prestodb/presto · warning · PrestoException

PERMISSION_DENIED

PERMISSION_DENIED

Error message

DROP TABLE is disabled in this catalog

What it means

ClickHouseMetadata.dropTable() checks the catalog's allowDropTable flag (presto-clickhouse.allow-drop-table) and refuses to drop tables when it is false, throwing PERMISSION_DENIED. This is an intentional safety guard, not an access-control failure.

Source

Thrown at presto-clickhouse/src/main/java/com/facebook/presto/plugin/clickhouse/ClickHouseMetadata.java:175

            }
            catch (TableNotFoundException e) {
                log.info("table disappeared during listing operation");
            }
        }
        return columns.build();
    }

    @Override
    public ColumnMetadata getColumnMetadata(ConnectorSession session, ConnectorTableHandle tableHandle, ColumnHandle columnHandle)
    {
        return ((ClickHouseColumnHandle) columnHandle).getColumnMetadata();
    }

    @Override
    public void dropTable(ConnectorSession session, ConnectorTableHandle tableHandle)
    {
        if (!allowDropTable) {
            throw new PrestoException(PERMISSION_DENIED, "DROP TABLE is disabled in this catalog");
        }
        ClickHouseTableHandle handle = (ClickHouseTableHandle) tableHandle;
        clickHouseClient.dropTable(ClickHouseIdentity.from(session), handle);
    }

    @Override
    public ConnectorOutputTableHandle beginCreateTable(ConnectorSession session, ConnectorTableMetadata tableMetadata, Optional<ConnectorNewTableLayout> layout)
    {
        ClickHouseOutputTableHandle handle = clickHouseClient.beginCreateTable(session, tableMetadata);
        setRollback(() -> clickHouseClient.rollbackCreateTable(ClickHouseIdentity.from(session), handle));
        return handle;
    }

    @Override
    public void createTable(ConnectorSession session, ConnectorTableMetadata tableMetadata, boolean ignoreExisting)
    {
        clickHouseClient.createTable(session, tableMetadata);
    }

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Set presto-clickhouse.allow-drop-table=true in the catalog properties file and restart/reload the connector
  2. Use TRUNCATE TABLE or DELETE instead if row/data removal suffices
  3. Drop the table directly in ClickHouse if that fits your workflow

Example fix

// before (clickhouse.properties)
connector.name=clickhouse
// after
connector.name=clickhouse
presto-clickhouse.allow-drop-table=true
Defensive patterns

Strategy: try-catch

Validate before calling

// Check catalog session properties before attempting DDL
boolean allowDrop = sessionProperties.get("allow_drop_table", "false").equals("true");
if (!allowDrop) {
    log.info("DROP TABLE disabled for this catalog; skipping");
    return;
}

Try / catch

try {
    dropTable(connectorTableHandle);
} catch (PrestoException e) {
    if (e.getErrorCode().getCode() == PERMISSION_DENIED.toErrorCode().getCode()
            && e.getMessage().contains("DROP TABLE is disabled")) {
        // enable allow-drop-table or drop via ClickHouse directly
    } else throw e;
}

Prevention

When it happens

Trigger: Executing DROP TABLE on any table in a ClickHouse catalog where allow-drop-table is not set to true (default is false).

Common situations: Default catalog configuration blocks destructive DDL; teams migrating from other connectors unaware the ClickHouse plugin disables DROP TABLE by default; CI pipelines that clean up tables.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/f543a75feeb14cea. Report an issue: GitHub.