Version note: Reviewed September 4, 2026 against Apache Druid 37 documentation. Confirm the exact deployed version before applying configuration.

Apache Druid does not enable a production security posture by default. Treat the cluster as untrusted until supported authentication, authorization, TLS, network isolation, secret handling, logging, backup, and recovery controls are configured and tested.

Define the trust boundary

Run Druid under an unprivileged operating-system identity on protected networks. Restrict administrative and ingestion endpoints, disable unused services and JavaScript execution unless explicitly required, patch dependencies, and document responsibility for Routers, Brokers, Coordinators, Overlords, Historical processes, MiddleManagers or Indexers, ZooKeeper, metadata storage, and deep storage.

Use supported authentication and authorization

Load the documented security extension and configure an authenticator chain, authorizer, and internal-system escalator for the exact version. Basic Security stores users, credentials, roles, and permissions through documented Coordinator APIs; permissions contain a resource and a singular READ or WRITE action. Do not copy invented password-file or roles-file properties.

Prefer centralized enterprise identity where supported, require strong administrator authentication, rotate secrets, separate service identities, grant least privilege, and test denial as well as successful access. Protect credentials outside source control.

Encrypt communications and stored data

Configure TLS for client and internal paths, verify certificates and hostnames, restrict protocols and ciphers according to organizational policy, and test renewal. Druid does not itself encrypt segment files in deep storage; configure native storage encryption, key management, access policy, logging, retention, and recovery for each backing system.

Collect useful evidence

Druid configuration audit history and query request logging are separate features. Configure the documented audit manager and request logger, then protect, retain, monitor, and test the resulting records. Avoid logging sensitive query text without minimization and access controls. A log file is not automatically a complete or tamper-proof audit trail.

Back up and restore

Deep storage is authoritative for segment files; the metadata database contains essential cluster metadata and cannot be assumed reconstructable from segments. Use highly available production metadata storage, back it up consistently, protect deep storage, retain versioned configuration and secrets procedures, and rehearse recovery. Measure restore results against approved recovery time and recovery point objectives.

Production acceptance checklist

  1. Threat model, owners, inventory, and supported-version matrix approved.
  2. Authentication, authorization, internal identity, TLS, and network policy tested.
  3. Secrets, logs, backups, metadata store, deep storage, and keys protected.
  4. Denied access, certificate failure, dependency outage, restore, and incident procedures exercised.
  5. Capacity, latency, ingestion, query, recovery, and security acceptance evidence retained.

Compare platforms in Apache Druid versus Pinot, monitor pipelines with data pipeline monitoring tools, and govern permissions through data access governance.