title: PyHive connecting to Hive on Dataproc got VPC_SERVICE_CONTROLS PERMISSION_DENIED NO_MATCHING_ACCESS_LEVEL error
body: <p>I'm using <code>pyhive</code> to connect to Hive on GCP Dataproc. Queries succeed and fail intermittently. This is one of the issues. It happened during a</p>
  <pre><code>DROP TABLE IF EXISTS db_name.tb_name
  </code></pre>
  <p>Client side got</p>
  <pre><code>Traceback (most recent call last):
    File &quot;/usr/local/lib/python3.7/site-packages/thrift/transport/TSocket.py&quot;, line 154, in write
      plus = self.handle.send(buff)
  BrokenPipeError: [Errno 32] Broken pipe
  
  During handling of the above exception, another exception occurred:
  
  Traceback (most recent call last):
    ...
    ...
      self._cursor.execute(sql, *args, **kwargs)  # type: ignore
    File &quot;/usr/local/lib/python3.7/site-packages/pyhive/hive.py&quot;, line 356, in execute
      self._reset_state()
    File &quot;/usr/local/lib/python3.7/site-packages/pyhive/hive.py&quot;, line 266, in _reset_state
      response = self._connection.client.CloseOperation(request)
    File &quot;/usr/local/lib/python3.7/site-packages/TCLIService/TCLIService.py&quot;, line 651, in CloseOperation
      self.send_CloseOperation(req)
    File &quot;/usr/local/lib/python3.7/site-packages/TCLIService/TCLIService.py&quot;, line 660, in send_CloseOperation
      self._oprot.trans.flush()
    File &quot;/usr/local/lib/python3.7/site-packages/thrift_sasl/__init__.py&quot;, line 143, in flush
      self._flushPlain(buffer)
    File &quot;/usr/local/lib/python3.7/site-packages/thrift_sasl/__init__.py&quot;, line 166, in _flushPlain
      self._trans.write(struct.pack(&quot;&gt;I&quot;, len(buffer)) + buffer)
    File &quot;/usr/local/lib/python3.7/site-packages/thrift/transport/TSocket.py&quot;, line 161, in write
      raise TTransportException(message=&quot;unexpected exception&quot;, inner=e)
  thrift.transport.TTransport.TTransportException: unexpected exception
  </code></pre>
  <p>Server side log contains a lot of</p>
  <pre><code>{
    &quot;protoPayload&quot;: {
      &quot;@type&quot;: &quot;type.googleapis.com/google.cloud.audit.AuditLog&quot;,
      &quot;status&quot;: {
        &quot;code&quot;: 7,
        &quot;message&quot;: &quot;PERMISSION_DENIED&quot;,
        &quot;details&quot;: [
          {
            &quot;@type&quot;: &quot;type.googleapis.com/google.rpc.PreconditionFailure&quot;,
            &quot;violations&quot;: [
              {
                &quot;type&quot;: &quot;VPC_SERVICE_CONTROLS&quot;,
                &quot;description&quot;: &quot;enVxsuY7TYqavK8rl_fwvgr3yn4-9bneHjDTtQFvton7C03R3sHaXA&quot;
              }
            ]
          }
        ]
      },
      &quot;authenticationInfo&quot;: {},
      &quot;requestMetadata&quot;: {
        &quot;callerIp&quot;: &quot;73.252.204.93&quot;,
        &quot;requestAttributes&quot;: {},
        &quot;destinationAttributes&quot;: {}
      },
      &quot;serviceName&quot;: &quot;dataproc.googleapis.com&quot;,
      &quot;methodName&quot;: &quot;google.cloud.dataproc.v1beta2.ClusterController.ListClusters&quot;,
      &quot;resourceName&quot;: &quot;projects/xxx&quot;,
      &quot;metadata&quot;: {
        &quot;securityPolicyInfo&quot;: {
          &quot;servicePerimeterName&quot;: &quot;accessPolicies/xxx/servicePerimeters/Production_Security_Zone&quot;,
          &quot;organizationId&quot;: &quot;xxx&quot;
        },
        &quot;violationReason&quot;: &quot;NO_MATCHING_ACCESS_LEVEL&quot;,
        &quot;ingressViolations&quot;: [
          {
            &quot;servicePerimeter&quot;: &quot;accessPolicies/xxx/servicePerimeters/Production_Security_Zone&quot;,
            &quot;targetResource&quot;: &quot;xxx&quot;
          }
        ],
        &quot;@type&quot;: &quot;type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata&quot;,
        &quot;resourceNames&quot;: [
          &quot;xxx&quot;
        ],
        &quot;vpcServiceControlsUniqueId&quot;: &quot;xxx&quot;,
        &quot;accessLevels&quot;: [
          &quot;no_matching_definitions&quot;
        ]
      }
    },
    &quot;insertId&quot;: &quot;xxx&quot;,
    &quot;resource&quot;: {
      &quot;type&quot;: &quot;audited_resource&quot;,
      &quot;labels&quot;: {
        &quot;method&quot;: &quot;google.cloud.dataproc.v1beta2.ClusterController.ListClusters&quot;,
        &quot;project_id&quot;: &quot;xxx&quot;,
        &quot;service&quot;: &quot;dataproc.googleapis.com&quot;
      }
    },
    &quot;timestamp&quot;: &quot;2021-03-13T08:09:35.213190134Z&quot;,
    &quot;severity&quot;: &quot;ERROR&quot;,
    &quot;logName&quot;: &quot;projects/xxx/logs/cloudaudit.googleapis.com%2Fpolicy&quot;,
    &quot;receiveTimestamp&quot;: &quot;2021-03-13T08:09:35.968888182Z&quot;
  }
  </code></pre>
  <p>I'm connecting from a Mac laptop behind VPN.</p>
  <p>sasl3==0.2.11</p>
  <p>thrift==0.13.0</p>
  <p>thrift-sasl==0.4.2</p>
  <p>pyhive==0.6.3</p>
  <p>Any pointers how to fix this? Seems to be server side permission setting? Thanks!!</p>