What causes "Cannot create role %s" in prestodb/presto?

Run the CREATE ROLE as a user granted the security admin option on the catalog.

prestodb/presto · error · AccessDeniedException

Cannot create role %s

Error message

Cannot create role %s

What it means

Thrown by denyCreateRole when CREATE ROLE is rejected by checkCanCreateRole. Role administration (CREATE/DROP/GRANT/REVOKE ROLE) is reserved to principals granted the admin option in the catalog's security policy. The message names the role the user attempted to create.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:397

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot revoke roles %s from %s ", roles, grantees));
    }

    public static void denySetRole(String role)

View on GitHub (pinned to 55bb57d202)

Solutions

Run the CREATE ROLE as a user granted the security admin option on the catalog.
Request that an admin create the role for you.
Check the connector's authorization configuration to learn who may manage roles.
Confirm the role does not already exist and the catalog supports role-based security.

Example fix

// before (denied as analyst)
CREATE ROLE finance_readers;
// after: executed by admin, then
GRANT finance_readers TO USER alice;

Defensive patterns

Strategy: try-catch

Validate before calling

// Only run CREATE ROLE from an identity with role-admin rights
if (!hasRoleAdminOption(currentUser, catalogName)) {
    throw new IllegalStateException("CREATE ROLE must run under a security admin");
}

Try / catch

try {
    stmt.execute("CREATE ROLE " + roleName);
} catch (AccessDeniedException e) {
    log.error("Role creation denied for {}: {}", roleName, e.getMessage());
    throw e; // requires admin intervention
}

Prevention

Execute all role lifecycle DDL with dedicated admin credentials.
Check who holds the admin option before scripting role setup.
Validate the target catalog/environment before DDL.

When it happens

Trigger: Executing 'CREATE ROLE <role>' in a catalog (e.g. Hive with Ranger/file-based authorization) where the session user lacks role-admin privileges.

Common situations: Setting up new team access in a shared cluster as a non-admin; bootstrap/infra scripts creating roles with an underprivileged service account; connectors whose role checks are enforced even if SQL succeeds elsewhere.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/7af090c3b960d6dc. Report an issue: GitHub.