{"record":{"id":"7af090c3b960d6dc","repo":"prestodb/presto","slug":"cannot-create-role-s","errorCode":null,"errorMessage":"Cannot create role %s","messagePattern":"Cannot create role (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":397,"sourceCode":"\n    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from columns %s in table or view %s%s\", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCallProcedure(String procedureName)\n    {\n        denyCallProcedure(procedureName, null);\n    }\n\n    public static void denyCallProcedure(String procedureName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot call procedure %s%s\", procedureName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot create role %s\", roleName));\n    }\n\n    public static void denyDropRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop role %s\", roleName));\n    }\n\n    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant roles %s to %s \", roles, grantees));\n    }\n\n    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke roles %s from %s \", roles, grantees));\n    }\n\n    public static void denySetRole(String role)","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L379-L415","documentation":"Thrown by denyCreateRole when CREATE ROLE is rejected by checkCanCreateRole. Role administration (CREATE/DROP/GRANT/REVOKE ROLE) is reserved to principals granted the admin option in the catalog's security policy. The message names the role the user attempted to create.","triggerScenarios":"Executing 'CREATE ROLE <role>' in a catalog (e.g. Hive with Ranger/file-based authorization) where the session user lacks role-admin privileges.","commonSituations":"Setting up new team access in a shared cluster as a non-admin; bootstrap/infra scripts creating roles with an underprivileged service account; connectors whose role checks are enforced even if SQL succeeds elsewhere.","solutions":["Run the CREATE ROLE as a user granted the security admin option on the catalog.","Request that an admin create the role for you.","Check the connector's authorization configuration to learn who may manage roles.","Confirm the role does not already exist and the catalog supports role-based security."],"exampleFix":"// before (denied as analyst)\nCREATE ROLE finance_readers;\n// after: executed by admin, then\nGRANT finance_readers TO USER alice;","handlingStrategy":"try-catch","validationCode":"// Only run CREATE ROLE from an identity with role-admin rights\nif (!hasRoleAdminOption(currentUser, catalogName)) {\n    throw new IllegalStateException(\"CREATE ROLE must run under a security admin\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(\"CREATE ROLE \" + roleName);\n} catch (AccessDeniedException e) {\n    log.error(\"Role creation denied for {}: {}\", roleName, e.getMessage());\n    throw e; // requires admin intervention\n}","preventionTips":["Execute all role lifecycle DDL with dedicated admin credentials.","Check who holds the admin option before scripting role setup.","Validate the target catalog/environment before DDL."],"tags":["security","roles","access-control","authorization"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}