What causes "Cannot insert into table %s%s" in prestodb/presto?

Grant INSERT privilege on the table to the executing principal in the connector's authorization system.

prestodb/presto · error · AccessDeniedException

Cannot insert into table %s%s

Error message

Cannot insert into table %s%s

What it means

Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to insert rows into a table. The connector's AccessControl.checkCanInsertIntoTable implementation denied the INSERT statement via denyInsertTable. This is an intentional authorization denial for write operations.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:227

    public static void denySelectTable(String tableName)
    {
        denySelectTable(tableName, null);
    }

    public static void denySelectTable(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyInsertTable(String tableName)
    {
        denyInsertTable(tableName, null);
    }

    public static void denyInsertTable(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot insert into table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyDeleteTable(String tableName)
    {
        denyDeleteTable(tableName, null);
    }

    public static void denyDeleteTable(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot delete from table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyTruncateTable(String tableName)
    {
        denyTruncateTable(tableName, null);
    }

    public static void denyTruncateTable(String tableName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

Grant INSERT privilege on the table to the executing principal in the connector's authorization system.
Run the ETL/write job with a service account that has write access.
Confirm the target table's owner/ACLs (e.g. underlying filesystem permissions for Hive).
Connector authors: implement checkCanInsertIntoTable with real checks instead of unconditional denyInsertTable.

Example fix

// before
INSERT INTO reports.t VALUES (...); -- Access Denied: Cannot insert into table reports.t

// after
-- as account with insert grant
GRANT INSERT ON reports.t TO USER etl;  -- in the backing authorization system
INSERT INTO reports.t VALUES (...);

Defensive patterns

Strategy: validation

Validate before calling

boolean canInsert = grantsContain(showGrants(table), serviceAccount, "INSERT");
if (!canInsert) {
    throw new IllegalStateException("Service account lacks INSERT on " + table);
}

Prevention

Provision ETL service accounts with INSERT grants at table creation.
Check underlying storage ACLs (Hive/HDFS permissions) in addition to Presto grants.
Fail fast in pipeline startup by verifying write grants before loading data.
Avoid reusing read-only connectors for write workloads.

When it happens

Trigger: Executing INSERT INTO t ... where the connector's checkCanInsertIntoTable(Identity, SchemaTableName) denies the user; also hit via CREATE TABLE AS with write-backed catalogs lacking insert grants.

Common situations: ETL jobs running as underprivileged service accounts; Hive tables owned by another user; connectors that are read-only (deny all inserts by design); permissions revoked during role cleanups.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/47b4cb90dcb2972a. Report an issue: GitHub.