{"record":{"id":"331ff3e5e9da9a69","repo":"prestodb/presto","slug":"cannot-update-columns-s-in-table-s-s","errorCode":null,"errorMessage":"Cannot update columns [%s] in table %s%s","messagePattern":"Cannot update columns \\[(.+?)\\] in table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":257,"sourceCode":"\n    public static void denyTruncateTable(String tableName)\n    {\n        denyTruncateTable(tableName, null);\n    }\n\n    public static void denyTruncateTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot truncate table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames)\n    {\n        denyUpdateTableColumns(tableName, updatedColumnNames, null);\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot update columns [%s] in table %s%s\", updatedColumnNames, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateView(String viewName)\n    {\n        denyCreateView(viewName, null);\n    }\n\n    public static void denyCreateView(String viewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot create view %s%s\", viewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateViewWithSelect(String sourceName, Identity identity)\n    {\n        denyCreateViewWithSelect(sourceName, identity.toConnectorIdentity());\n    }\n\n    public static void denyCreateViewWithSelect(String sourceName, ConnectorIdentity identity)","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L239-L275","documentation":"This AccessDeniedException is thrown by Presto's authorization layer when the active access controller denies an UPDATE statement that modifies specific columns of a table. Connectors with security (e.g. Hive/system access control) call denyUpdateTableColumns when the current identity lacks the UPDATE privilege on the listed columns. It means the privilege decision came from the connector/security mapping, not a SQL problem.","triggerScenarios":"Executing UPDATE ... SET col1,col2 on a table when checkCanUpdateTableColumns denies the updated column set; denyUpdateTableColumns is invoked by AccessControlManager.checkCanUpdateTableColumns during query analysis.","commonSituations":"Running UPDATE as a non-owner/non-admin user; file-based or Hive system access control not granting UPDATE on the schema; connector authorizer plugins (e.g. presto-grpc-api, ranger) restricting column-level updates.","solutions":["Grant the UPDATE privilege on those columns to the user/role in the underlying catalog's access control configuration","Run the UPDATE as an identity that the access controller authorizes","Check the connector's security mapping/system access control file and add the required grants","If the denial is unexpected, inspect the configured AccessControl plugin logs to see which rule denied it"],"exampleFix":"// before (hive security mapping denies user)\nUPDATE sales SET region='EU' WHERE id=1; -- AccessDeniedException\n// after: grant privilege in access control config\nGRANT UPDATE ON sales TO USER analyst; -- then re-run UPDATE","handlingStrategy":"try-catch","validationCode":"// best effort: attempt the check via system metadata or maintain a grant cache\n// Presto has no client-side precheck; ensure the identity holds UPDATE via the catalog admin\nboolean hasUpdate = catalogAdmin.userHasPrivilege(user, table, \"UPDATE\");","typeGuard":null,"tryCatchPattern":"try {\n    executeUpdate(sql);\n} catch (AccessDeniedException e) {\n    log.error(\"UPDATE denied: {}\", e.getMessage());\n    throw new SecurityException(\"Grant UPDATE on the target columns to this user\", e);\n}","preventionTips":["Provision UPDATE grants as part of onboarding IAM/role setup","Test UPDATE paths with a least-privileged service account before deploying","Keep access control config in version control and review denials in audit logs"],"tags":["security","authorization","access-denied","presto-spi"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}