apache/kafka · error · IllegalArgumentException

operation must not be ANY

Error message

operation must not be ANY

What it means

Thrown by the AccessControlEntry constructor when the supplied AclOperation is AclOperation.ANY. ANY is a wildcard valid only in filters (AccessControlEntryFilter) for matching, not in a concrete ACL entry that the broker must store; an actual grant must specify a real operation (READ, WRITE, CREATE, etc.). The IllegalArgumentException guards against persisting an underspecified permission.

Source

Thrown at clients/src/main/java/org/apache/kafka/common/acl/AccessControlEntry.java:44

 */
@InterfaceAudience.Public
public class AccessControlEntry {
    final AccessControlEntryData data;

    /**
     * Create an instance of an access control entry with the provided parameters.
     *
     * @param principal non-null principal
     * @param host non-null host
     * @param operation non-null operation, ANY is not an allowed operation
     * @param permissionType non-null permission type, ANY is not an allowed type
     */
    public AccessControlEntry(String principal, String host, AclOperation operation, AclPermissionType permissionType) {
        Objects.requireNonNull(principal);
        Objects.requireNonNull(host);
        Objects.requireNonNull(operation);
        if (operation == AclOperation.ANY)
            throw new IllegalArgumentException("operation must not be ANY");
        Objects.requireNonNull(permissionType);
        if (permissionType == AclPermissionType.ANY)
            throw new IllegalArgumentException("permissionType must not be ANY");
        this.data = new AccessControlEntryData(principal, host, operation, permissionType);
    }

    /**
     * Return the principal for this entry.
     */
    public String principal() {
        return data.principal();
    }

    /**
     * Return the host or `*` for all hosts.
     */
    public String host() {
        return data.host();

View on GitHub (pinned to c31c9215e1)

Solutions

1. Choose a concrete operation: READ, WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, ALTER_CONFIGS, DESCRIBE_CONFIGS, IDEMPOTENT_WRITE, or ALL.
2. If matching ACLs is the intent, build an AccessControlEntryFilter (which permits ANY) instead of an AccessControlEntry.
3. Validate user input upstream and reject 'ANY' before constructing the ACE, surfacing a domain-specific error.

Example fix

// before
new AccessControlEntry(principal, host, AclOperation.ANY, AclPermissionType.ALLOW);

// after
new AccessControlEntry(principal, host, AclOperation.READ, AclPermissionType.ALLOW);
// or, for matching:
new AccessControlEntryFilter(principal, host, AclOperation.ANY, AclPermissionType.ANY);

// AclOperation.ANY is a wildcard meaningful only for filters, never for a concrete ACE
AclOperation op = /* from config/request */;
if (op == null) { /* reject: null principal operation */ }
if (op == AclOperation.ANY) {
    // pick a concrete operation (READ/WRITE/CREATE/...) or reject the request
}

// Narrow an AclOperation to the subset legal inside an AccessControlEntry
static boolean isConcreteAclOperation(AclOperation op) {
    return op != null && op != AclOperation.ANY;
}

try {
    AccessControlEntry ace = new AccessControlEntry(principal, host, op, perm);
} catch (IllegalArgumentException e) {
    // message is literally "operation must not be ANY"; re-prompt caller/config for a concrete op
}

When it happens

Trigger: Constructing `new AccessControlEntry(principal, host, AclOperation.ANY, permissionType)` directly. Also reached when reusing a filter object's operation() value, or deserializing/building an ACE from user input that defaulted the operation to ANY because none was chosen.

Common situations: UI/CLI exposing an ACL form where the operation dropdown defaults to ANY; copying values from a filter into a createAcls request; helper code that shares a builder between filters and entries; tests that pass ANY as a placeholder.

Related errors

• permissionType must not be ANY
• Not authorized to access topics: ${Set.of(tp.topic())}
• Not authorized to access topics: ${unauthorizedTopics}
• Not authorized to access topics: ${unauthorizedTopics}
• Input string `str` decoded as uuidBytes.remaining() bytes, w

AI-assisted analysis of apache/kafka@c31c9215e1 (2026-08-03). Data as JSON: /data/errors/8ad4212b945d49a8.json. Report an issue: GitHub.