{"record":{"id":"ecad2d20d51ba2ee","repo":"kubernetes/kops","slug":"write-to-s-with-acl-of-unexpected-type-t-ecad2d","errorCode":null,"errorMessage":"write to %s with ACL of unexpected type %T","messagePattern":"write to (.+?) with ACL of unexpected type %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/memfs.go","lineNumber":290,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"reading data: %v\", err)\n\t}\n\n\ttfProviderArguments := map[string]string{\n\t\t\"region\": \"us-test-1\",\n\t}\n\tw.EnsureTerraformProvider(\"aws\", tfProviderArguments)\n\n\tcontent, err := w.AddFileBytes(\"aws_s3_object\", name, \"content\", bytes, false)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"rendering S3 file: %v\", err)\n\t}\n\n\tvar requestAcl *string\n\tif acl != nil {\n\t\ts3Acl, ok := acl.(*S3Acl)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"write to %s with ACL of unexpected type %T\", p, acl)\n\t\t}\n\t\tif s3Acl != nil && s3Acl.RequestACL != nil {\n\t\t\taclVal := string(*s3Acl.RequestACL)\n\t\t\trequestAcl = &aclVal\n\t\t}\n\t}\n\n\ttf := &terraformMemFSFile{\n\t\tBucket:   \"testingBucket\",\n\t\tKey:      p.location,\n\t\tContent:  content,\n\t\tSSE:      \"AES256\",\n\t\tAcl:      requestAcl,\n\t\tProvider: terraformWriter.LiteralTokens(\"aws\", \"files\"),\n\t}\n\treturn w.RenderResource(\"aws_s3_object\", name, tf)\n}\n","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/memfs.go#L272-L308","documentation":"When rendering an S3 object, renderTerraformS3 expects the supplied ACL to be either nil or *S3Acl (the only ACL type S3 terraform output understands). Passing any other ACL implementation aborts the render with this error.","triggerScenarios":"RenderTerraform -> renderTerraformS3 with a non-nil acl parameter whose concrete type is not *vfs.S3Acl (e.g. a custom ACL struct, or a GCS/azure ACL type passed down generically).","commonSituations":"Generic vfs code paths that attach backend-agnostic ACLs; test code constructing mock ACL types; refactors that changed ACL types without updating memfs.","solutions":["Pass *vfs.S3Acl (with RequestACL set, e.g. \"public-read\") when writing to memfs/S3-rendered paths, or pass nil ACL","Wrap non-S3 ACLs into S3Acl before calling WriteFile/RenderTerraform on memfs paths","If you need other ACL types, update renderTerraformS3 to map them explicitly"],"exampleFix":"// before\np.WriteFile(ctx, r, myCustomACL{}) // error: unexpected ACL type\n// after\np.WriteFile(ctx, r, &vfs.S3Acl{RequestACL: ptr.To(\"public-read\")})","handlingStrategy":"type-guard","validationCode":"func aclOK(acl vfs.ACL) bool { return acl == nil || func() bool { _, ok := acl.(*vfs.S3Acl); return ok }() }","typeGuard":"func toS3Acl(acl vfs.ACL) (*vfs.S3Acl, bool) { s, ok := acl.(*vfs.S3Acl); return s, ok }","tryCatchPattern":"if err := p.RenderTerraform(w, name, data, acl); err != nil {\n    if strings.Contains(err.Error(), \"ACL of unexpected type\") {\n        acl = &vfs.S3Acl{} // retry with S3-shaped ACL\n    }\n    return err\n}","preventionTips":["Pass nil or *vfs.S3Acl when writing memfs/S3-rendered paths","Convert backend-agnostic ACLs to S3Acl before rendering","Type-assert ACLs in tests before invoking terraform rendering"],"tags":["vfs","memfs","acl","terraform","s3"],"backgroundTag":"unexpected-acl-type","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}