What causes "Cannot drop role %s" in prestodb/presto?

Have a security admin execute the DROP ROLE.

prestodb/presto · error · AccessDeniedException

Cannot drop role %s

Error message

Cannot drop role %s

What it means

Thrown by denyDropRole when DROP ROLE is rejected by checkCanDropRole. Dropping a role invalidates grants across the catalog, so only role administrators may do it. The message identifies the role being dropped.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:402

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot revoke roles %s from %s ", roles, grantees));
    }

    public static void denySetRole(String role)
    {
        throw new AccessDeniedException(format("Cannot set role %s", role));
    }

    public static void denyCreateBranch(String tableName)

View on GitHub (pinned to 55bb57d202)

Solutions

Have a security admin execute the DROP ROLE.
Grant the principal drop-role (admin) rights in the access control configuration if legitimate.
Verify the role name and that you are on the intended catalog.
Revoke grants and archive membership first per your governance process, then drop as admin.

Example fix

// before (denied)
DROP ROLE old_contractors;
// after: run under admin credentials, e.g. via the security-admin account

Defensive patterns

Strategy: try-catch

Validate before calling

if (!hasRoleAdminOption(currentUser, roleName)) {
    throw new IllegalStateException("DROP ROLE " + roleName + " requires the admin option");
}

Try / catch

try {
    stmt.execute("DROP ROLE " + roleName);
} catch (AccessDeniedException e) {
    log.error("Role drop denied for {}: {}", roleName, e.getMessage());
    throw e;
}

Prevention

Keep role cleanup in admin-only automation pipelines.
Confirm catalog + role name to avoid dropping in the wrong environment.
Record role drops in an audit log for governance.

When it happens

Trigger: Executing 'DROP ROLE <role>' in a catalog whose access control denies the current user role-admin rights for that role.

Common situations: Cleanup scripts removing obsolete roles run by non-admins; dropping a role in the wrong catalog/environment; automated TTL cleanup jobs with insufficient privileges.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/08b653c208f52da1. Report an issue: GitHub.