hashicorp/terraform · error

Failed to read state file from %v: %v

Error message

Failed to read state file from %v: %v

What it means

After successfully opening the state object reader, Get() does ioutil.ReadAll. If the byte stream read fails partway (network reset mid-download, connection drop, reader error after decryption header), this wraps that read error. The object exists and opened; only the body read failed.

Source

Thrown at internal/backend/remote-state/gcs/client.go:47

	encryptionKey []byte
	kmsKeyName    string
}

func (c *remoteClient) Get() (payload *remote.Payload, diags tfdiags.Diagnostics) {
	ctx := context.TODO()
	stateFileReader, err := c.stateFile().NewReader(ctx)
	if err != nil {
		if err == storage.ErrObjectNotExist {
			return nil, diags
		} else {
			return nil, diags.Append(fmt.Errorf("Failed to open state file at %v: %v", c.stateFileURL(), err))
		}
	}
	defer stateFileReader.Close()

	stateFileContents, err := ioutil.ReadAll(stateFileReader)
	if err != nil {
		return nil, diags.Append(fmt.Errorf("Failed to read state file from %v: %v", c.stateFileURL(), err))
	}

	stateFileAttrs, err := c.stateFile().Attrs(ctx)
	if err != nil {
		return nil, diags.Append(fmt.Errorf("Failed to read state file attrs from %v: %v", c.stateFileURL(), err))
	}

	result := &remote.Payload{
		Data: stateFileContents,
		MD5:  stateFileAttrs.MD5,
	}

	return result, diags
}

func (c *remoteClient) Put(data []byte) tfdiags.Diagnostics {
	var diags tfdiags.Diagnostics
	ctx := context.TODO()

View on GitHub (pinned to c9def3e214)

Solutions

1. Retry the terraform operation (RefreshState is not idempotent-guaranteed but a transient read error usually clears on retry).
2. If persistent, verify object integrity with 'gsutil cp gs://...state .tfstate' and check for read errors.
3. Reduce state size (split resources / use workspaces) if downloads are routinely interrupted.
4. Check for a corrupted object: compare gsutil-stored MD5 against object metadata.

Example fix

# recover (transient)
terraform state pull   # retry
gsutil cp gs://bucket/prefix/default.tfstate /tmp/check.tfstate && md5sum /tmp/check.tfstate

var payload *remote.Payload
for attempt := 0; attempt < 3; attempt++ {
    var diags tfdiags.Diagnostics
    payload, diags = client.Get()
    if !diags.HasErrors() { break }
    time.Sleep(time.Duration(1<<attempt) * time.Second)
}

When it happens

Trigger: Large state file download interrupted by network reset; GCS connection closed mid-stream; decryption of object body failed after headers; transient I/O.

Common situations: Flaky CI network downloading a large tfstate; GCS side throttling; intermittent connectivity to GCS; corrupted object.

Related errors

• Failed to read state file attrs from %v: %v
• Failed to upload state to %v: %v
• storage.NewClient() failed: %v
• querying Cloud Storage failed: %v
• Failed to open state file at %v: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/25bd9ce8e4769a1a. Report an issue: GitHub.