prestodb/presto · error · SemanticException

MISSING_ROLE

MISSING_ROLE

Error message

Role '%s' does not exist

What it means

Thrown by GrantRolesTask when a role being granted (or the specified grantor, when the grantor is of type ROLE) is not present in availableRoles for the catalog. Presto validates every specified role against accessControl.getAvailableRoles before calling metadata.grantRoles.

Source

Thrown at presto-main-base/src/main/java/com/facebook/presto/execution/GrantRolesTask.java:74

                .collect(toImmutableSet());
        boolean withAdminOption = statement.isWithAdminOption();
        Optional<PrestoPrincipal> grantor = statement.getGrantor().map(specification -> createPrincipal(session, specification));
        String catalog = createCatalogName(session, statement);

        Set<String> availableRoles = metadata.listRoles(session, catalog);
        Set<String> specifiedRoles = new LinkedHashSet<>();
        specifiedRoles.addAll(roles);
        grantees.stream()
                .filter(principal -> principal.getType() == ROLE)
                .map(PrestoPrincipal::getName)
                .forEach(specifiedRoles::add);
        if (grantor.isPresent() && grantor.get().getType() == ROLE) {
            specifiedRoles.add(grantor.get().getName());
        }

        for (String role : specifiedRoles) {
            if (!availableRoles.contains(role)) {
                throw new SemanticException(MISSING_ROLE, statement, "Role '%s' does not exist", role);
            }
        }

        accessControl.checkCanGrantRoles(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), roles, grantees, withAdminOption, grantor, catalog);
        metadata.grantRoles(session, roles, grantees, withAdminOption, grantor, catalog);

        return immediateFuture(null);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Create the role first with CREATE ROLE <role> IN <catalog>
2. Verify existing roles via SELECT * FROM <catalog>.information_schema.roles or SHOW ROLES IN <catalog>
3. Correct the role name or remove the GRANTED BY clause if the grantor role does not exist

Example fix

// before
GRANT analyst_role TO USER bob;
// after
CREATE ROLE analyst_role; -- in the target catalog
GRANT analyst_role TO USER bob;

-- verify roles exist before GRANT
SELECT role_name FROM <catalog>.information_schema.roles
WHERE role_name IN ('analyst_role', 'grantor_role');

try { grantRoles(...); } catch (SemanticException e) { if (e.getCode() == SemanticErrorCode.MISSING_ROLE) { /* create role then retry once */ } else { throw e; } }

When it happens

Trigger: Executing `GRANT role TO user` (or `GRANTED BY some_role`) where the role string is not in the catalog's available role set, raising SemanticException(MISSING_ROLE).

Common situations: Role never created (missing CREATE ROLE step); role created in a different catalog; typo in role name; grantor clause referencing a role the connector does not define.

Related errors

• NOT_SUPPORTED
• MISSING_TABLE
• MISSING_ROLE
• INVALID_TABLE_PROPERTY
• MISSING_ATTRIBUTE

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/a62d8aa7dab6769a. Report an issue: GitHub.