hashicorp/terraform · error

%s errored.

Error message

%s errored.

What it means

In checkPolicy(), when a policy check's status is tfe.PolicyErrored — the policy evaluation itself crashed or could not complete (infrastructure failure in the policy engine), as opposed to a policy failing on merit (that's PolicySoftFailed/HardFailed). The error aborts the run.

Source

Thrown at internal/backend/remote/backend_common.go:443

						next = false
					}
					line = append(line, l...)
				}

				if next || len(line) > 0 {
					b.CLI.Output(b.Colorize().Color(string(line)))
				}
			}
		}

		switch pc.Status {
		case tfe.PolicyPasses:
			if (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {
				b.CLI.Output("\n------------------------------------------------------------------------")
			}
			continue
		case tfe.PolicyErrored:
			return fmt.Errorf("%s errored.", msgPrefix)
		case tfe.PolicyHardFailed:
			return fmt.Errorf("%s hard failed.", msgPrefix)
		case tfe.PolicySoftFailed:
			runURL := fmt.Sprintf(runHeaderErr, b.hostname, b.organization, op.Workspace, r.ID)

			if op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||
				!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {
				return fmt.Errorf("%s soft failed.\n%s", msgPrefix, runURL)
			}

			if op.AutoApprove {
				if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
					return generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
				}
			} else {
				opts := &terraform.InputOpts{
					Id:          "override",
					Query:       "\nDo you want to override the soft failed policy check?",

View on GitHub (pinned to c9def3e214)

Solutions

1. Review the streamed policy logs above the error (checkPolicy prints them before the status switch) to find the rule that errored.
2. Fix or disable the offending policy rule in the HCP/TFE policy set.
3. Re-run once the policy service is healthy if it was a transient evaluation failure.

func isPolicyErrored(s tfe.PolicyStatus) bool {
    return s == tfe.PolicyErrored
}

if err := b.checkPolicy(stopCtx, cancelCtx, op, r); err != nil {
    if strings.HasSuffix(err.Error(), "errored.") {
        // policy engine error, not a violation -> fix policy infra
    }
    return err
}

When it happens

Trigger: checkPolicy() reads a policy check whose pc.Status == tfe.PolicyErrored; e.g. the Sentinel/OPA policy service errored evaluating rules, a policy rule had a runtime error, or the policy backend was unavailable.

Common situations: Sentinel/OPA policy with a bug that raises a runtime error; the policy evaluation service was temporarily unavailable; a malformed policy rule uploaded to the org/workspace.

Related errors

• %s hard failed.
• %s soft failed. %s
• overridden using the UI or API
• Failed to override: %w %s
• Task Stage '%s': %s.

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c3904c65a18ff44e. Report an issue: GitHub.