prestodb/presto · error · AccessDeniedException

Cannot create view %s%s

Error message

Cannot create view %s%s

What it means

Thrown when the identity attempting CREATE VIEW lacks the CREATE_VIEW privilege on the target schema. The connector's access controller calls denyCreateView during checkCanCreateView. It indicates an authorization failure at the SPI security layer before the view metadata is written.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:267

    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames)
    {
        denyUpdateTableColumns(tableName, updatedColumnNames, null);
    }

    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot update columns [%s] in table %s%s", updatedColumnNames, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateView(String viewName)
    {
        denyCreateView(viewName, null);
    }

    public static void denyCreateView(String viewName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot create view %s%s", viewName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateViewWithSelect(String sourceName, Identity identity)
    {
        denyCreateViewWithSelect(sourceName, identity.toConnectorIdentity());
    }

    public static void denyCreateViewWithSelect(String sourceName, ConnectorIdentity identity)
    {
        denyCreateViewWithSelect(sourceName, identity, null);
    }

    public static void denyCreateViewWithSelect(String sourceName, ConnectorIdentity identity, String extraInfo)
    {
        throw new AccessDeniedException(format("View owner '%s' cannot create view that selects from %s%s", identity.getUser(), sourceName, formatExtraInfo(extraInfo)));
    }

    public static void denyRenameView(String viewName, String newViewName)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Grant the user CREATE_VIEW privilege on the target schema (or make them schema owner)
  2. Adjust system access control rules (e.g. security.json schema owner rules) to allow the user
  3. Use a role that has the required grant and re-run CREATE VIEW

Example fix

// before
CREATE VIEW analytics.daily AS SELECT ...; -- AccessDeniedException
// after (as admin)
GRANT CREATE VIEW ON SCHEMA analytics TO USER bob;
Defensive patterns

Strategy: try-catch

Validate before calling

// precheck: user should already be able to SELECT sources and own/create in schema
boolean canCreate = catalogAdmin.userHasPrivilege(user, schema, "CREATE_VIEW");

Try / catch

try {
    execute("CREATE VIEW " + name + " AS " + query);
} catch (AccessDeniedException e) {
    log.error("CREATE VIEW denied: {}", e.getMessage());
    throw new SecurityException("User lacks CREATE_VIEW on schema " + schema, e);
}

Prevention

When it happens

Trigger: Executing CREATE VIEW <name> AS ... when AccessControlManager.checkCanCreateView dispatches to the connector authorizer and it denies the operation for the current identity/schema.

Common situations: Non-privileged users creating views in schemas they do not own; tightened system access control (e.g. file-based security.json) without schema-owner rules; connector plugins denying view creation entirely.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/f4acc0d72e6ce6f7. Report an issue: GitHub.