{"record":{"id":"e51ddf514924fab4","repo":"prestodb/presto","slug":"permission-denied-e51ddf","errorCode":"PERMISSION_DENIED","errorMessage":"User does not have access to encryption key for encrypted column = %s. If returning 'null' for encrypted columns is acceptable to your query, please add 'set session hive.read_null_masked_parquet_encrypted_value_enabled=true' before your query","messagePattern":"User does not have access to encryption key for encrypted column = (.+?)\\. If returning 'null' for encrypted columns is acceptable to your query, please add 'set session hive\\.read_null_masked_parquet_encrypted_value_enabled=true' before your query","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/parquet/ParquetPageSourceFactoryUtils.java","lineNumber":59,"sourceCode":"        }\n        if (e instanceof ParquetCorruptionException) {\n            throw new PrestoException(HIVE_BAD_DATA, e);\n        }\n        if (e instanceof AccessControlException) {\n            throw new PrestoException(PERMISSION_DENIED, e.getMessage(), e);\n        }\n        if (nullToEmpty(e.getMessage()).trim().equals(\"Filesystem closed\") ||\n                e instanceof FileNotFoundException) {\n            throw new PrestoException(HIVE_CANNOT_OPEN_SPLIT, e);\n        }\n        String message = format(\"Error opening Hive split %s (offset=%s, length=%s): %s\", path, fileSplit.getStart(), fileSplit.getLength(), e.getMessage());\n        if (e.getClass().getSimpleName().equals(\"BlockMissingException\")) {\n            throw new PrestoException(HIVE_MISSING_DATA, message, e);\n        }\n        if (e instanceof HiddenColumnException) {\n            message = format(\"User does not have access to encryption key for encrypted column = %s. If returning 'null' for encrypted \" +\n                    \"columns is acceptable to your query, please add 'set session hive.read_null_masked_parquet_encrypted_value_enabled=true' before your query\", ((HiddenColumnException) e).getColumn());\n            throw new PrestoException(PERMISSION_DENIED, message, e);\n        }\n        throw new PrestoException(HIVE_CANNOT_OPEN_SPLIT, message, e);\n    }\n}\n","sourceCodeStart":41,"sourceCodeEnd":64,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/parquet/ParquetPageSourceFactoryUtils.java#L41-L64","documentation":"When opening a split fails because the exception is a HiddenColumnException, mapToPrestoException throws PERMISSION_DENIED. This means the column is a Parquet-encrypted column and the user does not have access to its encryption key, so the reader cannot decrypt it. The message points to the session property hive.read_null_masked_parquet_encrypted_value_enabled=true, which returns NULLs for encrypted columns instead of failing.","triggerScenarios":"Querying a Hive table containing Parquet column encryption where the current user lacks the encryption key (key not granted in the KMS / Hive key provider); the underlying Hadoop FS call during split open wraps HiddenColumnException.","commonSituations":"Parquet column-level encryption configured by table owners but key grants not given to analyst users; moving queries to a service user without key ACLs; encrypted columns added via a CTAS with encryption flags while readers were not granted keys.","solutions":["Grant the querying user access to the column encryption key in the key provider (e.g. KMS ACL / ranger policy)","If NULL masking is acceptable, set the session property: SET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true; before the query","Exclude the encrypted columns from the SELECT list so the reader never needs the key","Re-write the table without encryption if encryption is no longer required"],"exampleFix":"-- before\nSELECT ssn FROM hive.encrypted_table; -- PERMISSION_DENIED: no key access\n-- after\nSET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true;\nSELECT ssn FROM hive.encrypted_table; -- returns NULLs instead of failing","handlingStrategy":"try-catch","validationCode":"-- Verify key access before running the query (in your KMS/ranger tooling)\n-- e.g. hadoop key list -metadata and check ACLs, or attempt a tiny probe query:\nSELECT encrypted_col FROM hive.encrypted_table LIMIT 1;","typeGuard":null,"tryCatchPattern":"try {\n    execute(\"SELECT encrypted_col FROM hive.encrypted_table\");\n} catch (PrestoException e) {\n    if (PERMISSION_DENIED.equals(e.getErrorCode())) {\n        execute(\"SET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true\");\n        execute(\"SELECT encrypted_col FROM hive.encrypted_table\"); // NULL-masked fallback\n    } else { throw e; }\n}","preventionTips":["Grant encryption-key access to all roles/users expected to query encrypted tables","Document the hive.read_null_masked_parquet_encrypted_value_enabled escape hatch for analysts","Probe encrypted tables with LIMIT 1 in CI before scheduling production jobs","Exclude encrypted columns from wide SELECT * queries unless needed"],"tags":["security","encryption","parquet","permissions","hive"],"backgroundTag":"missing-encryption-key-access","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}