{"record":{"id":"5e05ffa0be65c2bd","repo":"prestodb/presto","slug":"cannot-call-procedure-s-s","errorCode":null,"errorMessage":"Cannot call procedure %s%s","messagePattern":"Cannot call procedure (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":392,"sourceCode":"\n    public static void denySelectColumns(String tableName, Collection<String> columnNames)\n    {\n        denySelectColumns(tableName, columnNames, null);\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from columns %s in table or view %s%s\", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCallProcedure(String procedureName)\n    {\n        denyCallProcedure(procedureName, null);\n    }\n\n    public static void denyCallProcedure(String procedureName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot call procedure %s%s\", procedureName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot create role %s\", roleName));\n    }\n\n    public static void denyDropRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop role %s\", roleName));\n    }\n\n    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant roles %s to %s \", roles, grantees));\n    }\n\n    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L374-L410","documentation":"Thrown by denyCallProcedure when executing a system or connector procedure is denied by checkCanCallProcedure. Procedures (e.g. system.sync_partition_metadata, flush metadata caches) can mutate state, so access controls often restrict them to operators. extraInfo may append the reason.","triggerScenarios":"CALL <catalog>.system.<procedure>(...) or CALL system.<procedure>(...) when the access control's checkCanCallProcedure does not allow the current user for that procedure name.","commonSituations":"Running maintenance procedures (sync partitions, drop stats) as an analyst; CI automation invoking procedures with a service account lacking procedure permissions; copy-pasted runbooks assuming admin rights.","solutions":["Have an authorized operator run the procedure.","Ask the admin to add a procedure allow rule for your principal in the access control config.","Verify the fully qualified procedure name and catalog.","Use the equivalent supported SQL/connector API if one is permitted for your role."],"exampleFix":"// before (denied)\nCALL system.sync_partition_metadata('hive', 'default', 'FULL');\n// after: run under the ops service account permitted by access control rules","handlingStrategy":"try-catch","validationCode":"// Verify the principal is allowed to run this procedure before CALL\nboolean allowed = accessControlConfig.allowsProcedure(currentUser, procedureQualifiedName);","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(\"CALL \" + procedureCall);\n} catch (AccessDeniedException e) {\n    throw new IllegalStateException(\"Procedure \" + procedureCall + \" requires an operator; \" + e.getMessage(), e);\n}","preventionTips":["Route maintenance CALLs through the ops service account.","List permitted procedures per role in runbooks.","Never hardcode CALL statements into analyst-facing tooling."],"tags":["security","procedures","access-control","authorization"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}