apache/cassandra · error · InvalidRequestException

Resource %s doesn't exist

Error message

Resource %s doesn't exist

What it means

After correcting the resource (e.g. applying the current keyspace when 'ON TABLE t' omits a keyspace), PermissionsManagementStatement.validate() checks resource.exists(). Granting or revoking a permission on a nonexistent keyspace/table/function is rejected with this InvalidRequestException naming the resource.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/PermissionsManagementStatement.java:61

        this.permissions = permissions;
        this.resource = resource;
        this.grantee = RoleResource.role(grantee.getName());
    }

    public void validate(ClientState state) throws RequestValidationException
    {
        // validate login here before authorize to avoid leaking user existence to anonymous users.
        state.ensureNotAnonymous();

        if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))
            throw new InvalidRequestException(String.format("Role %s doesn't exist", grantee.getRoleName()));

        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.
        // called both here and in authorize(), as in some cases we do not call the latter.
        resource = maybeCorrectResource(resource, state);

        if (!resource.exists())
            throw new InvalidRequestException(String.format("Resource %s doesn't exist", resource));
    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.
        resource = maybeCorrectResource(resource, state);

        // check that the user has AUTHORIZE permission on the resource or its parents, otherwise reject GRANT/REVOKE.
        state.ensurePermission(Permission.AUTHORIZE, resource);

        // check that the user has [a single permission or all in case of ALL] on the resource or its parents.
        for (Permission p : permissions)
            state.ensurePermission(p, resource);
    }

    @Override
    public String toString()
    {

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Verify the resource exists (DESCRIBE KEYSPACES / system_schema) and fix the name.
  2. Create the keyspace/table before granting permissions on it.
  3. Check whether the statement relied on USE keyspace resolution and qualify the resource explicitly.

Example fix

-- before
GRANT SELECT ON KEYSPACE prod_data TO analyst; -- keyspace missing
-- after
CREATE KEYSPACE IF NOT EXISTS prod_data WITH replication = {'class':'SimpleStrategy','replication_factor':1};
GRANT SELECT ON KEYSPACE prod_data TO analyst;
Defensive patterns

Strategy: validation

Validate before calling

// verify resource exists before grant
Row r = session.execute("SELECT keyspace_name FROM system_schema.keyspaces WHERE keyspace_name = ?", ks).one();
if (r == null) throw new IllegalStateException("Keyspace " + ks + " does not exist");

Try / catch

try { session.execute(grant); } catch (InvalidRequestException e) { if (e.getMessage().startsWith("Resource")) { /* fix or create resource */ } else throw e; }

Prevention

When it happens

Trigger: GRANT/REVOKE ... ON KEYSPACE <ks> / ON TABLE <ks.t> where the named keyspace or table does not exist.

Common situations: Granting on a table in the wrong keyspace; migration scripts run before schema creation; case-sensitivity mismatches in unquoted identifiers.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/cb723453b4cfd094. Report an issue: GitHub.