Apache
/
druid
mirror of https://github.com/apache/druid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

docs: add line about write datasource perm for overlord api (#14114) 

Co-authored-by: Katya Macedo  <38017980+ektravel@users.noreply.github.com>
This commit is contained in:
317brian 2023-05-19 14:56:24 -07:00 committed by GitHub
parent 269137c682
commit 9faf9ecf20
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/multi-stage-query/security.md
View File

@ -43,12 +43,18 @@ To submit a query:
Once a query is submitted, it executes as a [`query_controller`](concepts.md#execution-flow) task. Query tasks that Once a query is submitted, it executes as a [`query_controller`](concepts.md#execution-flow) task. Query tasks that
users submit to the MSQ task engine are Overlord tasks, so they follow the Overlord's security model. This means that users submit to the MSQ task engine are Overlord tasks, so they follow the Overlord's security model. This means that
users with access to the Overlord API can perform some actions even if they didn't submit the query, including users with access to the Overlord API can perform some actions even if they didn't submit the query, including
retrieving status or canceling a query. For more information about the Overlord API and the task API, see [APIs for SQL-based ingestion](../api-reference/sql-ingestion-api.md). retrieving status or canceling a query. For more information about the Overlord API and the task API, see [APIs for
SQL-based ingestion](../api-reference/sql-ingestion-api.md).
> Keep in mind that any user with access to Overlord APIs can submit `query_controller` tasks with only the WRITE DATASOURCE permission.
Depending on what a user is trying to do, they might also need the following permissions:
- `INSERT` or `REPLACE` queries: Users must have DATASOURCE READ permission on the output datasource.
- `SELECT` queries: Users must have READ permission on the `__query_select` datasource, which is a stub datasource that gets created.
To interact with a query through the Overlord API, users need the following permissions:
- `INSERT` or `REPLACE` queries: Users must have READ DATASOURCE permission on the output datasource.
- `SELECT` queries: Users must have read permissions on the `__query_select` datasource, which is a stub datasource that gets created.
## S3 ## S3