What causes "No matching AWS Lake Formation Security Mapping" in prestodb/presto?

prestodb/presto · error · AccessDeniedException

No matching AWS Lake Formation Security Mapping

Error message

No matching AWS Lake Formation Security Mapping

What it means

AWSSecurityMappings.getAWSLakeFormationSecurityMapping finds the first security mapping whose user-access expression matches the requesting user. If no mapping matches, it throws AccessDeniedException('No matching AWS Lake Formation Security Mapping'), denying Lake Formation access for that principal. It is the Lake Formation equivalent of 'no IAM role mapping found for this user'.

Source

Thrown at presto-hive-common/src/main/java/com/facebook/presto/hive/aws/security/AWSSecurityMappings.java:46

{
    private final List<AWSSecurityMapping> awsSecurityMappings;

    @JsonCreator
    public AWSSecurityMappings(@JsonProperty("mappings") List<AWSSecurityMapping> awsSecurityMappings)
    {
        checkArgument(awsSecurityMappings != null, "No AWS Security mappings configured");

        this.awsSecurityMappings = ImmutableList.copyOf(awsSecurityMappings);
    }

    public AWSSecurityMapping getAWSLakeFormationSecurityMapping(String user)
    {
        Optional<AWSSecurityMapping> awsSecurityMapping = awsSecurityMappings.stream()
                .filter(mapping -> (mapping.matches(user)))
                .findFirst();

        if (!awsSecurityMapping.isPresent()) {
            throw new AccessDeniedException("No matching AWS Lake Formation Security Mapping");
        }

        verify(!awsSecurityMapping.get().getCredentials().isPresent(),
                "Basic AWS Credentials are not supported for AWS Lake Formation Security Mapping");

        verify(awsSecurityMapping.get().getIamRole().isPresent(),
                "iamRole is mandatory for AWS Lake Formation Security Mapping");

        return awsSecurityMapping.get();
    }

    public AWSSecurityMapping getAWSS3SecurityMapping(String user)
    {
        Optional<AWSSecurityMapping> awsSecurityMapping = awsSecurityMappings.stream()
                .filter(mapping -> mapping.matches(user))
                .findFirst();

        return awsSecurityMapping.orElseThrow(() -> new AccessDeniedException("No matching AWS S3 Security Mapping"));

View on GitHub (pinned to 55bb57d202)

Solutions

Add or fix a security-mapping entry whose user-access expression matches the requesting principal, with an iam-role configured.
Test the regex against the exact user string (it is case-sensitive); adjust the pattern.
Ensure the matched mapping has an IAM role and no basic AWS credentials (both are enforced after the match).
Review presto-log for the actual user identity passed in — it may include a realm/ARN prefix your pattern doesn't cover.

Example fix

// before (security mapping JSON)
{"userAccess": "^alice$", "iamRole": "arn:aws:iam::123:role/lf"}
// after
{"userAccess": "^(alice|bob)$", "iamRole": "arn:aws:iam::123:role/lf"}

Defensive patterns

Strategy: validation

Validate before calling

Optional<AWSSecurityMapping> m = securityMappings.stream()
    .filter(x -> x.matches(currentUser))
    .findFirst();
if (!m.isPresent() || !m.get().getIamRole().isPresent()) {
    throw new AccessDeniedException("user not mapped to a Lake Formation role: " + currentUser);
}

Try / catch

try {
    mapping = awsSecurityMappings.getAWSLakeFormationSecurityMapping(user);
} catch (AccessDeniedException e) {
    // return clear 403-style error to client with guidance to contact admin
}

Prevention

Maintain a default/catch-all mapping or explicit onboarding step for new users/groups.
Test mapping regexes against exact principal strings (case-sensitive).
Always include iam-role in Lake Formation mappings; never basic credentials.
Log the effective user identity used for matching to debug pattern misses.

When it happens

Trigger: A query/principal accesses a Lake Formation-governed table while aws security-mapping entries' user-access regexes match no user; also thrown for a matching mapping that wrongly defines basic credentials or lacks an IAM role (the verify() calls right after).

Common situations: New user/group not covered by existing mapping patterns; typo in user-access regex; case-sensitivity mismatch; IAM role omitted from the mapping entry; Lake Formation enabled in catalog config but mappings file not updated after onboarding teams.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/672b15d044f955bc. Report an issue: GitHub.