prestodb/presto · error · IllegalArgumentException

Unknown AccessMode:

Error message

Unknown AccessMode: 

What it means

CatalogAccessControlRule.fromJson parses the mode/access-mode field of a catalog access control rule and resolves it against AccessMode by lowercased name. Only the known AccessMode names (ALL, READ_ONLY) are accepted; any other string makes the lookup miss and throws IllegalArgumentException("Unknown AccessMode: <value>").

Source

Thrown at presto-main-base/src/main/java/com/facebook/presto/security/CatalogAccessControlRule.java:93

        }

        @JsonCreator
        public static AccessMode fromJson(Object value)
        {
            if (Boolean.TRUE.equals(value)) {
                return ALL;
            }
            if (Boolean.FALSE.equals(value)) {
                return NONE;
            }
            if (value instanceof String) {
                AccessMode accessMode = modeByName.get(((String) value).toLowerCase(Locale.US));
                if (accessMode != null) {
                    return accessMode;
                }
            }

            throw new IllegalArgumentException("Unknown " + AccessMode.class.getSimpleName() + ": " + value);
        }

        boolean implies(AccessMode other)
        {
            if (this == ALL && other == READ_ONLY) {
                return true;
            }
            return this == other;
        }
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Change the rule's mode to exactly "all" or "read_only" (case-insensitive) in the rules JSON
2. Re-check the AccessMode enum for the list of supported values in your Presto version
3. Validate the rules JSON against the expected schema before deploying
4. If a stricter/other mode is genuinely needed, it must be added to AccessMode upstream

Example fix

// before (rules.json)
{ "catalog": "sales", "accessMode": "read", "user": "alice" }
// after
{ "catalog": "sales", "accessMode": "READ_ONLY", "user": "alice" }

// validate rules JSON before loading
Set<String> allowed = Set.of("all", "read_only");
for (Map<String,Object> rule : rules) {
    Object mode = rule.get("accessMode");
    if (mode instanceof String && !allowed.contains(((String) mode).toLowerCase(Locale.US))) {
        throw new IllegalArgumentException("Rule accessMode must be one of " + allowed + ": " + mode);
    }
}

boolean isValidAccessMode(Object value) {
    return value instanceof String
        && ("all".equalsIgnoreCase((String) value) || "read_only".equalsIgnoreCase((String) value));
}

try {
    List<CatalogAccessControlRule> parsed = CatalogAccessControlRule.fromJson(rulesJson);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unknown AccessMode")) {
        log.error("Rules file has an unsupported access mode; fix the mode value", e);
    } else { throw e; }
}

When it happens

Trigger: Loading a catalog access control rules JSON whose rule contains mode or accessMode set to a string that is not a valid AccessMode name (or is null/not a String), e.g. "read", "readonly", "ReadWrite".

Common situations: Typo in the rules JSON file; invented mode names like "read_only" or "write"; hand-edited or migrated rules files; case handled (lowercased before lookup) so only wrong words, not wrong casing, trigger this.

Related errors

• Timeout is negative
• ROLE_ALREADY_EXIST
• MISSING_ROLE
• INVALID_FUNCTION_ARGUMENT
• Access control '%s' is already registered

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/c8b7dfcc2330b7f3. Report an issue: GitHub.