{"record":{"id":"08b653c208f52da1","repo":"prestodb/presto","slug":"cannot-drop-role-s","errorCode":null,"errorMessage":"Cannot drop role %s","messagePattern":"Cannot drop role (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":402,"sourceCode":"\n    public static void denyCallProcedure(String procedureName)\n    {\n        denyCallProcedure(procedureName, null);\n    }\n\n    public static void denyCallProcedure(String procedureName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot call procedure %s%s\", procedureName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot create role %s\", roleName));\n    }\n\n    public static void denyDropRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop role %s\", roleName));\n    }\n\n    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant roles %s to %s \", roles, grantees));\n    }\n\n    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke roles %s from %s \", roles, grantees));\n    }\n\n    public static void denySetRole(String role)\n    {\n        throw new AccessDeniedException(format(\"Cannot set role %s\", role));\n    }\n\n    public static void denyCreateBranch(String tableName)","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L384-L420","documentation":"Thrown by denyDropRole when DROP ROLE is rejected by checkCanDropRole. Dropping a role invalidates grants across the catalog, so only role administrators may do it. The message identifies the role being dropped.","triggerScenarios":"Executing 'DROP ROLE <role>' in a catalog whose access control denies the current user role-admin rights for that role.","commonSituations":"Cleanup scripts removing obsolete roles run by non-admins; dropping a role in the wrong catalog/environment; automated TTL cleanup jobs with insufficient privileges.","solutions":["Have a security admin execute the DROP ROLE.","Grant the principal drop-role (admin) rights in the access control configuration if legitimate.","Verify the role name and that you are on the intended catalog.","Revoke grants and archive membership first per your governance process, then drop as admin."],"exampleFix":"// before (denied)\nDROP ROLE old_contractors;\n// after: run under admin credentials, e.g. via the security-admin account","handlingStrategy":"try-catch","validationCode":"if (!hasRoleAdminOption(currentUser, roleName)) {\n    throw new IllegalStateException(\"DROP ROLE \" + roleName + \" requires the admin option\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(\"DROP ROLE \" + roleName);\n} catch (AccessDeniedException e) {\n    log.error(\"Role drop denied for {}: {}\", roleName, e.getMessage());\n    throw e;\n}","preventionTips":["Keep role cleanup in admin-only automation pipelines.","Confirm catalog + role name to avoid dropping in the wrong environment.","Record role drops in an audit log for governance."],"tags":["security","roles","access-control","authorization"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}