{"record":{"id":"ea9777d6c9876fba","repo":"hashicorp/terraform","slug":"errstateversionunauthorizedupgradestate","errorCode":"ErrStateVersionUnauthorizedUpgradeState","errorMessage":"You are not authorized to read the full state version containing outputs.\nState versions created by terraform v1.3.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version.","messagePattern":"You are not authorized to read the full state version containing outputs\\.\nState versions created by terraform v1\\.3\\.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/state.go","lineNumber":81,"sourceCode":"\tworkspace            *tfe.Workspace\n\tstateUploadErr       bool\n\tforcePush            bool\n\tlockInfo             *statemgr.LockInfo\n\n\t// The server can optionally return an X-Terraform-Snapshot-Interval header\n\t// in its response to the \"Create State Version\" operation, which specifies\n\t// a number of seconds the server would prefer us to wait before trying\n\t// to write a new snapshot. If this is non-zero then we'll wait at least\n\t// this long before allowing another intermediate snapshot. This does\n\t// not effect final snapshots after an operation, which will always\n\t// be written to the remote API.\n\tstateSnapshotInterval time.Duration\n\t// If the header X-Terraform-Snapshot-Interval is present then\n\t// we will enable snapshots\n\tenableIntermediateSnapshots bool\n}\n\nvar ErrStateVersionUnauthorizedUpgradeState = errors.New(strings.TrimSpace(`\nYou are not authorized to read the full state version containing outputs.\nState versions created by terraform v1.3.0 and newer do not require this level\nof authorization and therefore this error can usually be fixed by upgrading the\nremote state version.\n`))\n\nvar _ statemgr.Full = (*State)(nil)\nvar _ statemgr.Migrator = (*State)(nil)\nvar _ statemgr.IntermediateStateConditionalPersister = (*State)(nil)\n\n// statemgr.Reader impl.\nfunc (s *State) State() *states.State {\n\ts.mu.Lock()\n\tdefer s.mu.Unlock()\n\n\treturn s.state.DeepCopy()\n}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/cloud/state.go#L63-L99","documentation":"Returned at state.go:594 when the cloud state manager tries to read output values but falls back to reading the full state (because the state version lacks DetailedType, indicating it was created by terraform < 1.3.0), and the refreshed state is nil. A nil state at this point means the user lacks authorization to read the full state version. Terraform 1.3.0+ stores output type information so full-state reads are unnecessary, hence the upgrade advice.","triggerScenarios":"A cloud-backed workspace has state created by terraform < 1.3.0 (no DetailedType on outputs). The code at state.go:578-583 detects missing DetailedType, calls RefreshState() to read the full state, but state.go:590 finds state == nil because the API token/user lacks 'read full state' permissions. Returns ErrStateVersionUnauthorizedUpgradeState.","commonSituations":"A workspace that has been running terraform since before v1.3.0 and was never upgraded; a service account or team with limited permissions (no 'State Version Access: Read' for full state); migrating a legacy workspace to TFC without upgrading the state format.","solutions":["Upgrade the workspace's terraform version to 1.3.0 or newer and run a successful apply to regenerate state with detailed output types.","Grant the API token or user 'Read' access to full state versions in the TFC/TFE workspace permissions.","Run 'terraform refresh' or 'terraform apply' with a newer terraform binary to upgrade the state format.","If using a service account, ensure its team has the appropriate state access level."],"exampleFix":"// before: state created with terraform < 1.3.0, token lacks full-state read\n// error: You are not authorized to read the full state version...\n\n// after: upgrade terraform and apply to regenerate state\nterraform version  # ensure >= 1.3.0\nterraform apply    # regenerates state with detailed output types\n// OR grant 'State Version Access: Read' in TFC workspace settings","handlingStrategy":"validation","validationCode":"// Before reading outputs, check terraform version compatibility:\n// if terraformVersion < 1.3.0 {\n//     log.Warn(\"upgrade to terraform >= 1.3.0 to avoid full-state read requirements\")\n// }\n// Ensure the API token has 'State Version Access: Read' permission","typeGuard":null,"tryCatchPattern":"// if errors.Is(err, cloud.ErrStateVersionUnauthorizedUpgradeState) {\n//     return fmt.Errorf(\"upgrade terraform to >= 1.3.0 or grant state read access: %w\", err)\n// }","preventionTips":["Upgrade all workspaces to terraform >= 1.3.0 and apply once to regenerate state.","Grant service accounts 'Read' access to state versions in TFC workspace settings.","Monitor for workspaces with legacy state formats during terraform version migrations."],"tags":["terraform","cloud","state","permissions","version-upgrade","outputs"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}