What causes "Cannot truncate table %s%s" in prestodb/presto?

Grant TRUNCATE/DELETE-style privilege or table ownership to the executing principal.

prestodb/presto · error · AccessDeniedException

Cannot truncate table %s%s

Error message

Cannot truncate table %s%s

What it means

Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to truncate a table. The connector's AccessControl.checkCanTruncateTable implementation denied TRUNCATE TABLE via denyTruncateTable. Truncation removes all rows, so most connectors restrict it to owners/admins or deny it entirely.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:247

    public static void denyDeleteTable(String tableName)
    {
        denyDeleteTable(tableName, null);
    }

    public static void denyDeleteTable(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot delete from table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyTruncateTable(String tableName)
    {
        denyTruncateTable(tableName, null);
    }

    public static void denyTruncateTable(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot truncate table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames)
    {
        denyUpdateTableColumns(tableName, updatedColumnNames, null);
    }

    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot update columns [%s] in table %s%s", updatedColumnNames, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateView(String viewName)
    {
        denyCreateView(viewName, null);
    }

    public static void denyCreateView(String viewName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

Grant TRUNCATE/DELETE-style privilege or table ownership to the executing principal.
Run the truncate as an owner/admin account.
If the connector does not support truncation, drop and recreate the table instead (with DROP privilege).
Connector authors: implement checkCanTruncateTable with real authorization rather than unconditional denyTruncateTable.

Example fix

// before
TRUNCATE TABLE staging.t; -- Access Denied: Cannot truncate table staging.t

// after
-- as owner/admin
TRUNCATE TABLE staging.t; -- OK

Defensive patterns

Strategy: validation

Validate before calling

boolean canTruncate = grantsContain(showGrants(table), currentUser, "DELETE") || isOwner(table, currentUser);
if (!canTruncate) {
    throw new IllegalStateException("Principal lacks truncate privileges on " + table);
}

Prevention

Use drop-and-recreate instead of TRUNCATE when the connector denies truncation.
Restrict truncate-capable credentials to ops/admin accounts only.
Confirm connector support for TRUNCATE before including it in reset scripts.
Keep table ownership assigned to the owning team's principal.

When it happens

Trigger: Executing TRUNCATE TABLE t where the connector's checkCanTruncateTable(Identity, SchemaTableName) denies the user; some connectors deny truncation unconditionally because the underlying store cannot support it.

Common situations: Test-data reset scripts as non-owner users; connectors (e.g. read-only or append-only stores) that deny truncate by design; revoked admin roles after permission audits.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/1ae5f9e59232bef7. Report an issue: GitHub.