hashicorp/terraform · error · errApplyNeedsUIConfirmation

Cannot confirm apply due to -input=false. Please handle run

Error message

Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.

What it means

errApplyNeedsUIConfirmation is returned when a cloud run reaches the apply-confirmation step but the CLI cannot prompt the user because -input=false was set and -auto-approve was not. Defined in errors.go:22, returned at backend_apply.go:174 when mustConfirm && !b.input. Terraform refuses to silently apply; it directs the user to confirm in the HCP Terraform UI.

Source

Thrown at internal/cloud/errors.go:22

package cloud

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Only one of workspace \"tags\" or \"name\" is allowed.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

View on GitHub (pinned to c9def3e214)

Solutions

1. Add -auto-approve to the command so Terraform confirms the apply programmatically: 'terraform apply -auto-approve'.
2. Or open the run URL printed by Terraform and click Confirm in the HCP Terraform UI.
3. Remove -input=false if an interactive prompt is acceptable in your shell.

Example fix

# before
$ terraform apply -input=false
# after
$ terraform apply -auto-approve

// Before running apply against the cloud backend, resolve the input/approval combo.
func applyArgs(inputEnabled, autoApprove bool) []string {
    args := []string{"apply"}
    if !inputEnabled {
        // -input=false requires -auto-approve or the run must be confirmed in the UI
        if !autoApprove {
            log.Println("WARNING: apply -input=false without -auto-approve forces UI confirmation")
        }
        args = append(args, "-input=false")
    }
    if autoApprove {
        args = append(args, "-auto-approve")
    }
    return args
}

When it happens

Trigger: backend_apply.go:154-174: mustConfirm is true (UIIn/UIOut present, not AutoApprove), b.input is false (-input=false). The run is created and planned but apply is not auto-triggered; the error is returned so the operator confirms in the UI.

Common situations: Running 'terraform apply -input=false' (common in restricted CI shells) against the cloud backend without -auto-approve; a wrapper script that disables prompts but expects manual UI confirmation.

Related errors

• Cannot override soft failed policy checks when -input=false.
• Apply discarded.
• approved using the UI or API
• execution halted
• Apply discarded.

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/624bb9091ff7050d. Report an issue: GitHub.