couldn't read plan data for cloud run %s; make sure you've r

Error message

couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run

What it means

Returned by ShowPlanForRun when fetching the REDACTED plan JSON (readRedactedPlan) returns tfe.ErrResourceNotFound. For a redacted plan a 404 usually means the token lacks read permission on the workspace rather than the plan literally being absent.

Source

Thrown at internal/cloud/backend_show.go:70

		// Good to go, but alert the renderer if it has no changes.
		if !r.Plan.HasChanges {
			opts = append(opts, plans.NoChanges)
		}
	default:
		// Bail, we can't use this.
		err = fmt.Errorf("can't display a cloud plan that is currently %s", r.Plan.Status)
		return nil, err
	}

	// Fetch the json plan!
	if redacted {
		jsonBytes, err = readRedactedPlan(ctx, b.client.BaseURL(), b.Token, r.Plan.ID)
	} else {
		jsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)
	}
	if err == tfe.ErrResourceNotFound {
		if redacted {
			return nil, fmt.Errorf("couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run", runID)
		} else {
			return nil, fmt.Errorf("couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace", runID)
		}
	} else if err != nil {
		return nil, fmt.Errorf("couldn't read plan data for cloud run %s: %w", runID, err)
	}

	// Format a run header and footer
	header := strings.TrimSpace(fmt.Sprintf(runHeader, b.Hostname, b.Organization, r.Workspace.Name, r.ID))
	footer := strings.TrimSpace(statusFooter(r.Status, r.Actions.IsConfirmable, r.Workspace.Locked))

	out := &cloudplan.RemotePlanJSON{
		JSONBytes: jsonBytes,
		Redacted:  redacted,
		Mode:      mode,
		Qualities: opts,
		RunHeader: header,
		RunFooter: footer,

View on GitHub (pinned to c9def3e214)

Solutions

Run `terraform login` against the correct hostname and ensure the token has read access to the workspace.
Confirm the plan output is still retained (re-run the plan if retention lapsed).
Request read permission on the workspace from an org admin.

Example fix

# before: guest token with no workspace read
terraform show plan-from-run run-xxxx
# after: log in with a token that has workspace read
terraform login app.terraform.io
terraform show plan-from-run run-xxxx

Defensive patterns

Strategy: validation

Validate before calling

if b.Token == "" {
    return fmt.Errorf("not logged in; cannot read redacted plan")
}
if !canReadWorkspace(b.Token, r.Workspace) {
    return fmt.Errorf("token lacks read access to workspace %s", r.Workspace.Name)
}

Try / catch

if err == tfe.ErrResourceNotFound && redacted {
    // treat as permission/login issue, not a hard failure; prompt re-login
}

Prevention

Ensure read access on the workspace before showing redacted plans.
Log in via terraform login before show.
Re-run the plan if output retention may have expired.

When it happens

Trigger: redacted == true path: readRedactedPlan returns 404 because the token cannot read plan output for the workspace, or the plan output was purged.

Common situations: Token has no workspace read access; plan output retention expired; showing a plan from a workspace the user is not a member of; forgot `terraform login`.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/7fedd4ebb1e28a7f. Report an issue: GitHub.