{"record":{"id":"71f373a0e037482a","repo":"hashicorp/terraform","slug":"q-must-be-a-valid-acl-value-expected-s-s-or","errorCode":null,"errorMessage":"%q must be a valid ACL value , expected %s, %s or %s, got %q","messagePattern":"%q must be a valid ACL value , expected (.+?), (.+?) or (.+?), got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oss/backend.go","lineNumber":209,"sourceCode":"\t\t\t},\n\n\t\t\t\"encrypt\": {\n\t\t\t\tType:        schema.TypeBool,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Whether to enable server side encryption of the state file\",\n\t\t\t\tDefault:     false,\n\t\t\t},\n\n\t\t\t\"acl\": {\n\t\t\t\tType:        schema.TypeString,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"Object ACL to be applied to the state file\",\n\t\t\t\tDefault:     \"\",\n\t\t\t\tValidateFunc: func(v interface{}, k string) ([]string, []error) {\n\t\t\t\t\tif value := v.(string); value != \"\" {\n\t\t\t\t\t\tacls := oss.ACLType(value)\n\t\t\t\t\t\tif acls != oss.ACLPrivate && acls != oss.ACLPublicRead && acls != oss.ACLPublicReadWrite {\n\t\t\t\t\t\t\treturn nil, []error{fmt.Errorf(\n\t\t\t\t\t\t\t\t\"%q must be a valid ACL value , expected %s, %s or %s, got %q\",\n\t\t\t\t\t\t\t\tk, oss.ACLPrivate, oss.ACLPublicRead, oss.ACLPublicReadWrite, acls)}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\treturn nil, nil\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"shared_credentials_file\": {\n\t\t\t\tType:        schema.TypeString,\n\t\t\t\tOptional:    true,\n\t\t\t\tDefaultFunc: schema.MultiEnvDefaultFunc([]string{\"ALICLOUD_SHARED_CREDENTIALS_FILE\", \"ALIBABA_CLOUD_CREDENTIALS_FILE\"}, \"\"),\n\t\t\t\tDescription: \"This is the path to the shared credentials file. If this is not set and a profile is specified, `~/.aliyun/config.json` will be used.\",\n\t\t\t},\n\t\t\t\"profile\": {\n\t\t\t\tType:        schema.TypeString,\n\t\t\t\tOptional:    true,\n\t\t\t\tDescription: \"This is the Alibaba Cloud profile name as set in the shared credentials file. It can also be sourced from the `ALICLOUD_PROFILE` environment variable.\",\n\t\t\t\tDefaultFunc: schema.MultiEnvDefaultFunc([]string{\"ALICLOUD_PROFILE\", \"ALIBABA_CLOUD_PROFILE\"}, \"\"),","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/oss/backend.go#L191-L227","documentation":"Returned by the ValidateFunc of the acl attribute when the provided string is non-empty and is not one of the three supported OSS canned ACLs: private, public-read, public-read-write (oss.ACLPrivate / ACLPublicRead / ACLPublicReadWrite). It is a config-time guard before the OSS client ever applies the ACL.","triggerScenarios":"Setting acl = \"public\" or acl = \"bucket-owner-read\" (an S3-style value) or any typo in the oss backend block. The ValidateFunc compares against the three OSS ACL constants.","commonSituations":"Migrating from the AWS S3 backend and reusing an S3 canned ACL string; typos like \"public_read\" (underscore) or \"publicRead\" (camelCase); setting a custom ACL that OSS does not support.","solutions":["Use exactly one of: private, public-read, public-read-write (hyphenated lowercase).","If you do not need a custom ACL, omit the attribute entirely (default is empty = inherit bucket ACL).","Double-check for underscores or camelCase typos."],"exampleFix":"# before\nacl = \"public_read\"\n\n# after\nacl = \"public-read\"","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"var validOSSACLs = map[string]bool{\n    \"private\": true, \"public-read\": true, \"public-read-write\": true,\n}\nfunc isValidOSSACL(a string) bool { return validOSSACLs[a] }","tryCatchPattern":null,"preventionTips":["Use the exact OSS canned ACL strings (hyphenated lowercase).","Omit acl to inherit bucket ACL.","Do not reuse S3 ACL values."],"tags":["oss","validation","config","acl","backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}