couldn't read unredacted JSON plan data for cloud run %s; ma

Error message

couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace

What it means

Returned by ShowPlanForRun when fetching the UNREDACTED plan JSON (Plans.ReadJSONOutput) returns 404. Unredacted output requires admin permissions on the workspace, so a 404 here typically means insufficient privilege.

Source

Thrown at internal/cloud/backend_show.go:72

			opts = append(opts, plans.NoChanges)
		}
	default:
		// Bail, we can't use this.
		err = fmt.Errorf("can't display a cloud plan that is currently %s", r.Plan.Status)
		return nil, err
	}

	// Fetch the json plan!
	if redacted {
		jsonBytes, err = readRedactedPlan(ctx, b.client.BaseURL(), b.Token, r.Plan.ID)
	} else {
		jsonBytes, err = b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)
	}
	if err == tfe.ErrResourceNotFound {
		if redacted {
			return nil, fmt.Errorf("couldn't read plan data for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run", runID)
		} else {
			return nil, fmt.Errorf("couldn't read unredacted JSON plan data for cloud run %s; make sure you've run `terraform login` and that you have admin permissions on the workspace", runID)
		}
	} else if err != nil {
		return nil, fmt.Errorf("couldn't read plan data for cloud run %s: %w", runID, err)
	}

	// Format a run header and footer
	header := strings.TrimSpace(fmt.Sprintf(runHeader, b.Hostname, b.Organization, r.Workspace.Name, r.ID))
	footer := strings.TrimSpace(statusFooter(r.Status, r.Actions.IsConfirmable, r.Workspace.Locked))

	out := &cloudplan.RemotePlanJSON{
		JSONBytes: jsonBytes,
		Redacted:  redacted,
		Mode:      mode,
		Qualities: opts,
		RunHeader: header,
		RunFooter: footer,
	}

View on GitHub (pinned to c9def3e214)

Solutions

Use a token belonging to a workspace admin (or request admin access) when viewing unredacted plans.
Fall back to redacted=true viewing if admin access is not available.
Confirm the workspace's team access policy grants admin to the token's team.

Example fix

// before: non-admin token requesting unredacted plan
json, _ := b.ShowPlanForRun(ctx, runID, host, false /*unredacted*/)
// after: use an admin token, or request redacted
adminJSON, _ := b.ShowPlanForRun(ctx, runID, host, false)   // admin token
redactedJSON, _ := b.ShowPlanForRun(ctx, runID, host, true) // safe fallback

Defensive patterns

Strategy: validation

Validate before calling

// Only request unredacted output with an admin token.
if !isAdminToken(b.Token, r.Workspace) {
    return fmt.Errorf("token is not workspace admin; cannot view unredacted plan")
}

Try / catch

jsonBytes, err := b.client.Plans.ReadJSONOutput(ctx, r.Plan.ID)
if errors.Is(err, tfe.ErrResourceNotFound) && !redacted {
    // fall back to redacted view if admin access unavailable
    return b.ShowPlanForRun(ctx, runID, runHostname, true)
}

Prevention

Use an admin-scoped token only when unredacted output is required.
Default to redacted=true and escalate only when needed.
Audit workspace team access to confirm admin roles.

When it happens

Trigger: redacted == false path: Plans.ReadJSONOutput returns tfe.ErrResourceNotFound because the caller is not an admin of the workspace (sensitive values are hidden from non-admins by returning 404).

Common situations: Non-admin team member trying to view an unredacted plan; using a read-only/team token instead of an admin token; showing unredacted plans from a CI service account lacking admin role.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a78932f384d8629c. Report an issue: GitHub.