couldn't read information for cloud run %s; make sure you've

Error message

couldn't read information for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run

What it means

Returned by ShowPlanForRun when Runs.ReadWithOptions returns tfe.ErrResourceNotFound while fetching the run. Terraform interprets a 404 as either not being authenticated or lacking permission to view that run.

Source

Thrown at internal/cloud/backend_show.go:34

// ShowPlanForRun downloads the JSON plan output for the specified cloud run
// (either the redacted or unredacted format, per the caller's request), and
// returns it in a cloudplan.RemotePlanJSON wrapper struct (along with various
// metadata required by terraform show). It's intended for use by the terraform
// show command, in order to format and display a saved cloud plan.
func (b *Cloud) ShowPlanForRun(ctx context.Context, runID, runHostname string, redacted bool) (*cloudplan.RemotePlanJSON, error) {
	var jsonBytes []byte
	mode := plans.NormalMode
	var opts []plans.Quality

	// Bail early if wrong hostname
	if runHostname != b.Hostname {
		return nil, fmt.Errorf("hostname for run (%s) does not match the configured cloud integration (%s)", runHostname, b.Hostname)
	}

	// Get run and plan
	r, err := b.client.Runs.ReadWithOptions(ctx, runID, &tfe.RunReadOptions{Include: []tfe.RunIncludeOpt{tfe.RunPlan, tfe.RunWorkspace}})
	if err == tfe.ErrResourceNotFound {
		return nil, fmt.Errorf("couldn't read information for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run", runID)
	} else if err != nil {
		return nil, fmt.Errorf("couldn't read information for cloud run %s: %w", runID, err)
	}

	// Sort out the run mode
	if r.IsDestroy {
		mode = plans.DestroyMode
	} else if r.RefreshOnly {
		mode = plans.RefreshOnlyMode
	}

	// Check that the plan actually finished
	switch r.Plan.Status {
	case tfe.PlanErrored:
		// Errored plans might still be displayable, but we want to mention it to the renderer.
		opts = append(opts, plans.Errored)
	case tfe.PlanFinished:
		// Good to go, but alert the renderer if it has no changes.

View on GitHub (pinned to c9def3e214)

Solutions

Run `terraform login` (or set TF_TOKEN_<hostname>) and retry.
Verify the run ID is correct and that your user/team has read access to the workspace.
Confirm the run has not been discarded/removed in the HCP/TFE UI.

Example fix

# before: no token / wrong token
terraform show <plan ref run-xxxx>
# after
terraform login app.terraform.io
terraform show <plan ref run-xxxx>

Defensive patterns

Strategy: validation

Validate before calling

// Ensure a token exists and is valid before showing a run.
if b.Token == "" {
    return fmt.Errorf("not logged in; run `terraform login %s`", b.Hostname)
}

Try / catch

r, err := b.client.Runs.ReadWithOptions(ctx, runID, opts)
if errors.Is(err, tfe.ErrResourceNotFound) {
    // prompt re-login or verify permissions, do not treat as transient
}

Prevention

Always `terraform login` before `terraform show` on cloud plans.
Use TF_TOKEN_<hostname> in CI with least-privilege tokens.
Verify run ID spelling and workspace membership.

When it happens

Trigger: Calling `terraform show` with a cloud run ID that does not exist, belongs to another org/workspace, or is inaccessible to the current token; the token is missing/expired so the API returns 404.

Common situations: Forgot to `terraform login`; token expired; run ID typo; run lives in a workspace the user has no read access to; run was discarded/deleted.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9b0b22ed32b1a040. Report an issue: GitHub.