What causes "overridden using the UI or API" in hashicorp/terraform?

No fix needed — the run continues because it was overridden externally.

errRunOverridden

errRunOverridden

Error message

overridden using the UI or API

What it means

A sentinel error set in backend_common.go:471 when the cloud backend's polling goroutine detects a policy override confirmation run is no longer awaiting local input — meaning it was overridden externally via UI/API. Similar to errRunApproved, this is checked at backend_common.go:417 and :421 with 'err != errRunOverridden' to allow the flow to continue when the override happened out-of-band. It signals the run transitioned away from RunPolicyOverride/RunPostPlanAwaitingDecision without being discarded.

Source

Thrown at internal/cloud/errors.go:21

package cloud

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Only one of workspace \"tags\" or \"name\" is allowed.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},

View on GitHub (pinned to d32a084675)

Solutions

No fix needed — the run continues because it was overridden externally.
If you want local-only override control, avoid overriding in the UI during active CLI sessions.
Coordinate policy override decisions across team members.

Defensive patterns

Strategy: try-catch

Try / catch

// Non-fatal — the backend continues when override happens externally.
// if errors.Is(err, cloud.ErrRunOverridden) { /* policy overridden externally, proceed */ }

Prevention

Establish a clear team policy for who overrides soft-failed checks (UI vs CLI).
Use workspace locks during policy-sensitive operations.
Monitor TFC audit logs for external policy overrides.

When it happens

Trigger: During a cloud-backed operation where a soft policy check failed and the CLI is prompting for override confirmation, someone overrides the policy via the TFC/TFE UI or API. The polling loop detects the status change and returns errRunOverridden.

Common situations: A team member overrides a soft-failed policy check in the UI while another operator's CLI session is deciding whether to override locally; automated policy override via API during a CLI-driven run.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/e75d6d1a5758947b. Report an issue: GitHub.