{"record":{"id":"f2cbdc92147c67f2","repo":"prestodb/presto","slug":"cannot-rename-a-column-in-table-s-s","errorCode":null,"errorMessage":"Cannot rename a column in table %s%s","messagePattern":"Cannot rename a column in table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":207,"sourceCode":"\n    public static void denyAlterColumn(String tableName)\n    {\n        denyAlterColumn(tableName, null);\n    }\n\n    public static void denyAlterColumn(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot alter a column for table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyRenameColumn(String tableName)\n    {\n        denyRenameColumn(tableName, null);\n    }\n\n    public static void denyRenameColumn(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot rename a column in table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySelectTable(String tableName)\n    {\n        denySelectTable(tableName, null);\n    }\n\n    public static void denySelectTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyInsertTable(String tableName)\n    {\n        denyInsertTable(tableName, null);\n    }\n\n    public static void denyInsertTable(String tableName, String extraInfo)","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L189-L225","documentation":"Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to rename a column. The connector's AccessControl.checkCanRenameColumn implementation denied ALTER TABLE ... RENAME COLUMN via denyRenameColumn. This is an intentional authorization denial for DDL that changes table schema.","triggerScenarios":"Executing ALTER TABLE t RENAME COLUMN old TO new where the connector's checkCanRenameColumn(Identity, SchemaTableName) denies the current user.","commonSituations":"Users renaming columns in Hive/Iceberg tables without ownership; deployment pipelines performing schema refactors with restricted credentials; connectors denying DDL entirely.","solutions":["Grant ALTER/RENAME privilege or table ownership to the executing principal.","Run the rename as an owner/admin account.","Update migration tooling credentials to use a privileged service account.","Connector authors: implement checkCanRenameColumn to allow legitimate owners instead of always calling denyRenameColumn."],"exampleFix":"// before\nALTER TABLE reports.t RENAME COLUMN nm TO name; -- Access Denied\n\n// after\n-- executed as table owner\nALTER TABLE reports.t RENAME COLUMN nm TO name; -- OK\n","handlingStrategy":"validation","validationCode":"boolean canRenameColumn = grantsContain(showGrants(table), currentUser, \"ALTER\");\nif (!canRenameColumn) {\n    throw new IllegalStateException(\"Principal lacks ALTER (rename column) on \" + table);\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run refactoring migrations as the table owner.","Avoid interactive renames by non-owner users; route through reviewed migrations.","Verify the correct catalog/schema so grants line up.","Document which roles hold ALTER privileges per table."],"tags":["presto","security","authorization","ddl"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}