prestodb/presto · error · AccessDeniedException

Cannot select from columns %s in table or view %s%s

Error message

Cannot select from columns %s in table or view %s%s

What it means

Thrown by denySelectColumns when checkCanSelectColumns denies a read of specific columns of a table or view. Presto supports column-level access control, so a user may see the table but not every column. Column names in the message are sorted; extraInfo may append the denial reason.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:382

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s.%s%s", catalogName, propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String propertyName)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s", propertyName));
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames)
    {
        denySelectColumns(tableName, columnNames, null);
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot call procedure %s%s", procedureName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot create role %s", roleName));
    }

    public static void denyDropRole(String roleName)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Restrict the SELECT list to explicitly granted columns.
2. Request a grant for the missing columns from the security admin.
3. Replace SELECT * with an explicit column list in tools/ORMs that expand all columns.
4. Confirm table name/catalog; column policies are per table or view.

Example fix

// before (denied: ssn not granted)
SELECT * FROM hive.secure.employees;
// after
SELECT employee_id, name FROM hive.secure.employees;

// Never emit SELECT * when column policies are in effect
List<String> granted = getGrantedColumns(user, table); // from your grants metadata
List<String> requested = explicitColumns;
if (!granted.containsAll(requested)) {
    throw new IllegalArgumentException("Columns not granted: " + new HashSet<>(requested) .stream().filter(c -> !granted.contains(c)).collect(toSet()));
}

try {
    rs = stmt.executeQuery(selectSql);
} catch (AccessDeniedException e) {
    // column-level denial — retry with only explicitly granted columns
    rs = stmt.executeQuery(buildSelectFromGrantedColumns(table, granted));
}

When it happens

Trigger: SELECT listing one or more columns (not SELECT *) the user is not granted on that table/view, e.g. policy granting only columns (a,b) but the query selects (a,c).

Common situations: Wide SELECT * against tables with sensitive columns (PII, salary) under column masking/row-filtering access controls; analytics tools auto-selecting all columns; newly added columns not covered by existing grants.

Related errors

• Cannot select from table %s%s
• Cannot select from view %s%s
• Unsupported privilege name:
• Cannot set catalog session property:
• ACCESS_DENIED

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/6092b5242060a159. Report an issue: GitHub.