hostname for run (%s) does not match the configured cloud in

Error message

hostname for run (%s) does not match the configured cloud integration (%s)

What it means

Returned by Cloud.ShowPlanForRun when the hostname embedded in the run ID/reference (runHostname) does not equal b.Hostname, the cloud integration's configured hostname. The backend refuses to fetch a plan from a different cloud host than the one Terraform is logged into.

Source

Thrown at internal/cloud/backend_show.go:28

	tfe "github.com/hashicorp/go-tfe"
	"github.com/hashicorp/terraform/internal/cloud/cloudplan"
	"github.com/hashicorp/terraform/internal/plans"
)

// ShowPlanForRun downloads the JSON plan output for the specified cloud run
// (either the redacted or unredacted format, per the caller's request), and
// returns it in a cloudplan.RemotePlanJSON wrapper struct (along with various
// metadata required by terraform show). It's intended for use by the terraform
// show command, in order to format and display a saved cloud plan.
func (b *Cloud) ShowPlanForRun(ctx context.Context, runID, runHostname string, redacted bool) (*cloudplan.RemotePlanJSON, error) {
	var jsonBytes []byte
	mode := plans.NormalMode
	var opts []plans.Quality

	// Bail early if wrong hostname
	if runHostname != b.Hostname {
		return nil, fmt.Errorf("hostname for run (%s) does not match the configured cloud integration (%s)", runHostname, b.Hostname)
	}

	// Get run and plan
	r, err := b.client.Runs.ReadWithOptions(ctx, runID, &tfe.RunReadOptions{Include: []tfe.RunIncludeOpt{tfe.RunPlan, tfe.RunWorkspace}})
	if err == tfe.ErrResourceNotFound {
		return nil, fmt.Errorf("couldn't read information for cloud run %s; make sure you've run `terraform login` and that you have permission to view the run", runID)
	} else if err != nil {
		return nil, fmt.Errorf("couldn't read information for cloud run %s: %w", runID, err)
	}

	// Sort out the run mode
	if r.IsDestroy {
		mode = plans.DestroyMode
	} else if r.RefreshOnly {
		mode = plans.RefreshOnlyMode
	}

	// Check that the plan actually finished

View on GitHub (pinned to c9def3e214)

Solutions

Align the cloud backend 'hostname' setting with the hostname of the run you are trying to view.
Re-run `terraform login` against the correct hostname whose run you want to show.
Use the fully-qualified run reference that matches the configured integration.

Example fix

# before
terraform {
  cloud { hostname = "app.terraform.io" organization = "acme" }
}
# trying to show a run from tfe.corp.example.com
# after: point the backend at the run's host
cloud { hostname = "tfe.corp.example.com" organization = "acme" }

Defensive patterns

Strategy: validation

Validate before calling

// Validate hostname match before calling ShowPlanForRun.
if runHostname != b.Hostname {
    return fmt.Errorf("refusing to show run from %s; cloud backend is %s", runHostname, b.Hostname)
}

Type guard

func sameCloudHost(configured, run string) bool {
    return strings.EqualFold(strings.TrimRight(configured, "/"), strings.TrimRight(run, "/"))
}

Prevention

Keep exactly one cloud backend hostname per project root.
Store run references with their hostname and match before display.
Normalize hostnames (strip scheme/trailing slash) when comparing.

When it happens

Trigger: Caller passes a runID/reference whose hostname (e.g. app.terraform.io) differs from the Cloud backend's configured Hostname (e.g. tfe.corp.example.com). Triggered by `terraform show`/`terraform plan` against a plan ref string scoped to another host.

Common situations: Multiple TFE/HCP backends in use; the cloud backend block points at one host while the plan reference was produced by another; hostname typo or trailing slash; SaaS vs self-hosted confusion.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/489034ae718fc3f7. Report an issue: GitHub.