fix: Properly differentiate workspace errors in terraform output

- Add isWorkspaceExistsError helper to check for "already exists" errors
- Fail fast on unexpected errors (network, permission) instead of
  silently falling through to workspace select
- Add tests for both "already exists" and unexpected error cases
- Fix godot linter issue in comment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: osterman

pkg/terraform/output/executor.go

@@ -12,6 +12,7 @@ import (
 	"github.com/samber/lo"
 
 	errUtils "github.com/cloudposse/atmos/errors"
+	"github.com/cloudposse/atmos/pkg/auth"
 	log "github.com/cloudposse/atmos/pkg/logger"
 	"github.com/cloudposse/atmos/pkg/perf"
 	"github.com/cloudposse/atmos/pkg/schema"
@@ -217,6 +218,13 @@ func (e *Executor) GetOutput(
 ) (any, bool, error) {
 	defer perf.Track(atmosConfig, "output.Executor.GetOutput")()
 
+	// Validate authManager type if provided.
+	if authManager != nil {
+		if _, ok := authManager.(auth.AuthManager); !ok {
+			return nil, false, fmt.Errorf("%w: expected auth.AuthManager", errUtils.ErrInvalidAuthManagerType)
+		}
+	}
+
 	stackSlug := fmt.Sprintf("%s-%s", stack, component)
 
 	// Check cache first.

pkg/terraform/output/executor_test.go

@@ -229,7 +229,7 @@ func TestExecutor_ExecuteWithSections_InitError(t *testing.T) {
 	assert.True(t, errors.Is(err, errUtils.ErrTerraformInit), "expected ErrTerraformInit")
 }
 
-func TestExecutor_ExecuteWithSections_WorkspaceNewError(t *testing.T) {
+func TestExecutor_ExecuteWithSections_WorkspaceNewError_AlreadyExists(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
@@ -244,17 +244,44 @@ func TestExecutor_ExecuteWithSections_WorkspaceNewError(t *testing.T) {
 	atmosConfig := validAtmosConfig()
 	sections := validSections()
 
-	// Setup expectations.
+	// Setup expectations - workspace already exists, so it falls back to select.
 	mockRunner.EXPECT().SetEnv(gomock.Any()).Return(nil).AnyTimes()
 	mockRunner.EXPECT().Init(gomock.Any(), gomock.Any()).Return(nil)
-	mockRunner.EXPECT().WorkspaceNew(gomock.Any(), "test-workspace").Return(errors.New("workspace exists"))
+	mockRunner.EXPECT().WorkspaceNew(gomock.Any(), "test-workspace").Return(errors.New("Workspace test-workspace already exists"))
 	mockRunner.EXPECT().WorkspaceSelect(gomock.Any(), "test-workspace").Return(errors.New("select failed"))
 
 	_, err := exec.ExecuteWithSections(atmosConfig, "test-component", "test-stack", sections, nil)
 	require.Error(t, err)
 	assert.True(t, errors.Is(err, errUtils.ErrTerraformWorkspaceOp), "expected ErrTerraformWorkspaceOp")
 }
 
+func TestExecutor_ExecuteWithSections_WorkspaceNewError_Unexpected(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockDescriber := NewMockComponentDescriber(ctrl)
+	mockRunner := NewMockTerraformRunner(ctrl)
+
+	customFactory := func(workdir, executable string) (TerraformRunner, error) {
+		return mockRunner, nil
+	}
+
+	exec := NewExecutor(mockDescriber, WithRunnerFactory(customFactory))
+	atmosConfig := validAtmosConfig()
+	sections := validSections()
+
+	// Setup expectations - unexpected error (network, permission, etc.) should fail fast.
+	mockRunner.EXPECT().SetEnv(gomock.Any()).Return(nil).AnyTimes()
+	mockRunner.EXPECT().Init(gomock.Any(), gomock.Any()).Return(nil)
+	mockRunner.EXPECT().WorkspaceNew(gomock.Any(), "test-workspace").Return(errors.New("network timeout"))
+	// WorkspaceSelect should NOT be called for unexpected errors.
+
+	_, err := exec.ExecuteWithSections(atmosConfig, "test-component", "test-stack", sections, nil)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, errUtils.ErrTerraformWorkspaceOp), "expected ErrTerraformWorkspaceOp")
+	assert.Contains(t, err.Error(), "network timeout")
+}
+
 func TestExecutor_ExecuteWithSections_OutputError(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()

pkg/terraform/output/workspace.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 
 	errUtils "github.com/cloudposse/atmos/errors"
 	log "github.com/cloudposse/atmos/pkg/logger"
@@ -68,11 +69,23 @@ func (m *defaultWorkspaceManager) EnsureWorkspace(
 		return nil
 	}
 
-	// Log the creation failure before attempting select.
-	log.Debug("Workspace creation failed, attempting select", "workspace", workspace, "error", err)
+	// Check if this is a "workspace already exists" error.
+	// terraform-exec doesn't provide typed errors, so we check the error message.
+	// Terraform CLI outputs "Workspace X already exists" when trying to create an existing workspace.
+	if !isWorkspaceExistsError(err) {
+		// This is an unexpected error (network, permission, etc.) - fail fast.
+		log.Debug("Workspace creation failed with unexpected error", "workspace", workspace, "error", err)
+		return wrapErrorWithStderr(
+			errUtils.Build(errUtils.ErrTerraformWorkspaceOp).
+				WithCause(err).
+				WithExplanationf("Failed to create workspace '%s' for %s.", workspace, GetComponentInfo(component, stack)).
+				Err(),
+			stderrCapture,
+		)
+	}
 
 	// Workspace already exists, select it.
-	log.Debug("Selecting existing terraform workspace", "workspace", workspace, "component", component, "stack", stack)
+	log.Debug("Workspace already exists, selecting it", "workspace", workspace, "component", component, "stack", stack)
 
 	if err := runner.WorkspaceSelect(ctx, workspace); err != nil {
 		return wrapErrorWithStderr(
@@ -89,3 +102,14 @@ func (m *defaultWorkspaceManager) EnsureWorkspace(
 	windowsFileDelay()
 	return nil
 }
+
+// isWorkspaceExistsError checks if the error indicates the workspace already exists.
+// Terraform-exec doesn't provide typed errors, so we check the error message.
+// Terraform CLI outputs "Workspace X already exists" when trying to create an existing workspace.
+func isWorkspaceExistsError(err error) bool {
+	if err == nil {
+		return false
+	}
+	errMsg := strings.ToLower(err.Error())
+	return strings.Contains(errMsg, "already exists")
+}