prestodb/presto · error · AccessDeniedException

Cannot access schema:

Error message

Cannot access schema: 

What it means

Access-control denial in checkAndSetSchema for the USE statement: the schema exists, but the AccessContext check determined the current identity is not allowed to access it, and the name is appended to the failure message.

Source

Thrown at presto-main-base/src/main/java/com/facebook/presto/execution/UseTask.java:102

        if (!hasCatalogAccess(session.getIdentity(), session.getAccessControlContext(), catalog, accessControl)) {
            denyCatalogAccess(catalog);
        }
        stateMachine.setSetCatalog(catalog);
    }

    private void checkAndSetSchema(Use statement, Metadata metadata, QueryStateMachine stateMachine, Session session, AccessControl accessControl)
    {
        String catalog = statement.getCatalog()
                .map(Identifier::getValueLowerCase)
                .orElseGet(() -> session.getCatalog().map(String::toLowerCase).get());

        Identifier schemaIdentifier = statement.getSchema();
        String schema = metadata.normalizeIdentifier(session, catalog, schemaIdentifier.getValue());
        if (!metadata.getMetadataResolver(session).schemaExists(new CatalogSchemaName(catalog, schema))) {
            throw new SemanticException(MISSING_SCHEMA, format("Schema does not exist: %s.%s", catalog, schema));
        }
        if (!hasSchemaAccess(session.getTransactionId().get(), session.getIdentity(), session.getAccessControlContext(), catalog, schema, accessControl)) {
            throw new AccessDeniedException("Cannot access schema: " + new CatalogSchemaName(catalog, schema));
        }
        stateMachine.setSetSchema(schema);
    }

    private boolean hasCatalogAccess(Identity identity, AccessControlContext context, String catalog, AccessControl accessControl)
    {
        return !accessControl.filterCatalogs(identity, context, ImmutableSet.of(catalog)).isEmpty();
    }

    private boolean hasSchemaAccess(TransactionId transactionId, Identity identity, AccessControlContext context, String catalog, String schema, AccessControl accessControl)
    {
        return !accessControl.filterSchemas(transactionId, identity, context, catalog, ImmutableSet.of(schema)).isEmpty();
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Request the required schema privileges from the system administrator
2. Verify the authenticated user and role are the ones intended
3. Switch to an identity that has access, or use a schema the identity can read

When it happens

Trigger: Thrown at presto-main-base/src/main/java/com/facebook/presto/execution/UseTask.java:102 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/d88afb734f6cca0f. Report an issue: GitHub.