{"record":{"id":"b3613fe4d9cd7752","repo":"prestodb/presto","slug":"cannot-drop-a-tag-from-table-s-s","errorCode":null,"errorMessage":"Cannot drop a tag from table %s%s","messagePattern":"Cannot drop a tag from table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":457,"sourceCode":"\n    public static void denyDropBranch(String tableName)\n    {\n        denyDropBranch(tableName, null);\n    }\n\n    public static void denyDropBranch(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a branch from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropTag(String tableName)\n    {\n        denyDropTag(tableName, null);\n    }\n\n    public static void denyDropTag(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a tag from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropConstraint(String tableName)\n    {\n        denyDropConstraint(tableName, null);\n    }\n\n    public static void denyDropConstraint(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a constraint from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyAddConstraint(String tableName)\n    {\n        denyAddConstraint(tableName, null);\n    }\n\n    public static void denyAddConstraint(String tableName, String extraInfo)","sourceCodeStart":439,"sourceCodeEnd":475,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L439-L475","documentation":"denyDropTag throws AccessDeniedException when the access control layer denies dropping a tag from the given table. Tags are immutable named snapshots in versioned table formats; DROP TAG requires a distinct privilege checked via checkCanDropTag.","triggerScenarios":"A connector calls checkCanDropTag; the policy rejects and calls denyDropTag(tableName, extraInfo), producing 'Cannot drop a tag from table <table><extraInfo>'.","commonSituations":"Retiring old release tags on tables where the user lacks drop privileges; automated cleanup jobs running under an unprivileged principal; policy migrations that dropped tag privileges from role definitions.","solutions":["Grant DROP TAG privilege to the relevant principal in the access-control configuration","Confirm the cleanup/automation job uses a service account with those privileges","Check the policy engine (Ranger/OPA) actually contains the tag-operation rule and was reloaded after edits","Verify the table name in the policy matches the queried table (catalog.schema.table)"],"exampleFix":"// before: OPA policy omits DROP TAG\n{\"actions\": [\"SELECT\", \"CREATE TAG\"]}\n// after\n{\"actions\": [\"SELECT\", \"CREATE TAG\", \"DROP TAG\"]}","handlingStrategy":"try-catch","validationCode":"// pre-check DROP TAG grant\nif (!grants(user, catalog, table).contains(\"DROP TAG\")) {\n    throw new IllegalStateException(\"DROP TAG not granted to \" + user);\n}","typeGuard":"boolean canDropTag(String user, String table, Map<String, Set<String>> grants) {\n    return grants.getOrDefault(user, Set.of()).stream().anyMatch(g -> g.contains(\"DROP TAG\"));\n}","tryCatchPattern":"try {\n    conn.execute(\"ALTER TABLE t DROP TAG release_1\");\n} catch (AccessDeniedException e) {\n    LOG.warn(\"DROP TAG denied: %s\", e.getMessage());\n    throw e;\n}","preventionTips":["Automate tag cleanup with privileged service credentials","Re-test policies after Ranger/OPA rule changes","Confirm the cleanup job's principal is not impersonated to a lesser user","Document tag privilege requirements in runbooks"],"tags":["presto","security","access-denied","tagging"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}