kubernetes/kops · error

write to %s with ACL of unexpected type %T

Error message

write to %s with ACL of unexpected type %T

What it means

When rendering an S3 object, renderTerraformS3 expects the supplied ACL to be either nil or *S3Acl (the only ACL type S3 terraform output understands). Passing any other ACL implementation aborts the render with this error.

Source

Thrown at util/pkg/vfs/memfs.go:290

	if err != nil {
		return fmt.Errorf("reading data: %v", err)
	}

	tfProviderArguments := map[string]string{
		"region": "us-test-1",
	}
	w.EnsureTerraformProvider("aws", tfProviderArguments)

	content, err := w.AddFileBytes("aws_s3_object", name, "content", bytes, false)
	if err != nil {
		return fmt.Errorf("rendering S3 file: %v", err)
	}

	var requestAcl *string
	if acl != nil {
		s3Acl, ok := acl.(*S3Acl)
		if !ok {
			return fmt.Errorf("write to %s with ACL of unexpected type %T", p, acl)
		}
		if s3Acl != nil && s3Acl.RequestACL != nil {
			aclVal := string(*s3Acl.RequestACL)
			requestAcl = &aclVal
		}
	}

	tf := &terraformMemFSFile{
		Bucket:   "testingBucket",
		Key:      p.location,
		Content:  content,
		SSE:      "AES256",
		Acl:      requestAcl,
		Provider: terraformWriter.LiteralTokens("aws", "files"),
	}
	return w.RenderResource("aws_s3_object", name, tf)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pass *vfs.S3Acl (with RequestACL set, e.g. "public-read") when writing to memfs/S3-rendered paths, or pass nil ACL
2. Wrap non-S3 ACLs into S3Acl before calling WriteFile/RenderTerraform on memfs paths
3. If you need other ACL types, update renderTerraformS3 to map them explicitly

Example fix

// before
p.WriteFile(ctx, r, myCustomACL{}) // error: unexpected ACL type
// after
p.WriteFile(ctx, r, &vfs.S3Acl{RequestACL: ptr.To("public-read")})

func aclOK(acl vfs.ACL) bool { return acl == nil || func() bool { _, ok := acl.(*vfs.S3Acl); return ok }() }

func toS3Acl(acl vfs.ACL) (*vfs.S3Acl, bool) { s, ok := acl.(*vfs.S3Acl); return s, ok }

if err := p.RenderTerraform(w, name, data, acl); err != nil {
    if strings.Contains(err.Error(), "ACL of unexpected type") {
        acl = &vfs.S3Acl{} // retry with S3-shaped ACL
    }
    return err
}

When it happens

Trigger: RenderTerraform -> renderTerraformS3 with a non-nil acl parameter whose concrete type is not *vfs.S3Acl (e.g. a custom ACL struct, or a GCS/azure ACL type passed down generically).

Common situations: Generic vfs code paths that attach backend-agnostic ACLs; test code constructing mock ACL types; refactors that changed ACL types without updating memfs.

Related errors

• rendering S3 file: %v
• the %q path is intended for use in tests
• the %q path does not support public ACL
• expected acl to be S3Acl, was %T
• reading data: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ecad2d20d51ba2ee. Report an issue: GitHub.