errPolicyOverrideNeedsUIConfirmation

errPolicyOverrideNeedsUIConfirmation

Error message

Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.

What it means

Returned at backend_common.go:409 when a soft policy check fails, the operation is not running with AutoApprove, and interactive input is disabled (!b.input). The backend cannot prompt the user to override the soft policy failure, so it directs them to the TFC/TFE UI to perform the override manually.

Source

Thrown at internal/cloud/errors.go:23

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Only one of workspace \"tags\" or \"name\" is allowed.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

View on GitHub (pinned to d32a084675)

Solutions

Use -auto-approve to automatically override soft-failed policy checks (if permissions allow).
Open the run in the Terraform Cloud UI and click 'Override' on the soft-failed policy check.
Use the TFC API to override the policy check programmatically.
Fix the policy violation in the configuration so the check passes.

Example fix

// before
terraform apply -input=false
// error: Cannot override soft failed policy checks when -input=false

// after (option 1: auto-approve overrides soft failures)
terraform apply -input=false -auto-approve
// after (option 2: override in TFC UI or API)

Defensive patterns

Strategy: validation

Validate before calling

// Before running apply, check if policies might soft-fail:
// if policyEnforced && !canOverride {
//     log.Warn("soft policy may fail; ensure -auto-approve or UI override access")
// }
// Use: terraform apply -input=false -auto-approve

Prevention

Use -auto-approve to allow automatic override of soft policy failures.
Ensure CI service accounts have policy override permissions in TFC.
Review sentinel policy sets to understand which checks can soft-fail.

When it happens

Trigger: Running 'terraform apply -input=false' (without -auto-approve) with a cloud backend where a sentinel/soft policy check fails. backend_common.go:408 checks '!b.input' in the policy soft-failure branch and returns this error instead of prompting for an override decision.

Common situations: CI/CD pipelines with -input=false that encounter soft policy failures; cost-control or compliance sentinel policies that soft-fail and need human override; operators unfamiliar with TFC policy override workflow.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/5922a727bb7f2c61. Report an issue: GitHub.