prestodb/presto · error · AccessDeniedException

Cannot call procedure %s%s

Error message

Cannot call procedure %s%s

What it means

Thrown by denyCallProcedure when executing a system or connector procedure is denied by checkCanCallProcedure. Procedures (e.g. system.sync_partition_metadata, flush metadata caches) can mutate state, so access controls often restrict them to operators. extraInfo may append the reason.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:392

    public static void denySelectColumns(String tableName, Collection<String> columnNames)
    {
        denySelectColumns(tableName, columnNames, null);
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Have an authorized operator run the procedure.
2. Ask the admin to add a procedure allow rule for your principal in the access control config.
3. Verify the fully qualified procedure name and catalog.
4. Use the equivalent supported SQL/connector API if one is permitted for your role.

Example fix

// before (denied)
CALL system.sync_partition_metadata('hive', 'default', 'FULL');
// after: run under the ops service account permitted by access control rules

// Verify the principal is allowed to run this procedure before CALL
boolean allowed = accessControlConfig.allowsProcedure(currentUser, procedureQualifiedName);

try {
    stmt.execute("CALL " + procedureCall);
} catch (AccessDeniedException e) {
    throw new IllegalStateException("Procedure " + procedureCall + " requires an operator; " + e.getMessage(), e);
}

When it happens

Trigger: CALL <catalog>.system.<procedure>(...) or CALL system.<procedure>(...) when the access control's checkCanCallProcedure does not allow the current user for that procedure name.

Common situations: Running maintenance procedures (sync partitions, drop stats) as an analyst; CI automation invoking procedures with a service account lacking procedure permissions; copy-pasted runbooks assuming admin rights.

Related errors

• Cannot set catalog session property:
• Cannot show role grants from catalog %s
• Cannot create role %s
• Cannot drop role %s
• Cannot grant roles %s to %s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/5e05ffa0be65c2bd. Report an issue: GitHub.