prestodb/presto · error · PrestoException

PERMISSION_DENIED

PERMISSION_DENIED

Error message

User does not have access to encryption key for encrypted column = %s. If returning 'null' for encrypted columns is acceptable to your query, please add 'set session hive.read_null_masked_parquet_encrypted_value_enabled=true' before your query

What it means

When opening a split fails because the exception is a HiddenColumnException, mapToPrestoException throws PERMISSION_DENIED. This means the column is a Parquet-encrypted column and the user does not have access to its encryption key, so the reader cannot decrypt it. The message points to the session property hive.read_null_masked_parquet_encrypted_value_enabled=true, which returns NULLs for encrypted columns instead of failing.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/parquet/ParquetPageSourceFactoryUtils.java:59

        }
        if (e instanceof ParquetCorruptionException) {
            throw new PrestoException(HIVE_BAD_DATA, e);
        }
        if (e instanceof AccessControlException) {
            throw new PrestoException(PERMISSION_DENIED, e.getMessage(), e);
        }
        if (nullToEmpty(e.getMessage()).trim().equals("Filesystem closed") ||
                e instanceof FileNotFoundException) {
            throw new PrestoException(HIVE_CANNOT_OPEN_SPLIT, e);
        }
        String message = format("Error opening Hive split %s (offset=%s, length=%s): %s", path, fileSplit.getStart(), fileSplit.getLength(), e.getMessage());
        if (e.getClass().getSimpleName().equals("BlockMissingException")) {
            throw new PrestoException(HIVE_MISSING_DATA, message, e);
        }
        if (e instanceof HiddenColumnException) {
            message = format("User does not have access to encryption key for encrypted column = %s. If returning 'null' for encrypted " +
                    "columns is acceptable to your query, please add 'set session hive.read_null_masked_parquet_encrypted_value_enabled=true' before your query", ((HiddenColumnException) e).getColumn());
            throw new PrestoException(PERMISSION_DENIED, message, e);
        }
        throw new PrestoException(HIVE_CANNOT_OPEN_SPLIT, message, e);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

Grant the querying user access to the column encryption key in the key provider (e.g. KMS ACL / ranger policy)
If NULL masking is acceptable, set the session property: SET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true; before the query
Exclude the encrypted columns from the SELECT list so the reader never needs the key
Re-write the table without encryption if encryption is no longer required

Example fix

-- before
SELECT ssn FROM hive.encrypted_table; -- PERMISSION_DENIED: no key access
-- after
SET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true;
SELECT ssn FROM hive.encrypted_table; -- returns NULLs instead of failing

Defensive patterns

Strategy: try-catch

Validate before calling

-- Verify key access before running the query (in your KMS/ranger tooling)
-- e.g. hadoop key list -metadata and check ACLs, or attempt a tiny probe query:
SELECT encrypted_col FROM hive.encrypted_table LIMIT 1;

Try / catch

try {
    execute("SELECT encrypted_col FROM hive.encrypted_table");
} catch (PrestoException e) {
    if (PERMISSION_DENIED.equals(e.getErrorCode())) {
        execute("SET SESSION hive.read_null_masked_parquet_encrypted_value_enabled = true");
        execute("SELECT encrypted_col FROM hive.encrypted_table"); // NULL-masked fallback
    } else { throw e; }
}

Prevention

Grant encryption-key access to all roles/users expected to query encrypted tables
Document the hive.read_null_masked_parquet_encrypted_value_enabled escape hatch for analysts
Probe encrypted tables with LIMIT 1 in CI before scheduling production jobs
Exclude encrypted columns from wide SELECT * queries unless needed

When it happens

Trigger: Querying a Hive table containing Parquet column encryption where the current user lacks the encryption key (key not granted in the KMS / Hive key provider); the underlying Hadoop FS call during split open wraps HiddenColumnException.

Common situations: Parquet column-level encryption configured by table owners but key grants not given to analyst users; moving queries to a service user without key ACLs; encrypted columns added via a CTAS with encryption flags while readers were not granted keys.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/e51ddf514924fab4. Report an issue: GitHub.