prestodb/presto · error · AccessDeniedException

Cannot create branch on table %s%s

Error message

Cannot create branch on table %s%s

What it means

denyCreateBranch throws AccessDeniedException when the access control layer denies the user permission to create a branch on the given table. Branching is a table-versioning feature (e.g. Iceberg-style branches); Presto enforces CREATE BRANCH authorization via checkCanCreateBranch before executing the statement.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:427

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot revoke roles %s from %s ", roles, grantees));
    }

    public static void denySetRole(String role)
    {
        throw new AccessDeniedException(format("Cannot set role %s", role));
    }

    public static void denyCreateBranch(String tableName)
    {
        denyCreateBranch(tableName, null);
    }

    public static void denyCreateBranch(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot create branch on table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateTag(String tableName)
    {
        denyCreateTag(tableName, null);
    }

    public static void denyCreateTag(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot create tag on table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyDropBranch(String tableName)
    {
        denyDropBranch(tableName, null);
    }

    public static void denyDropBranch(String tableName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Grant the user/group CREATE BRANCH (or table admin) privilege in the active access control (file-based rules, Ranger/OPA policy)
  2. Confirm the catalog's access-control.properties points at the intended policy file/plugin
  3. Verify the fully qualified table name and catalog in the policy match what the user queried
  4. If branching is not intended for this catalog, use a connector/version without branch support instead of fighting the policy

Example fix

// before: access-control rules deny all DDL
{
  "catalogs": [{"catalog": "iceberg", "allow": "read-only"}]
}
// after: allow branch DDL for data-engineer group
{
  "catalogs": [{"catalog": "iceberg", "allow": true, "privileges": ["CREATE BRANCH"]}]
}
Defensive patterns

Strategy: try-catch

Validate before calling

// verify CREATE BRANCH privilege via Presto system metadata before DDL
try (ResultSet rs = conn.executeQuery(
        "SELECT * FROM system.security.table_grants WHERE catalog_name='iceberg' AND table_name='t'")) {
    // confirm grantee and privilege include CREATE BRANCH
}

Type guard

boolean hasPrivilege(Set<String> privileges, String needed) {
    return privileges != null && privileges.contains(needed);
}

Try / catch

try {
    conn.execute("ALTER TABLE t CREATE BRANCH b");
} catch (AccessDeniedException e) {
    LOG.warn("CREATE BRANCH denied: %s", e.getMessage());
    throw e;
}

Prevention

When it happens

Trigger: A connector implementing BranchSupport calls checkCanCreateBranch, whose policy rejects it and calls denyCreateBranch(tableName, extraInfo), producing 'Cannot create branch on table <table><extraInfo>'.

Common situations: Users running ALTER TABLE ... CREATE BRANCH (or similar connector syntax) on a table in a catalog whose access control does not grant them table-level CREATE/branch privileges; enterprise policy plugins blocking DDL on production tables.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/c959492b1b37dfd5. Report an issue: GitHub.