hashicorp/terraform · error

Unknown or unexpected policy state: %s

Error message

Unknown or unexpected policy state: %s

What it means

The default case of the policy-check status switch (backend_common.go:435). Returned when pc.Status does not match any handled tfe.Policy* constant (Passes, Errored, HardFailed, SoftFailed, plus the early-continue Pending/Queued/Unreachable). Indicates client/server version skew: the server reported a policy lifecycle state the local go-tfe library does not recognize.

Source

Thrown at internal/cloud/backend_common.go:435

				if err != nil && err != errRunOverridden {
					return fmt.Errorf("Failed to override: %w\n%s\n", err, runURL)
				}

				if err != errRunOverridden {
					if _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {
						return b.generalError(fmt.Sprintf("Failed to override policy check.\n%s", runURL), err)
					}
				} else {
					runURL := fmt.Sprintf(runHeader, b.Hostname, b.Organization, op.Workspace, r.ID)
					b.CLI.Output(fmt.Sprintf("The run needs to be manually overridden or discarded.\n%s\n", runURL))
				}
			}

			if b.CLI != nil {
				b.CLI.Output("------------------------------------------------------------------------")
			}
		default:
			return fmt.Errorf("Unknown or unexpected policy state: %s", pc.Status)
		}
	}

	return nil
}

func (b *Cloud) confirm(stopCtx context.Context, op *backendrun.Operation, opts *terraform.InputOpts, r *tfe.Run, keyword string) error {
	doneCtx, cancel := context.WithCancel(stopCtx)
	result := make(chan error, 2)

	go func() {
		// Make sure we cancel doneCtx before we return
		// so the input command is also canceled.
		defer cancel()

		for {
			select {
			case <-doneCtx.Done():

View on GitHub (pinned to c9def3e214)

Solutions

1. Upgrade the local Terraform CLI so its go-tfe dependency knows the new status.
2. Align the TFE server version with a release compatible with your CLI.
3. Report the unknown status string shown in the error if versions are current.

Example fix

// before: stale CLI
// -> Unknown or unexpected policy state: "queued_post_override"
// after: upgrade CLI
terraform version  # then upgrade to latest stable

func knownPolicyStatus(s tfe.PolicyStatus) bool {
    switch s {
    case tfe.PolicyPasses, tfe.PolicyErrored, tfe.PolicyHardFailed,
         tfe.PolicySoftFailed, tfe.PolicyPending, tfe.PolicyQueued, tfe.PolicyUnreachable:
        return true
    }
    return false
}

When it happens

Trigger: After streaming logs, pc.Status is an unrecognized value in the switch at backend_common.go:386-435. The TFE/HCP server is newer than the bundled go-tfe constants.

Common situations: Older Terraform CLI against a newer HCP Terraform / TFE that introduced a new policy status. Unstable/server-side preview features.

Related errors

• Unknown or unexpected cost estimate state: %s
• %s errored.
• %s hard failed.
• %s soft failed. %s
• Failed to override: %w %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/7320662f1181f875. Report an issue: GitHub.