{"record":{"id":"be63e65d4ccbd30c","repo":"prestodb/presto","slug":"cannot-create-tag-on-table-s-s","errorCode":null,"errorMessage":"Cannot create tag on table %s%s","messagePattern":"Cannot create tag on table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":437,"sourceCode":"\n    public static void denyCreateBranch(String tableName)\n    {\n        denyCreateBranch(tableName, null);\n    }\n\n    public static void denyCreateBranch(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot create branch on table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateTag(String tableName)\n    {\n        denyCreateTag(tableName, null);\n    }\n\n    public static void denyCreateTag(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot create tag on table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropBranch(String tableName)\n    {\n        denyDropBranch(tableName, null);\n    }\n\n    public static void denyDropBranch(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a branch from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropTag(String tableName)\n    {\n        denyDropTag(tableName, null);\n    }\n\n    public static void denyDropTag(String tableName, String extraInfo)","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L419-L455","documentation":"denyCreateTag throws AccessDeniedException when the access control layer denies creating a tag (a named immutable snapshot reference, e.g. in Iceberg-style table versioning) on the given table. The optional extraInfo parameter appends additional context to the message.","triggerScenarios":"A connector calls checkCanCreateTag; its policy rejects the operation and calls denyCreateTag(tableName, extraInfo), yielding 'Cannot create tag on table <table><extraInfo>'.","commonSituations":"Users executing CREATE TAG statements on tables governed by restrictive access control; missing table-level privilege grants after migrating catalogs; policy plugins that enumerate allowed operations without including TAG operations.","solutions":["Grant the user/group CREATE TAG privilege in the active access-control configuration","Check the policy file/plugin actually loaded (look for config parse warnings in server logs) — a silently unloaded policy may deny everything","Confirm the tag DDL targets the correct catalog/table the policy grants cover","If tags should be self-service, add a rule scoped to the relevant schema rather than globally"],"exampleFix":"// before\nGRANT-less policy: {\"user\": \"bob\", \"allow\": false}\n// after\n{\"user\": \"bob\", \"privileges\": [\"CREATE TAG\"], \"allow\": true}","handlingStrategy":"try-catch","validationCode":"// confirm the user holds CREATE TAG before issuing the statement\nboolean canCreateTag = policyClient.hasPrivilege(user, catalog, table, \"CREATE TAG\");\nif (!canCreateTag) { throw new IllegalStateException(\"Missing CREATE TAG privilege\"); }","typeGuard":"boolean isPrivileged(java.security.Principal p, Map<String, Set<String>> grants, String table) {\n    return p != null && grants.getOrDefault(p.getName(), Set.of()).stream().anyMatch(g -> g.contains(table));\n}","tryCatchPattern":"try {\n    conn.execute(\"ALTER TABLE t CREATE TAG release_1\");\n} catch (AccessDeniedException e) {\n    LOG.warn(\"CREATE TAG denied: %s\", e.getMessage());\n    throw e;\n}","preventionTips":["Include tag operations in policy privilege enumerations","Confirm policy file/plugin loads cleanly at server startup","Use fully qualified table names in grants","Add integration tests that exercise tag DDL with a real principal"],"tags":["presto","security","access-denied","tagging"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}