prestodb/presto · error · AccessDeniedException

Cannot call procedure

Error message

Cannot call procedure %s%s

What it means

Thrown by denyCallProcedure when executing a system or connector procedure is denied by checkCanCallProcedure. Procedures (e.g. system.sync_partition_metadata, flush metadata caches) can mutate state, so access controls often restrict them to operators. extraInfo may append the reason.

Solutions

1. Have an authorized operator run the procedure.
2. Ask the admin to add a procedure allow rule for your principal in the access control config.
3. Verify the fully qualified procedure name and catalog.
4. Use the equivalent supported SQL/connector API if one is permitted for your role.

Example fix

// before (denied)
CALL system.sync_partition_metadata('hive', 'default', 'FULL');
// after: run under the ops service account permitted by access control rules

// Verify the principal is allowed to run this procedure before CALL
boolean allowed = accessControlConfig.allowsProcedure(currentUser, procedureQualifiedName);

try {
    stmt.execute("CALL " + procedureCall);
} catch (AccessDeniedException e) {
    throw new IllegalStateException("Procedure " + procedureCall + " requires an operator; " + e.getMessage(), e);
}

When it happens

Trigger: CALL <catalog>.system.<procedure>(...) or CALL system.<procedure>(...) when the access control's checkCanCallProcedure does not allow the current user for that procedure name.

Common situations: Running maintenance procedures (sync partitions, drop stats) as an analyst; CI automation invoking procedures with a service account lacking procedure permissions; copy-pasted runbooks assuming admin rights.

Related errors

• Cannot create role
• Cannot drop role
• Cannot grant roles to
• Cannot revoke roles from
• Cannot set catalog session property:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/5e05ffa0be65c2bd. Report an issue: GitHub.

Appendix: source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:392

    public static void denySelectColumns(String tableName, Collection<String> columnNames)
    {
        denySelectColumns(tableName, columnNames, null);
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)

View on GitHub (pinned to 55bb57d202)