apache/cassandra · error · InvalidRequestException

%s doesn't exist

Error message

%s doesn't exist

What it means

RoleManagementStatement.validate() (GRANT/REVOKE family) verifies both the target role and the grantee exist in the configured IRoleManager before executing. This throw is the case where the ROLE side of the statement (the role being granted on) does not exist, raising InvalidRequestException '<role> doesn't exist'.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/RoleManagementStatement.java:53

    protected final RoleResource grantee;

    public RoleManagementStatement(RoleName name, RoleName grantee)
    {
        this.role = RoleResource.role(name.getName());
        this.grantee = RoleResource.role(grantee.getName());
    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        super.checkPermission(state, Permission.AUTHORIZE, role);
    }

    public void validate(ClientState state) throws RequestValidationException
    {
        state.ensureNotAnonymous();

        if (!DatabaseDescriptor.getRoleManager().isExistingRole(role))
            throw new InvalidRequestException(String.format("%s doesn't exist", role.getRoleName()));

        if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))
            throw new InvalidRequestException(String.format("%s doesn't exist", grantee.getRoleName()));
    }
    
    @Override
    public String toString()
    {
        return ToStringBuilder.reflectionToString(this, ToStringStyle.SHORT_PREFIX_STYLE);
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. CREATE ROLE analyst_role (with password/login as needed) before granting
2. Re-check spelling/case of the role name in the statement
3. List existing roles (system_auth.roles or LIST ROLES) to confirm the name
4. Re-create roles that were dropped when replaying setup scripts

Example fix

// before
GRANT SELECT ON KEYSPACE ks TO analyst_role;
// after
CREATE ROLE analyst_role WITH login = true;
GRANT SELECT ON KEYSPACE ks TO analyst_role;

const roles = await runCql('LIST ROLES'); if (!roles.includes(roleName)) throw new Error(`Role ${roleName} must be created before GRANT`);

try { runCql(grant); } catch (e) { if (e.message.includes("doesn't exist")) { await runCql(`CREATE ROLE ${roleName} WITH login = true`); await runCql(grant); } else throw e; }

When it happens

Trigger: GRANT <permission> ON resource TO role; where role (the first check) is not a registered role, e.g. GRANT SELECT ON ks.t TO analyst_role when analyst_role was never CREATE ROLEd or was DROPped.

Common situations: Typo in the role name; role dropped in another environment/cluster; running role statements before role management is set up (default RoleManager with no roles created); scripts replayed against a fresh cluster.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• You aren't allowed to alter %s
• Only superusers can drop a role with superuser status
• You are not authorized to view roles granted to %s
• You are not authorized to view superuser details
• Multiple definition for property '%s'

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/62b96d03b0dd302e. Report an issue: GitHub.