prestodb/presto · error · AccessDeniedException

Cannot grant roles %s to %s

Error message

Cannot grant roles %s to %s 

What it means

Thrown by denyGrantRoles when GRANT ROLE ... TO <principals> is rejected by checkCanGrantRoles. Granting a role requires holding that role with the admin/grant option; the check also inspects the grantees set. Note the message ends with a trailing space by design of the format string.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:407

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot revoke roles %s from %s ", roles, grantees));
    }

    public static void denySetRole(String role)
    {
        throw new AccessDeniedException(format("Cannot set role %s", role));
    }

    public static void denyCreateBranch(String tableName)
    {
        denyCreateBranch(tableName, null);
    }

    public static void denyCreateBranch(String tableName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Ask a security admin (holder of the role WITH ADMIN OPTION) to perform the GRANT.
2. Obtain the admin option on the specific role if policy permits delegating it to you.
3. Check grantee principals — grants to them may be individually blocked.
4. Confirm you are granting in the correct catalog where your admin option applies.

Example fix

// before (denied: alice lacks admin option)
GRANT finance_readers TO USER bob; -- run by alice
// after: run by admin who holds finance_readers WITH ADMIN OPTION

// Verify admin option on each role and grantee policy before granting
for (String role : roles) {
    if (!holdsRoleWithAdminOption(currentUser, role)) {
        throw new IllegalStateException("Missing ADMIN OPTION on role " + role);
    }
}

try {
    stmt.execute(grantSql);
} catch (AccessDeniedException e) {
    log.warn("GRANT {} denied: {} — routing to security admin queue", roles, e.getMessage());
}

When it happens

Trigger: Executing 'GRANT <role> TO USER/ROLE <grantee>' when the current user lacks the admin option for the given roles or is not permitted to grant to those grantees.

Common situations: Team leads granting access without delegated admin option; provisioning scripts granting to principals outside policy; multi-catalog setups where admin option exists in one catalog but not another.

Related errors

• Cannot show role grants from catalog %s
• Cannot create role %s
• Cannot drop role %s
• Cannot revoke roles %s from %s
• Cannot set catalog session property:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/36789b8b5eff663e. Report an issue: GitHub.