prestodb/presto · error · AccessDeniedException

Cannot grant privilege %s on table %s%s

Error message

Cannot grant privilege %s on table %s%s

What it means

Thrown when the identity lacks the GRANT privilege needed to give another principal a privilege on a table. denyGrantTablePrivilege is called from AccessControlManager.checkCanGrantTablePrivilege. With grant options enabled, you additionally need the privilege WITH GRANT OPTION yourself.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:322

    public static void denySelectView(String viewName)
    {
        denySelectView(viewName, null);
    }

    public static void denySelectView(String viewName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from view %s%s", viewName, formatExtraInfo(extraInfo)));
    }

    public static void denyGrantTablePrivilege(String privilege, String tableName)
    {
        denyGrantTablePrivilege(privilege, tableName, null);
    }

    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot grant privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName)
    {
        denyRevokeTablePrivilege(privilege, tableName, null);
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot revoke privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyShowRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show roles from catalog %s", catalogName));
    }

    public static void denyShowCurrentRoles(String catalogName)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Have a catalog admin execute the GRANT
2. Grant the requester the privilege WITH GRANT OPTION first
3. Relax access control rules if delegation is intended

Example fix

// before (bob lacks grant option)
GRANT SELECT ON sales TO USER carol; -- AccessDeniedException
// after (as admin)
GRANT SELECT ON sales TO USER bob WITH GRANT OPTION;
-- bob now executes: GRANT SELECT ON sales TO USER carol;

// ensure grantor holds the privilege WITH GRANT OPTION before delegating
boolean canGrant = catalogAdmin.userHasPrivilegeWithGrantOption(grantor, table, privilege);

try {
    execute("GRANT " + privilege + " ON " + table + " TO USER " + grantee);
} catch (AccessDeniedException e) {
    throw new SecurityException("Escalate to a catalog admin or obtain grant option first", e);
}

When it happens

Trigger: GRANT SELECT ON t TO USER u where checkCanGrantTablePrivilege denies the grantor; or GRANT ... WITH GRANT OPTION without holding that option.

Common situations: Delegating access management to non-admin users; connectors whose authorizers only let catalog admins grant; confusion between role-based and user-based grant models.

Related errors

• Unsupported privilege name:
• Cannot revoke privilege %s on table %s%s
• Cannot set catalog session property:
• ACCESS_DENIED
• Cannot rename a column in table %s%s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/17f9b912b0cfea51. Report an issue: GitHub.