{"record":{"id":"2c9a76d2b5c5507d","repo":"hashicorp/terraform","slug":"acl-value-invalid-expected-s-or-s-got-s","errorCode":null,"errorMessage":"acl value invalid, expected %s or %s, got %s","messagePattern":"acl value invalid, expected (.+?) or (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/backend/remote-state/cos/backend.go","lineNumber":167,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t\treturn nil, nil\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"encrypt\": {\n\t\t\t\tType:        schema.TypeBool,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Whether to enable server side encryption of the state file\",\n\t\t\t\tDefault:     true,\n\t\t\t},\n\t\t\t\"acl\": {\n\t\t\t\tType:        schema.TypeString,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Object ACL to be applied to the state file\",\n\t\t\t\tDefault:     \"private\",\n\t\t\t\tValidateFunc: func(v interface{}, s string) ([]string, []error) {\n\t\t\t\t\tvalue := v.(string)\n\t\t\t\t\tif value != \"private\" && value != \"public-read\" {\n\t\t\t\t\t\treturn nil, []error{fmt.Errorf(\n\t\t\t\t\t\t\t\"acl value invalid, expected %s or %s, got %s\",\n\t\t\t\t\t\t\t\"private\", \"public-read\", value)}\n\t\t\t\t\t}\n\t\t\t\t\treturn nil, nil\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"accelerate\": {\n\t\t\t\tType:        schema.TypeBool,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Whether to enable global Acceleration\",\n\t\t\t\tDefault:     false,\n\t\t\t},\n\t\t\t\"assume_role\": {\n\t\t\t\tType:        schema.TypeSet,\n\t\t\t\tOptional:    true,\n\t\t\t\tMaxItems:    1,\n\t\t\t\tDescription: \"The `assume_role` block. If provided, terraform will attempt to assume this role using the supplied credentials.\",\n\t\t\t\tElem: &schema.Resource{","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/cos/backend.go#L149-L185","documentation":"ValidateFunc for the cos backend's `acl` attribute (cos/backend.go:167). Only 'private' and 'public-read' are accepted; any other ACL string fails validation. State files contain secrets, so 'private' is the safe default.","triggerScenarios":"Setting acl to anything other than 'private' or 'public-read' (e.g. 'public-read-write', 'bucket-owner-full-control') in the backend block.","commonSituations":"Carrying over an S3-style ACL value; assuming full AWS S3 ACL names are supported; accidentally exposing state with a public ACL.","solutions":["Set acl = \"private\" (the default and recommended value for state).","Use acl = \"public-read\" only if you have a specific reason and understand state exposure.","Do not use S3-only ACL names; COS supports a narrower set."],"exampleFix":"// before\nterraform {\n  backend \"cos\" {\n    acl = \"public-read-write\"\n  }\n}\n// after\nterraform {\n  backend \"cos\" {\n    acl = \"private\"\n  }\n}","handlingStrategy":"validation","validationCode":"// Validate the cos acl value before passing it to the backend\nfunc validACL(v string) error {\n    if v != \"private\" && v != \"public-read\" {\n        return fmt.Errorf(\"acl must be 'private' or 'public-read', got %q\", v)\n    }\n    return nil\n}","typeGuard":"// isSupportedCosACL narrows a string to an allowed COS ACL\nfunc isSupportedCosACL(v string) bool {\n    return v == \"private\" || v == \"public-read\"\n}","tryCatchPattern":null,"preventionTips":["Default to 'private' for state - it contains secrets.","Do not assume S3 ACL names map 1:1 to COS.","Review ACL in code review when sharing backend configs."],"tags":["cos","tencentcloud","validation","config","acl","security"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}