{"record":{"id":"47b4cb90dcb2972a","repo":"prestodb/presto","slug":"cannot-insert-into-table-s-s","errorCode":null,"errorMessage":"Cannot insert into table %s%s","messagePattern":"Cannot insert into table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":227,"sourceCode":"\n    public static void denySelectTable(String tableName)\n    {\n        denySelectTable(tableName, null);\n    }\n\n    public static void denySelectTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyInsertTable(String tableName)\n    {\n        denyInsertTable(tableName, null);\n    }\n\n    public static void denyInsertTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot insert into table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDeleteTable(String tableName)\n    {\n        denyDeleteTable(tableName, null);\n    }\n\n    public static void denyDeleteTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot delete from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyTruncateTable(String tableName)\n    {\n        denyTruncateTable(tableName, null);\n    }\n\n    public static void denyTruncateTable(String tableName, String extraInfo)","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L209-L245","documentation":"Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to insert rows into a table. The connector's AccessControl.checkCanInsertIntoTable implementation denied the INSERT statement via denyInsertTable. This is an intentional authorization denial for write operations.","triggerScenarios":"Executing INSERT INTO t ... where the connector's checkCanInsertIntoTable(Identity, SchemaTableName) denies the user; also hit via CREATE TABLE AS with write-backed catalogs lacking insert grants.","commonSituations":"ETL jobs running as underprivileged service accounts; Hive tables owned by another user; connectors that are read-only (deny all inserts by design); permissions revoked during role cleanups.","solutions":["Grant INSERT privilege on the table to the executing principal in the connector's authorization system.","Run the ETL/write job with a service account that has write access.","Confirm the target table's owner/ACLs (e.g. underlying filesystem permissions for Hive).","Connector authors: implement checkCanInsertIntoTable with real checks instead of unconditional denyInsertTable."],"exampleFix":"// before\nINSERT INTO reports.t VALUES (...); -- Access Denied: Cannot insert into table reports.t\n\n// after\n-- as account with insert grant\nGRANT INSERT ON reports.t TO USER etl;  -- in the backing authorization system\nINSERT INTO reports.t VALUES (...);\n","handlingStrategy":"validation","validationCode":"boolean canInsert = grantsContain(showGrants(table), serviceAccount, \"INSERT\");\nif (!canInsert) {\n    throw new IllegalStateException(\"Service account lacks INSERT on \" + table);\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision ETL service accounts with INSERT grants at table creation.","Check underlying storage ACLs (Hive/HDFS permissions) in addition to Presto grants.","Fail fast in pipeline startup by verifying write grants before loading data.","Avoid reusing read-only connectors for write workloads."],"tags":["presto","security","authorization","insert","write"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}