hashicorp/terraform · error

%s hard failed.

Error message

%s hard failed.

What it means

checkPolicy (backend_common.go:394-395) returns this for tfe.PolicyHardFailed. A 'hard failed' policy is a severe failure (e.g. the policy framework could not enforce a mandatory policy at all) that cannot be overridden and blocks the run unconditionally.

Source

Thrown at internal/cloud/backend_common.go:395

					line = append(line, l...)
				}

				if next || len(line) > 0 {
					b.CLI.Output(b.Colorize().Color(string(line)))
				}
			}
		}

		switch pc.Status {
		case tfe.PolicyPasses:
			if (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {
				b.CLI.Output("\n------------------------------------------------------------------------")
			}
			continue
		case tfe.PolicyErrored:
			return fmt.Errorf("%s errored.", msgPrefix)
		case tfe.PolicyHardFailed:
			return fmt.Errorf("%s hard failed.", msgPrefix)
		case tfe.PolicySoftFailed:
			runURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)

			if op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||
				!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {
				return fmt.Errorf("%s soft failed.\n%s", msgPrefix, runURL)
			}

			if op.AutoApprove {
				if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
					return b.generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
				}
			} else if !b.input {
				return errPolicyOverrideNeedsUIConfirmation
			} else {
				opts := &terraform.InputOpts{
					Id:          "override",
					Query:       "\nDo you want to override the soft failed policy check?",

View on GitHub (pinned to c9def3e214)

Solutions

1. Read the streamed policy logs to identify which hard-mandatory rule failed and why.
2. Bring the plan into compliance with the hard-mandatory policy (there is no override path).
3. If the policy is wrong, an admin must modify the policy set's enforcement level in HCP/TFE.
4. Re-run after the configuration satisfies the policy.

// Identify hard-mandatory policies up front so plans are compliant by design.
func hasHardMandatory(policySets []tfe.PolicySet) []string {
    var names []string
    for _, ps := range policySets {
        if ps.EnforcementLevel == "hard-mandatory" { names = append(names, ps.Name) }
    }
    return names
}

When it happens

Trigger: pc.Status == tfe.PolicyHardFailed in the switch at backend_common.go:386. Distinct from PolicySoftFailed (overridable) and PolicyErrored (runtime crash); hard-fail typically means a mandatory/advisory enforcement level was applied and a hard enforcement policy was violated or the enforcement itself broke.

Common situations: A hard-mandatory Sentinel policy was violated and cannot be overridden. Policy service misconfigured to hard-fail. Org governance rule that intentionally blocks.

Related errors

• %s errored.
• %s soft failed. %s
• Failed to override: %w %s
• Unknown or unexpected policy state: %s
• overridden using the UI or API

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/c5b87a51bc5f6ec4. Report an issue: GitHub.