What causes "Unknown privilege: '%s'" in prestodb/presto?

Replace the privilege with a supported Presto privilege name (check the Privilege enum / docs)

prestodb/presto · error · SemanticException

INVALID_PRIVILEGE

INVALID_PRIVILEGE

Error message

Unknown privilege: '%s'

What it means

Thrown by GrantTask.parsePrivilege when the privilege string in a GRANT statement does not case-insensitively match any Presto Privilege enum value. The loop over Privilege.values() fails, so the statement is rejected with INVALID_PRIVILEGE.

Source

Thrown at presto-main-base/src/main/java/com/facebook/presto/execution/GrantTask.java:87

        // verify current identity has permissions to grant permissions
        for (Privilege privilege : privileges) {
            accessControl.checkCanGrantTablePrivilege(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), privilege, tableName, createPrincipal(statement.getGrantee()), statement.isWithGrantOption());
        }

        metadata.grantTablePrivileges(session, tableName, privileges, createPrincipal(statement.getGrantee()), statement.isWithGrantOption());
        return immediateFuture(null);
    }

    private static Privilege parsePrivilege(Grant statement, String privilegeString)
    {
        for (Privilege privilege : Privilege.values()) {
            if (privilege.name().equalsIgnoreCase(privilegeString)) {
                return privilege;
            }
        }

        throw new SemanticException(INVALID_PRIVILEGE, statement, "Unknown privilege: '%s'", privilegeString);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

Replace the privilege with a supported Presto privilege name (check the Privilege enum / docs)
Use ALL to grant all applicable privileges
For connector-specific grants, use the connector's own security mechanism instead of GRANT

Example fix

// before
GRANT READ ON sales.orders TO USER bob;
// after
GRANT SELECT ON sales.orders TO USER bob;

Defensive patterns

Strategy: validation

Validate before calling

Set<String> valid = Arrays.stream(Privilege.values()).map(Enum::name).collect(Collectors.toSet());
if (!valid.contains(privilegeString.toUpperCase(Locale.ENGLISH))) {
    throw new IllegalArgumentException("Unknown privilege: " + privilegeString);
}

Try / catch

try { executeGrant(stmt); } catch (SemanticException e) { if (e.getCode() == SemanticErrorCode.INVALID_PRIVILEGE) { /* surface allowed privilege names to the user */ } throw e; }

Prevention

Whitelist privilege strings against Privilege.values() before building SQL
Never copy privilege keywords from other database dialects without mapping
Use ALL instead of enumerating unknown privilege names

When it happens

Trigger: Executing `GRANT <word> ON table TO user` where <word> is not one of the supported privilege names (e.g. SELECT, INSERT, DELETE, ...). Any unrecognized token (typo, connector-specific privilege, ALL misspelled) hits this path.

Common situations: Typing 'READ' or 'WRITE' which Presto does not define; copying ANSI/other-database privilege keywords; forgetting that non-grantable syntax like ALL PRIVILEGES must be written exactly as ALL.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/e1f7f2825f41d41d. Report an issue: GitHub.