t8y2/dbx · error

ETCD_INVALID_ACCESS

ETCD_INVALID_ACCESS

Error message

ETCD_INVALID_ACCESS: access must be READ, WRITE, or READWRITE, got %s

What it means

authRolePermission validates the optional 'access' parameter against the exact strings READ, WRITE, or READWRITE (defaults to READWRITE when omitted). Any other value is rejected with the coded error ETCD_INVALID_ACCESS before any etcd API call is made. The v2 API internally maps these to the read/write permission lists.

Source

Thrown at agents/drivers/etcd2-go/auth.go:352

		return nil, err
	}
	if !strings.HasPrefix(key, "/") {
		key = "/" + key
	}
	pattern := v2PermissionPattern(resource, key)

	var accesses []string
	if grant {
		access := strings.ToUpper(stringOrDefault(params, "access", ""))
		switch access {
		case "READ":
			accesses = []string{"read"}
		case "WRITE":
			accesses = []string{"write"}
		case "READWRITE":
			accesses = []string{"read", "write"}
		default:
			return nil, fmt.Errorf("ETCD_INVALID_ACCESS: access must be READ, WRITE, or READWRITE, got %s", access)
		}
	} else {
		accesses = []string{"read", "write"}
	}

	ctx, cancel := s.beginOperation()
	defer s.endOperation(cancel)
	for _, access := range accesses {
		document := v2Role{Role: role}
		direction := v2Permissions{KV: v2RWPermission{}}
		if access == "read" {
			direction.KV.Read = []string{pattern}
		} else {
			direction.KV.Write = []string{pattern}
		}
		if grant {
			document.Grant = &direction
		} else {

View on GitHub (pinned to c0390bff16)

Solutions

1. Send the access value uppercase: READ, WRITE, or READWRITE
2. Map lowercase client input to the accepted uppercase forms before the call
3. Omit the access parameter entirely if READWRITE (the default) is what you want

Example fix

// before
agent.call("auth role grant", map[string]any{"role": "r", "key": "/k", "access": "read"})

// after
access := strings.ToUpper("read") // "READ" | "WRITE" | "READWRITE"
agent.call("auth role grant", map[string]any{"role": "r", "key": "/k", "access": access})

var validAccess = map[string]bool{"READ":true,"WRITE":true,"READWRITE":true}
func validAccessParam(access string) bool { return access == "" || validAccess[access] }

err := grantPermission(role, key, access)
if err != nil && strings.Contains(err.Error(), "ETCD_INVALID_ACCESS") {
    return fmt.Errorf("access %q invalid: use READ, WRITE, or READWRITE", access)
}

When it happens

Trigger: Calling the role permission grant/revoke method (authRolePermission) with access set to something other than 'READ', 'WRITE', or 'READWRITE' — e.g. lowercase 'read', 'rw', or 'readwrite'.

Common situations: Passing lowercase values copied from etcd v2 internals ('read'/'write'); abbreviations like 'rw'; client code building the access string dynamically; confusion between v2 per-string permissions and v3 PermType names.

Understand the failure class

Background: "must be positive", "Invalid value": how libraries reject invalid parameter values (ValueError, ArgumentError, INVALID_PARAMETER_VALUE) — this error's family across 28 libraries.

Related errors

• user is required
• ETCD_WATCH_SCOPE_INVALID
• lease, ttl, and preserveLease cannot be specified together
• ETCD_INVALID_ACCESS
• ETCD_%s_REQUIRED

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/1ca237ba609ae114. Report an issue: GitHub.