ERROR :403 , "errorMessage":"Unauthorized" when submitting MSQ job via API

Issue:

API used to submit the MSQ ingestion is /druid/v2/sql/task and when submitting the API, we see the below exception

{"taskId":"forbidden","state":"FAILED","error":{"error":"druidException","errorCode":"general","persona":"USER","category":"FORBIDDEN","errorMessage":"Unauthorized","context":{}}}

Solution:

This issue occurs when API users are not given appropriate permissions. For MSQ ingestion which uses the EXTERN function to read external data or write to an external location, the API users should have READ permission on the EXTERNAL Resource type.

Also, these are the minimum permissions needed to run the MSQ ingestion.

Related Documentation:

https://docs.imply.io/latest/druid/multi-stage-query/reference/#extern-function

https://docs.imply.io/latest/druid/operations/security-user-auth/#external