hashicorp/terraform · error
%s hard failed.
Error message
%s hard failed.
What it means
In checkPolicy(), when pc.Status == tfe.PolicyHardFailed. A 'hard' policy failure is a mandatory policy violation that cannot be overridden — the run is blocked and there is no override path, unlike PolicySoftFailed.
Source
Thrown at internal/backend/remote/backend_common.go:445
line = append(line, l...)
}
if next || len(line) > 0 {
b.CLI.Output(b.Colorize().Color(string(line)))
}
}
}
switch pc.Status {
case tfe.PolicyPasses:
if (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {
b.CLI.Output("\n------------------------------------------------------------------------")
}
continue
case tfe.PolicyErrored:
return fmt.Errorf("%s errored.", msgPrefix)
case tfe.PolicyHardFailed:
return fmt.Errorf("%s hard failed.", msgPrefix)
case tfe.PolicySoftFailed:
runURL := fmt.Sprintf(runHeaderErr, b.hostname, b.organization, op.Workspace, r.ID)
if op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||
!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {
return fmt.Errorf("%s soft failed.\n%s", msgPrefix, runURL)
}
if op.AutoApprove {
if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
return generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
}
} else {
opts := &terraform.InputOpts{
Id: "override",
Query: "\nDo you want to override the soft failed policy check?",
Description: "Only 'override' will be accepted to override.",
}View on GitHub (pinned to c9def3e214)
Solutions
- Read the policy logs printed before the error to see exactly which rule failed and why.
- Change the configuration to satisfy the hard-mandatory policy (the only way forward for a hard failure).
- If the policy itself is wrong, ask an org admin to correct or relax the policy's enforcement level.
Defensive patterns
Strategy: try-catch
Type guard
func isHardFailed(s tfe.PolicyStatus) bool {
return s == tfe.PolicyHardFailed
} Try / catch
if err := b.checkPolicy(stopCtx, cancelCtx, op, r); err != nil {
if strings.HasSuffix(err.Error(), "hard failed.") {
// non-overridable -> must fix configuration
}
return err
} Prevention
- Treat hard-mandatory policies as build breakers and fix config immediately.
- Use advisory/soft-mandatory levels where override flexibility is needed.
- Review policy logs to understand exactly which hard rule was violated.
When it happens
Trigger: checkPolicy() finds a policy check with PolicyHardFailed status: a policy marked as hard-mandatory (enforcement level 'hard' / 'advisory' excluded) was violated. No override UI/API path exists for hard failures.
Common situations: Configuration violates an organization-wide hard-mandatory policy (e.g. forbidden provider, required tags, cloud region restrictions); the team cannot bypass it because it's hard-mandatory.
Related errors
AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07).
Data as JSON: /api/errors/f24f611838439678.
Report an issue: GitHub.