What causes "overridden using the UI or API" in hashicorp/terraform?

No further CLI override action needed — the run is already overridden; let it proceed.

hashicorp/terraform · info · errRunOverridden

overridden using the UI or API

Error message

overridden using the UI or API

What it means

errRunOverridden is a sentinel returned by confirm() when handling the 'override' keyword (soft-failed policy check) and the run is overridden externally via the UI/API while the CLI waited for input. Callers like backend_taskStages.go:202 and backend_common.go:417,421 test for it explicitly so the override path does not double-apply or report a spurious failure.

Source

Thrown at internal/cloud/errors.go:21

package cloud

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Only one of workspace \"tags\" or \"name\" is allowed.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},

View on GitHub (pinned to c9def3e214)

Solutions

No further CLI override action needed — the run is already overridden; let it proceed.
If unexpected, audit who overrode the policy via the HCP Terraform run audit log.

Defensive patterns

Strategy: try-catch

Try / catch

// errRunOverridden: policy was overridden externally; let the run continue.
err := b.confirm(ctx, op, opts, run, "override")
if err != nil && (errors.Is(err, cloud.ErrRunOverridden) || strings.Contains(err.Error(), "overridden using the UI or API")) {
    // already overridden out-of-band; proceed
    return nil
}

Prevention

Centralize policy overrides through one channel to avoid concurrent override races.
Audit Sentinel override events in the HCP Terraform audit log.
If overriding is routine, pass -auto-approve rather than relying on manual UI steps.

When it happens

Trigger: Cloud.confirm (backend_common.go:467-472) for the 'override' keyword: when Status leaves RunPolicyOverride/RunPostPlanAwaitingDecision and is not Discarded, errRunOverridden is returned. Triggered during soft-policy-override confirmation.

Common situations: A soft-failed Sentinel policy needs overriding; while the CLI prompt 'Do you want to override the soft failed policy check?' is open, an operator clicks Override in the UI or calls PolicyChecks.Override via API.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c1392b36245d4012. Report an issue: GitHub.