{"record":{"id":"3bce7af8c157a384","repo":"kubernetes/kops","slug":"error-setting-gcs-object-acl-for-gs-s-s-for-s","errorCode":null,"errorMessage":"error setting GCS object ACL for gs://%s/%s for %s as %s: %v","messagePattern":"error setting GCS object ACL for gs://(.+?)/(.+?) for (.+?) as (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go","lineNumber":121,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc (_ *StorageObjectAcl) RenderGCE(t *gce.GCEAPITarget, a, e, changes *StorageObjectAcl) error {\n\tbucket := fi.ValueOf(e.Bucket)\n\tobject := fi.ValueOf(e.Object)\n\tentity := fi.ValueOf(e.Entity)\n\trole := fi.ValueOf(e.Role)\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating GCS object ACL for gs://%s/%s for %s as %s\", bucket, object, entity, role)\n\t} else {\n\t\tklog.V(2).Infof(\"Updating GCS object ACL for gs://%s/%s for %s as %s\", bucket, object, entity, role)\n\t}\n\n\terr := t.Cloud.Storage().Bucket(bucket).Object(object).ACL().Set(context.TODO(), storage.ACLEntity(entity), storage.ACLRole(role))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error setting GCS object ACL for gs://%s/%s for %s as %s: %v\", bucket, object, entity, role, err)\n\t}\n\n\treturn nil\n}\n\n// terraformStorageObjectAcl is the model for a terraform google_storage_object_acl rule\ntype terraformStorageObjectAcl struct {\n\tBucket     string   `cty:\"bucket\"`\n\tObject     string   `cty:\"object\"`\n\tRoleEntity []string `cty:\"role_entity\"`\n}\n\nfunc (_ *StorageObjectAcl) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *StorageObjectAcl) error {\n\tvar roleEntities []string\n\troleEntities = append(roleEntities, fi.ValueOf(e.Role)+\":\"+fi.ValueOf(e.Name))\n\ttf := &terraformStorageObjectAcl{\n\t\tBucket:     fi.ValueOf(e.Bucket),\n\t\tObject:     fi.ValueOf(e.Object),","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go#L103-L139","documentation":"Wrapped error from StorageObjectAcl.RenderGCE when the GCS ACL Set call fails while granting the entity its role on the object. Bucket, object, entity, and role are all included in the message; common causes are an invalid entity string or missing storage.objects.setIamPolicy/acl permission.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:121 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error for the GCS rejection reason","Verify the entity format (e.g. serviceAccount:..., group:...) and that the bucket/object exist","Grant ACL-write permission on the bucket and re-run"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}