diff --git a/server/odc-service/src/main/java/com/oceanbase/odc/service/flow/FlowInstanceService.java b/server/odc-service/src/main/java/com/oceanbase/odc/service/flow/FlowInstanceService.java
index a9d642fa78..751b962e0c 100644
--- a/server/odc-service/src/main/java/com/oceanbase/odc/service/flow/FlowInstanceService.java
+++ b/server/odc-service/src/main/java/com/oceanbase/odc/service/flow/FlowInstanceService.java
@@ -300,9 +300,9 @@ public List<FlowInstanceDetailResp> create(@NotNull @Valid CreateFlowInstanceReq
         ConnectionConfig conn = null;
         if (Objects.nonNull(createReq.getConnectionId())) {
             conn = connectionService.getForConnectionSkipPermissionCheck(createReq.getConnectionId());
+            cloudMetadataClient.checkPermission(OBTenant.of(conn.getClusterName(),
+                    conn.getTenantName()), conn.getInstanceType(), false, CloudPermissionAction.READONLY);
         }
-        cloudMetadataClient.checkPermission(OBTenant.of(conn.getClusterName(),
-                conn.getTenantName()), conn.getInstanceType(), false, CloudPermissionAction.READONLY);
         return Collections.singletonList(buildFlowInstance(riskLevels, createReq, conn));
     }