How to fix Failed to enqueue cost estimate or Sentinel Policy check in Terraform

Verify your Terraform Enterprise version and check if you recently performed an upgrade, especially on a mounted disk instance. The issue affects v202212-x when upgrading from older versions.

# On your TFE instance, check version
curl http://localhost:8080/_health_check | grep -i version

If you recently upgraded, this is likely the root cause and requires database schema recreation.

Create a support bundle from the Terraform Enterprise console (Settings > Diagnostics > Request support bundle) and examine the tfe-task-worker.stdout file.

Look for errors like:

error running database migrations
database driver: sql: Scan error on column index 0, name 'current_schema': converting NULL to string is unsupported

If you see these database schema errors, the task_worker schema is missing and needs to be created.

Ensure the database service is healthy and all migrations have run.

# For mounted disk instances, restart the application
# This will trigger any pending migrations
sudo systemctl restart tfe

# Or, if using Docker Compose, restart services
docker-compose restart

The task_worker schema will be automatically created during application restart if it's missing.

If using Terraform Enterprise in Docker Compose, ensure the Sentinel worker network is configured correctly.

Check your docker-compose file for:

# Verify the network exists
docker network ls | grep tfe_terraform_isolation

# If missing, create it
docker network create tfe_terraform_isolation

# Or remove the TFE_RUN_PIPELINE_DOCKER_NETWORK setting to use default bridge
# Edit docker-compose and remove or comment out:
# - TFE_RUN_PIPELINE_DOCKER_NETWORK=tfe_terraform_isolation

Then restart the services:

docker-compose down && docker-compose up -d

Check if the Sentinel policy worker service is running and accessible.

# Attempt to connect to Sentinel worker port
curl -v http://127.0.0.1:8000 2>&1 | head -20

# If connection refused, check if the service is running
docker ps | grep sentinel
ps aux | grep sentinel

If the service is not running, restart Terraform Enterprise or the worker containers. If you see "network tfe_terraform_isolation not found", follow Step 4 to fix the Docker network configuration.

If the issue continues after restarting the application and verifying database connectivity, contact HashiCorp Support with:
- Your support bundle (including tfe-task-worker.stdout)
- Terraform Enterprise version
- Deployment type (mounted disk, container, etc.)
- Recent infrastructure or configuration changes

HashiCorp Support can verify database schema creation and provide additional diagnostics.