hashicorp/terraform · error

%s errored.

Error message

%s errored.

What it means

checkPolicy (backend_common.go:392-393) returns this when a policy check ends in tfe.PolicyErrored. 'Errored' means the policy evaluation itself crashed or could not complete (e.g. OPA/ Sentinel runtime failure, malformed policy, timeout), distinct from a policy that evaluated and failed.

Source

Thrown at internal/cloud/backend_common.go:393

						next = false
					}
					line = append(line, l...)
				}

				if next || len(line) > 0 {
					b.CLI.Output(b.Colorize().Color(string(line)))
				}
			}
		}

		switch pc.Status {
		case tfe.PolicyPasses:
			if (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {
				b.CLI.Output("\n------------------------------------------------------------------------")
			}
			continue
		case tfe.PolicyErrored:
			return fmt.Errorf("%s errored.", msgPrefix)
		case tfe.PolicyHardFailed:
			return fmt.Errorf("%s hard failed.", msgPrefix)
		case tfe.PolicySoftFailed:
			runURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)

			if op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||
				!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {
				return fmt.Errorf("%s soft failed.\n%s", msgPrefix, runURL)
			}

			if op.AutoApprove {
				if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
					return b.generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
				}
			} else if !b.input {
				return errPolicyOverrideNeedsUIConfirmation
			} else {
				opts := &terraform.InputOpts{

View on GitHub (pinned to c9def3e214)

Solutions

1. Inspect the policy check logs streamed just before this error for the runtime exception.
2. Fix or disable the offending policy in the HCP/TFE policy set.
3. Retry the run after confirming the policy service is healthy.
4. If caused by plan size, scope the plan with -target or split the workspace.

// Pre-validate policy sets compile before relying on them.
// (Perform via HCP/TFE policy set validation tooling.)

// On PolicyErrored, surface logs and abort gracefully.
if pc.Status == tfe.PolicyErrored {
    logPolicyFailure(pc); return structuredPolicyError(err)
}

When it happens

Trigger: After streaming policy logs, pc.Status == tfe.PolicyErrored is hit in the switch at backend_common.go:386. The policy framework failed to execute the rule set, not that a rule failed.

Common situations: Malformed or buggy Sentinel/OPA policy in the org/workspace. Policy execution timeout on a very large plan. Policy server outage on the TFE side. Upgrading policy framework that breaks an existing policy.

Related errors

• %s hard failed.
• %s soft failed. %s
• Failed to override: %w %s
• Unknown or unexpected policy state: %s
• overridden using the UI or API

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/492d238357a0758d. Report an issue: GitHub.