What causes "Role '%s' does not exist" in prestodb/presto?

List existing roles to confirm the exact name: SELECT * FROM .information_schema.roles or the connector's role listing.

prestodb/presto · error · SemanticException

MISSING_ROLE

MISSING_ROLE

Error message

Role '%s' does not exist

What it means

Thrown by DropRoleTask.execute when DROP ROLE names a role that is not in the set returned by metadata.listRoles for the target catalog. The role listing is fetched from the connector's system access control, so the role must exist in that specific catalog.

Source

Thrown at presto-main-base/src/main/java/com/facebook/presto/execution/DropRoleTask.java:50

public class DropRoleTask
        implements DDLDefinitionTask<DropRole>
{
    @Override
    public String getName()
    {
        return "DROP ROLE";
    }

    @Override
    public ListenableFuture<?> execute(DropRole statement, TransactionManager transactionManager, Metadata metadata, AccessControl accessControl, Session session, List<Expression> parameters, WarningCollector warningCollector, String query)
    {
        String catalog = createCatalogName(session, statement);
        String role = statement.getName().getValueLowerCase();
        accessControl.checkCanDropRole(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), role, catalog);
        Set<String> existingRoles = metadata.listRoles(session, catalog);
        if (!existingRoles.contains(role)) {
            throw new SemanticException(MISSING_ROLE, statement, "Role '%s' does not exist", role);
        }
        metadata.dropRole(session, role, catalog);
        return immediateFuture(null);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

List existing roles to confirm the exact name: SELECT * FROM <catalog>.information_schema.roles or the connector's role listing.
Verify the statement targets the catalog where the role was created (e.g. DROP ROLE x IN catalog if supported by your syntax/connector).
Check the connector's system access control configuration; the role may need to be created there first (CREATE ROLE).

Example fix

// before
DROP ROLE Admin; -- wrong catalog, role lives in 'hive'
// after
DROP ROLE admin IN hive;

Defensive patterns

Strategy: validation

Validate before calling

-- list roles in the target catalog first
SELECT role_name FROM <catalog>.information_schema.roles;
-- only issue DROP ROLE if the lowercased name is present

Prevention

Always use lowercase role names in scripts to match getValueLowerCase comparison.
Specify the correct catalog context when creating and dropping roles.
Treat role provisioning as catalog-scoped: create and drop in the same catalog.

When it happens

Trigger: DROP ROLE role_name where the lowercase role name is absent from metadata.listRoles(session, catalog) for the catalog derived via createCatalogName(session, statement); runs from runQuery after checkCanDropRole passes.

Common situations: Role defined in a different catalog than the one the session context resolves to; role already dropped; case-sensitivity confusion (name is lowercased before comparison); role exists in the identity provider but not registered with the connector's system access control.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/1531b642e1f0c11b. Report an issue: GitHub.