{"record":{"id":"308a2c4aa0648481","repo":"apache/rocketmq","slug":"the-actions-can-not-be-any","errorCode":null,"errorMessage":"The actions can not be Any.","messagePattern":"The actions can not be Any\\.","errorType":"validation","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java","lineNumber":253,"sourceCode":"        }\n    }\n\n    private void validate(PolicyEntry entry) {\n        Resource resource = entry.getResource();\n        if (resource == null) {\n            throw new AuthorizationException(\"The resource is null.\");\n        }\n        if (resource.getResourceType() == null) {\n            throw new AuthorizationException(\"The resource type is null.\");\n        }\n        if (resource.getResourcePattern() == null) {\n            throw new AuthorizationException(\"The resource pattern is null.\");\n        }\n        if (CollectionUtils.isEmpty(entry.getActions())) {\n            throw new AuthorizationException(\"The actions is empty.\");\n        }\n        if (entry.getActions().contains(Action.ANY)) {\n            throw new AuthorizationException(\"The actions can not be Any.\");\n        }\n        Environment environment = entry.getEnvironment();\n        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {\n            for (String sourceIp : environment.getSourceIps()) {\n                if (StringUtils.isBlank(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is empty.\");\n                }\n                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is invalid.\");\n                }\n            }\n        }\n        if (entry.getDecision() == null) {\n            throw new AuthorizationException(\"The decision is null or illegal.\");\n        }\n    }\n\n    private <T> CompletableFuture<T> handleException(Exception e) {","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java#L235-L271","documentation":"Thrown by AuthorizationMetadataManagerImpl.validate() when a PolicyEntry's actions list contains Action.ANY. Although ANY exists in the Action enum, stored ACL policies must enumerate concrete actions; the wildcard is only meaningful at evaluation time, not in persisted policy definitions. This mirrors the sibling rule that resources must have a concrete pattern.","triggerScenarios":"Creating or updating an ACL whose policy JSON contains \"actions\":[\"ANY\"] (or Action.ANY added programmatically) via createAcl/updateAcl or the mqadmin acl update path.","commonSituations":"A user migrating from the legacy ACL schema (which allowed permissive wildcard-like entries) tries to express 'all actions' with ANY; tooling or AI-generated ACL JSON uses ANY intending full access.","solutions":["Replace [\"ANY\"] with the explicit list [\"PUB\",\"SUB\"] (add other concrete actions if supported by the resource type)","If the intent is to allow everything for a subject, grant both PUB and SUB explicitly on the desired resource pattern"],"exampleFix":"// before\n{ \"subjects\":[{\"subjectType\":\"User\",\"subjectKey\":\"alice\"}],\n  \"policies\":[{\"resources\":[{\"type\":\"TOPIC\",\"pattern\":\"*\"}],\"actions\":[\"ANY\"],\"decision\":\"ALLOW\"}] }\n\n// after\n{ \"subjects\":[{\"subjectType\":\"User\",\"subjectKey\":\"alice\"}],\n  \"policies\":[{\"resources\":[{\"type\":\"TOPIC\",\"pattern\":\"*\"}],\"actions\":[\"PUB\",\"SUB\"],\"decision\":\"ALLOW\"}] }","handlingStrategy":"validation","validationCode":"boolean actionsAreConcrete(PolicyEntry entry) {\n    return entry.getActions() != null && entry.getActions().stream().noneMatch(a -> a == Action.ANY);\n}","typeGuard":null,"tryCatchPattern":"try {\n    metadataManager.updateAcl(acl).join();\n} catch (AuthorizationException e) {\n    if (e.getMessage().contains(\"Any\")) { /* replace ANY with PUB,SUB and retry */ }\n}","preventionTips":["Never emit Action.ANY in stored policies; expand it to PUB and SUB at build time","Document in team ACL templates that ANY is evaluation-only"],"tags":["auth","authorization","acl","validation","wildcard","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}