hashicorp/terraform · error · errPolicyOverrideNeedsUIConfirmation

Cannot override soft failed policy checks when -input=false.

Error message

Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.

What it means

errPolicyOverrideNeedsUIConfirmation is returned when a soft-failed Sentinel/OPA policy check is overridable but the CLI cannot prompt for override because -input=false and -auto-approve was not set. Defined in errors.go:23, returned at backend_common.go:409. Terraform will not auto-override policy failures silently; the user must override in the UI.

Source

Thrown at internal/cloud/errors.go:23

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Only one of workspace \"tags\" or \"name\" is allowed.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

View on GitHub (pinned to c9def3e214)

Solutions

If the soft failure is acceptable, re-run with -auto-approve to let Terraform override programmatically: 'terraform apply -auto-approve'.
Or open the run in the HCP Terraform UI and click 'Override' on the soft-failed policy check.
Fix the policy violation in configuration so the check passes, removing the need to override.

Example fix

# before
$ terraform apply -input=false   # policy soft-failed, can't prompt
# after (accept override automatically)
$ terraform apply -auto-approve

Defensive patterns

Strategy: validation

Validate before calling

// Decide upfront whether to auto-override soft policy failures.
func planApplyFlags(allowPolicyOverride, inputEnabled bool) []string {
    args := []string{"apply"}
    if !inputEnabled {
        args = append(args, "-input=false")
    }
    if allowPolicyOverride {
        // -auto-approve lets Terraform auto-override soft-failed policy checks
        args = append(args, "-auto-approve")
    }
    return args
}

Prevention

Use -auto-approve when soft-policy overrides are an accepted part of your pipeline.
Tighten Sentinel policies to hard-fail for cases that must never be overridden.
Monitor policy soft-fail rates and address root causes rather than routinely overriding.

When it happens

Trigger: backend_common.go:404-409: a policy check is overridable and soft-failed; op.AutoApprove is false and b.input is false (-input=false). The error is returned immediately so the operator handles the override in the HCP Terraform UI.

Common situations: A Sentinel policy soft-fails during a CI run with -input=false; the pipeline doesn't pass -auto-approve so Terraform cannot auto-override and asks the operator to use the UI.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/871e22d27d2096aa. Report an issue: GitHub.