{"record":{"id":"64dc9b6aa64906b5","repo":"prestodb/presto","slug":"cannot-select-from-table-s-s","errorCode":null,"errorMessage":"Cannot select from table %s%s","messagePattern":"Cannot select from table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":217,"sourceCode":"\n    public static void denyRenameColumn(String tableName)\n    {\n        denyRenameColumn(tableName, null);\n    }\n\n    public static void denyRenameColumn(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot rename a column in table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySelectTable(String tableName)\n    {\n        denySelectTable(tableName, null);\n    }\n\n    public static void denySelectTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyInsertTable(String tableName)\n    {\n        denyInsertTable(tableName, null);\n    }\n\n    public static void denyInsertTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot insert into table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDeleteTable(String tableName)\n    {\n        denyDeleteTable(tableName, null);\n    }\n\n    public static void denyDeleteTable(String tableName, String extraInfo)","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L199-L235","documentation":"Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to read (SELECT) from a table. The connector's AccessControl.checkCanSelectFromTable implementation denied the query via denySelectTable, aborting the query before execution. This is the most common Presto authorization denial: the user simply lacks read access to the table.","triggerScenarios":"Any SELECT (or CREATE TABLE AS SELECT, view creation) touching a table where the connector's checkCanSelectFromTable(Identity, SchemaTableName) denies the user; column-level checks may also route to denySelectColumns/denySelectTable.","commonSituations":"BI tools querying restricted tables; stale credentials after team/role changes; wrong catalog selected causing a non-existent permission mapping; file-based access-control.properties missing the user in the right category.","solutions":["Grant SELECT on the table to the user in the security system (Ranger policy, access-control.properties group, Sentry role).","Verify the principal: run SELECT current_user and confirm it matches the account with grants.","Check you are querying the intended catalog/schema (grants are usually per catalog).","If a view should be used, have an admin create a view over the table and grant SELECT on the view instead."],"exampleFix":"// access-control.properties (file-based)\n// before\nsecurity.read.admin=admin,etl\n\n// after\nsecurity.read.admin=admin,etl,analyst   # grant read to the denied user\n","handlingStrategy":"try-catch","validationCode":"// Verify grants before querying\nResultSet g = stmt.executeQuery(\"SHOW GRANTS ON TABLE \" + tableRef);\nboolean canSelect = grantsContain(g, currentUser, \"SELECT\");\nif (!canSelect) { /* request access or fall back to a view */ }\n","typeGuard":null,"tryCatchPattern":"try (Statement st = conn.createStatement()) {\n    return st.executeQuery(\"SELECT * FROM \" + table);\n} catch (SQLException e) {\n    if (\"ACCESS_DENIED\".equals(e.getSQLState())) {\n        throw new TableAccessForbiddenException(table, e); // typed app-level error\n    }\n    throw e;\n}\n","preventionTips":["Grant SELECT via views when table-level access should be restricted.","Keep access-control.properties / Ranger policies in sync with team membership.","Preflight connectivity checks with a cheap SELECT 1 on the target table during deploys.","Confirm executing principal with SELECT current_user when grants appear wrong."],"tags":["presto","security","authorization","select"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}