery request worked, so cache the full results.\n\t\t\tb.ServicesHost = host\n\n\t\t\t// Find the TFE API service URL\n\t\t\ttfcService, err = host.ServiceURL(tfeServiceID)\n\t\t} else {\n\t\t\t// Network errors from Discover() can read like non-sequiters, so we wrap em.\n\t\t\tvar serviceDiscoErr *disco.ErrServiceDiscoveryNetworkRequest\n\t\t\tif errors.As(err, &serviceDiscoErr) {\n\t\t\t\terr = fmt.Errorf(\"a network issue prevented cloud configuration; %w\", err)\n\t\t\t}\n\t\t}\n\t}\n\n\t// Handle any errors from URL normalization and service discovery before we continue.\n\tif err != nil {\n\t\tdiags = diags.Append(tfdiags.AttributeValue(\n\t\t\ttfdiags.Error,\n\t\t\tstrings.ToUpper(err.Error()[:1])+err.Error()[1:],\n\t\t\t\"\", // no description is needed here, the error is clear\n\t\t\tcty.Path{cty.GetAttrStep{Name: \"hostname\"}},\n\t\t))\n\t\treturn diags\n\t}\n\n\t// Token time. First, see if the configuration had one:\n\ttoken := config.token\n","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend.go#L260-L296","documentation":"Returned in backend Configure at backend.go:278 when service discovery (b.services.Discover) returns an error matching disco.ErrServiceDiscoveryNetworkRequest via errors.As. The original network error is wrapped with %w so callers can still inspect it. It fires before any token logic, specifically when the HCP Terraform / Terraform Enterprise hostname cannot be contacted.","triggerScenarios":"terraform init / terraform plan with a cloud backend whose hostname is unreachable: DNS failure, TCP refused, TLS handshake failure, or a corporate proxy blocking the discovery request.","commonSituations":"Wrong hostname in the cloud block; on-prem TFE offline or behind a VPN not connected; corporate proxy/firewall blocking app.terraform.io; transient ISP/DNS outage; typo like 'app.terraform.io ' with trailing space.","solutions":["Verify the hostname in the cloud block resolves and is reachable: curl -v https://<host>.","Connect to the VPN or network required to reach your TFE install.","Configure HTTPS_PROXY / TF_PROXY for corporate proxies and retry.","Check DNS and retry if the failure is transient."],"exampleFix":"// before\ncloud { hostname = \"app.terraform.io \" organization = \"acme\" } // trailing space / unreachable\n\n// after\ncloud { hostname = \"app.terraform.io\" organization = \"acme\" }","handlingStrategy":"retry","validationCode":"// Reachability check before terraform init.\nfunc cloudReachable(host string) error {\n    u := \"https://\" + host + \"/.well-known/terraform.json\"\n    resp, err := http.Get(u) // use configured client/proxy in production\n    if err != nil { return err }\n    defer resp.Body.Close()\n    return nil\n}","typeGuard":"// Narrow the wrapped network error.\nvar discoNet *disco.ErrServiceDiscoveryNetworkRequest\nif errors.As(err, &discoNet) { /* network issue */ }","tryCatchPattern":"// Retry backend Configure on network discovery errors.\nfor i := 0; i < 5; i++ {\n    diags := b.Configure(ctx)\n    if !diags.HasErrors() { break }\n    if !isNetworkDiscoveryErr(diags.Err()) { return diags }\n    time.Sleep(backoff(i))\n}","preventionTips":["Set HTTPS_PROXY/TF_PROXY behind corporate firewalls.","Validate hostname with curl before running terraform init.","Connect VPN first for on-prem TFE."],"tags":["terraform","cloud-backend","network","service-discovery","tfe"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}