{"record":{"id":"788f5f7da43473af","repo":"prestodb/presto","slug":"cannot-delete-from-table-s-s","errorCode":null,"errorMessage":"Cannot delete from table %s%s","messagePattern":"Cannot delete from table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":237,"sourceCode":"\n    public static void denyInsertTable(String tableName)\n    {\n        denyInsertTable(tableName, null);\n    }\n\n    public static void denyInsertTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot insert into table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDeleteTable(String tableName)\n    {\n        denyDeleteTable(tableName, null);\n    }\n\n    public static void denyDeleteTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot delete from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyTruncateTable(String tableName)\n    {\n        denyTruncateTable(tableName, null);\n    }\n\n    public static void denyTruncateTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot truncate table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames)\n    {\n        denyUpdateTableColumns(tableName, updatedColumnNames, null);\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames, String extraInfo)","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L219-L255","documentation":"Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to delete rows from a table. The connector's AccessControl.checkCanDeleteFromTable implementation denied the DELETE statement via denyDeleteTable. This is an intentional authorization denial for destructive write operations.","triggerScenarios":"Executing DELETE FROM t WHERE ... where the connector's checkCanDeleteFromTable(Identity, SchemaTableName) denies the user; some connectors also route through this when the operation is unsupported, denying even for admins.","commonSituations":"Data-retention/cleanup jobs as underprivileged accounts; connectors that do not support deletes (deny by design); users with INSERT but not DELETE grants.","solutions":["Grant DELETE privilege on the table to the executing principal in the backing authorization system.","Run cleanup jobs with an account holding delete/write privileges.","Verify the connector supports DELETE at all (e.g. Hive needs transactional tables); otherwise use the underlying engine's tooling.","Connector authors: implement checkCanDeleteFromTable with proper authorization rather than unconditional denyDeleteTable."],"exampleFix":"// before (connector)\npublic boolean checkCanDeleteFromTable(ConnectorIdentity identity, SchemaTableName table, AccessControlContext context) {\n    denyDeleteTable(table.toString());\n}\n\n// after\npublic boolean checkCanDeleteFromTable(ConnectorIdentity identity, SchemaTableName table, AccessControlContext context) {\n    if (!isOwner(identity, table)) {\n        denyDeleteTable(table.toString());\n    }\n    return true;\n}\n","handlingStrategy":"validation","validationCode":"boolean canDelete = grantsContain(showGrants(table), serviceAccount, \"DELETE\");\nif (!canDelete) {\n    throw new IllegalStateException(\"Service account lacks DELETE on \" + table);\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Grant DELETE separately from INSERT where the security model requires it.","Confirm the connector supports DELETE (transactional tables for Hive) before planning cleanup jobs.","Run retention jobs with accounts that hold delete privileges.","Review grants after security audits that may revoke write permissions."],"tags":["presto","security","authorization","delete"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}