{"record":{"id":"56204191b2658b3f","repo":"kubernetes/kops","slug":"error-querying-gcs-object-acl-for-gs-s-s-for","errorCode":null,"errorMessage":"error querying GCS object ACL for gs://%s/%s for %s: %v","messagePattern":"error querying GCS object ACL for gs://(.+?)/(.+?) for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go","lineNumber":62,"sourceCode":"\nfunc (e *StorageObjectAcl) CompareWithID() *string {\n\treturn e.Name\n}\n\nfunc (e *StorageObjectAcl) Find(c *fi.CloudupContext) (*StorageObjectAcl, error) {\n\tcloud := c.T.Cloud.(gce.GCECloud)\n\n\tbucket := fi.ValueOf(e.Bucket)\n\tobject := fi.ValueOf(e.Object)\n\tentity := fi.ValueOf(e.Entity)\n\n\tklog.V(2).Infof(\"Checking GCS object ACL for gs://%s/%s for %s\", bucket, object, entity)\n\trules, err := cloud.Storage().Bucket(bucket).Object(object).ACL().List(context.TODO())\n\tif err != nil {\n\t\tif gce.IsNotFound(err) {\n\t\t\treturn nil, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"error querying GCS object ACL for gs://%s/%s for %s: %v\", bucket, object, entity, err)\n\t}\n\n\tfor _, r := range rules {\n\t\tif string(r.Entity) != entity {\n\t\t\tcontinue\n\t\t}\n\n\t\tfoundEntity := string(r.Entity)\n\t\tfoundRole := string(r.Role)\n\n\t\tactual := &StorageObjectAcl{}\n\t\tactual.Name = e.Name\n\t\tactual.Bucket = e.Bucket\n\t\tactual.Object = e.Object\n\t\tactual.Entity = &foundEntity\n\n\t\tactual.Role = &foundRole\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go#L44-L80","documentation":"Wrapped error from StorageObjectAcl.Find when listing the GCS object's ACL entries fails with a non-404 error. Bucket, object path, and entity are included; typical causes are missing storage.objects.getIamPolicy/acl permission or a nonexistent bucket/object path.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gcetasks/storageobjectacl.go:62 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the bucket and object path in the spec are correct and exist","Grant the service account permission to read object ACLs on the bucket","Inspect the wrapped error and retry if transient"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}