hashicorp/terraform · error

%s soft failed. %s

Error message

%s soft failed.
%s

What it means

checkPolicy (backend_common.go:401) returns this for tfe.PolicySoftFailed when override is NOT possible in the current context. Soft-fail policies are overridable in principle, but the branch at backend_common.go:399-401 returns early (with the run URL) when ANY of: it's a plan operation (no override at plan time), there's no UI output, no UI input, the policy isn't IsOverridable, or the token lacks CanOverride permission. So this message means 'soft-failed AND you cannot override from here'.

Source

Thrown at internal/cloud/backend_common.go:401

			}
		}

		switch pc.Status {
		case tfe.PolicyPasses:
			if (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {
				b.CLI.Output("\n------------------------------------------------------------------------")
			}
			continue
		case tfe.PolicyErrored:
			return fmt.Errorf("%s errored.", msgPrefix)
		case tfe.PolicyHardFailed:
			return fmt.Errorf("%s hard failed.", msgPrefix)
		case tfe.PolicySoftFailed:
			runURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)

			if op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||
				!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {
				return fmt.Errorf("%s soft failed.\n%s", msgPrefix, runURL)
			}

			if op.AutoApprove {
				if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
					return b.generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
				}
			} else if !b.input {
				return errPolicyOverrideNeedsUIConfirmation
			} else {
				opts := &terraform.InputOpts{
					Id:          "override",
					Query:       "\nDo you want to override the soft failed policy check?",
					Description: "Only 'override' will be accepted to override.",
				}
				err = b.confirm(stopCtx, op, opts, r, "override")
				if err != nil && err != errRunOverridden {
					return fmt.Errorf("Failed to override: %w\n%s\n", err, runURL)
				}

View on GitHub (pinned to c9def3e214)

Solutions

  1. If running locally and permitted, run `terraform apply` (apply-time) where the interactive override prompt is available, and type the override keyword.
  2. Grant the token's team the 'Can Override Soft Policy' permission in HCP/TFE.
  3. Override the run directly in the HCP/TFE UI via the appended run URL.
  4. If automating, use -auto-approve with a token that has override permission so PolicyChecks.Override fires automatically (backend_common.go:404-407).

Example fix

// before: CI run, no UI, soft-mandatory policy
// -> Organization Policy Check soft failed. <run URL>
// after: grant override permission + use -auto-approve
terraform apply -auto-approve   # token team has CanOverride
Defensive patterns

Strategy: validation

Validate before calling

// Decide override capability before the run starts.
func canOverrideSoftFail(op *backendrun.Operation, pc *tfe.PolicyCheck) bool {
    return op.Type != backendrun.OperationTypePlan &&
        op.UIOut != nil && op.UIIn != nil &&
        pc.Actions.IsOverridable && pc.Permissions.CanOverride
}

Try / catch

// On soft-fail where override isn't available, route to the UI.
if pc.Status == tfe.PolicySoftFailed && !canOverrideSoftFail(op, pc) {
    return fmt.Errorf("soft failed; override via run URL: %s", runURL)
}

Prevention

When it happens

Trigger: pc.Status == tfe.PolicySoftFailed AND (op.Type == OperationTypePlan OR op.UIOut == nil OR op.UIIn == nil OR !pc.Actions.IsOverridable OR !pc.Permissions.CanOverride). The run URL is appended so the user can act in the UI.

Common situations: Running `terraform plan` against a workspace with a soft-mandatory policy (plan-time cannot override). Running in CI/automation with no interactive UI (op.UIIn nil) so the prompt can't be shown. Token's team lacks CanOverride permission. Policy configured as soft but not flagged overridable.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/3ed6555f4002ca15. Report an issue: GitHub.