hashicorp/terraform · error

could not read state version output %s: %w

Error message

could not read state version output %s: %w

What it means

For each sensitive output Terraform must do an explicit StateVersionOutputs.Read(output.ID) to fetch the actual value. This wraps a failure of that per-output read for a sensitive output.

Source

Thrown at internal/cloud/state.go:605

			}

			state := s.State()
			if state == nil {
				// We know that there is supposed to be state (and this is not simply a new workspace
				// without state) because the fallback is only invoked when outputs are present but
				// detailed types are not available.
				return nil, ErrStateVersionUnauthorizedUpgradeState
			}

			return state.RootOutputValues, nil
		}

		if output.Sensitive {
			// Since this is a sensitive value, the output must be requested explicitly in order to
			// read its value, which is assumed to be present by callers
			sensitiveOutput, err := s.tfeClient.StateVersionOutputs.Read(ctx, output.ID)
			if err != nil {
				return nil, fmt.Errorf("could not read state version output %s: %w", output.ID, err)
			}
			output.Value = sensitiveOutput.Value
		}

		cval, err := tfeOutputToCtyValue(*output)
		if err != nil {
			return nil, fmt.Errorf("could not decode output %s (ID %s)", output.Name, output.ID)
		}

		result[output.Name] = &states.OutputValue{
			Value:     cval,
			Sensitive: output.Sensitive,
		}
	}

	return result, nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Ensure the token can read sensitive output values.
2. Retry on a transient network error.
3. Confirm the output still exists in the latest state version.

Example fix

# before: token cannot read sensitive outputs -> could not read state version output <id>
# after: grant sensitive-output read scope / re-login, then retry
terraform login app.terraform.io
terraform output sensitive_value

outs, err := state.GetRootOutputValues(ctx)
if err != nil && strings.Contains(err.Error(), "could not read state version output") {
    if isTransientHTTP(err) {
        // bounded retry of GetRootOutputValues
    }
}

When it happens

Trigger: Reading a workspace whose outputs include sensitive values, and the explicit read of one output's value fails (auth, network, or the output was removed concurrently).

Common situations: Token lacks permission to read sensitive output values, a network blip on a specific output request, or the output was deleted between listing and reading.

Related errors

• could not read state version outputs: %w
• error retrieving state: %v
• You are not authorized to read the full state version contai
• sasToken cannot be empty
• unable to build authorizer for Storage API: %+v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9213e71ae39339f2. Report an issue: GitHub.