hashicorp/terraform · error

failed to load state: %w

Error message

failed to load state: %w

What it means

When an output has no DetailedType (state written by Terraform < 1.3.0), GetRootOutputValues falls back to reading the entire state file, which requires higher authorization. This wraps a failure of that RefreshState() fallback.

Source

Thrown at internal/cloud/state.go:586

			return nil, fmt.Errorf("current outputs were not ready to be read within the deadline. Please try again")
		case context.Canceled:
			return nil, fmt.Errorf("canceled reading current outputs")
		}
		return nil, fmt.Errorf("could not read state version outputs: %w", err)
	}

	result := make(map[string]*states.OutputValue)

	for _, output := range so.Items {
		if output.DetailedType == nil {
			// If there is no detailed type information available, this state was probably created
			// with a version of terraform < 1.3.0. In this case, we'll eject completely from this
			// function and fall back to the old behavior of reading the entire state file, which
			// requires a higher level of authorization.
			log.Printf("[DEBUG] falling back to reading full state")

			if err := s.RefreshState(); err != nil {
				return nil, fmt.Errorf("failed to load state: %w", err)
			}

			state := s.State()
			if state == nil {
				// We know that there is supposed to be state (and this is not simply a new workspace
				// without state) because the fallback is only invoked when outputs are present but
				// detailed types are not available.
				return nil, ErrStateVersionUnauthorizedUpgradeState
			}

			return state.RootOutputValues, nil
		}

		if output.Sensitive {
			// Since this is a sensitive value, the output must be requested explicitly in order to
			// read its value, which is assumed to be present by callers
			sensitiveOutput, err := s.tfeClient.StateVersionOutputs.Read(ctx, output.ID)
			if err != nil {

View on GitHub (pinned to c9def3e214)

Solutions

1. Upgrade the state: run an apply/refresh with Terraform >= 1.3 to rewrite state with detailed output types.
2. Grant the token permission to read the full state.
3. Re-run after the upgrade so the fallback path is no longer needed.

Example fix

# before: legacy state from TF < 1.3 + token without full-state read -> failed to load state
# after: upgrade state format, then read outputs
terraform apply    # rewrite state with detailed output types (TF >= 1.3)
terraform output

// Detect legacy state lacking detailed output types and upgrade proactively
sv, err := client.StateVersions.ReadCurrent(ctx, workspace.ID)
if err == nil && sv != nil {
    // require TF >= 1.3 to have written detailed types; otherwise plan an upgrade apply
}

outs, err := state.GetRootOutputValues(ctx)
if err != nil {
    if errors.Is(err, cloud.ErrStateVersionUnauthorizedUpgradeState) {
        // upgrade state with TF >= 1.3 then retry
    }
    return err
}

When it happens

Trigger: Legacy state lacking detailed output types, and the full-state refresh (which needs elevated read authorization) fails.

Common situations: Old workspaces never upgraded to the modern state format, or a token without full-state-read permission against legacy state.

Related errors

• error retrieving state: %v
• sasToken cannot be empty
• unable to build authorizer for Storage API: %+v
• unable to build authorizer for Resource Manager API: %+v
• subscription id not specified

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/54c2100889e75fbc. Report an issue: GitHub.