What causes "Cannot select from view %s%s" in prestodb/presto?

GRANT SELECT ON the view to the user/role

prestodb/presto · error · AccessDeniedException

Cannot select from view %s%s

Error message

Cannot select from view %s%s

What it means

Thrown when the identity lacks SELECT privilege on a view. denySelectView fires from AccessControlManager.checkCanSelectFromView during query planning when a query reads from a view. View SELECT grants are separate from underlying table grants in Presto.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:312

    public static void denyDropView(String viewName)
    {
        denyDropView(viewName, null);
    }

    public static void denyDropView(String viewName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot drop view %s%s", viewName, formatExtraInfo(extraInfo)));
    }

    public static void denySelectView(String viewName)
    {
        denySelectView(viewName, null);
    }

    public static void denySelectView(String viewName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from view %s%s", viewName, formatExtraInfo(extraInfo)));
    }

    public static void denyGrantTablePrivilege(String privilege, String tableName)
    {
        denyGrantTablePrivilege(privilege, tableName, null);
    }

    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot grant privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName)
    {
        denyRevokeTablePrivilege(privilege, tableName, null);
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

GRANT SELECT ON the view to the user/role
Verify whether underlying table grants are needed too (connector semantics) and grant accordingly
Use a role with view SELECT and SET ROLE before querying

Example fix

// before
SELECT * FROM analytics.daily; -- AccessDeniedException
// after (as admin)
GRANT SELECT ON analytics.daily TO USER analyst;

Defensive patterns

Strategy: try-catch

Validate before calling

boolean canSelect = catalogAdmin.userHasPrivilege(user, viewName, "SELECT");

Try / catch

try {
    return query("SELECT * FROM " + viewName);
} catch (AccessDeniedException e) {
    log.error("SELECT on view {} denied for {}: {}", viewName, user, e.getMessage());
    throw new SecurityException("Request SELECT grant on the view", e);
}

Prevention

Grant SELECT on both views and the base tables your consumers need (per connector semantics)
Use roles so view access can be managed in one place
Audit view grants after refactors that add new views

When it happens

Trigger: Any query selecting from a view where the session identity is not granted SELECT on the view; e.g. SELECT * FROM analytics.daily with no grant on the view itself.

Common situations: Users granted SELECT on base tables but not the view (or vice versa); revoking view access to hide data while exposing tables; system access control file missing view rules.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/5f751a9303aa5871. Report an issue: GitHub.