Link Search Menu Expand Document Documentation Menu
Documentation

Model access control through resource sharing

This is an experimental feature and is not recommended for use in a production environment. For updates on the progress of the feature or if you want to leave feedback, join the discussion on the OpenSearch forum.

In ML Commons, access to models is controlled through model groups—collections of versions of a particular model that share the same access permissions. ML Commons integrates with the Security plugin’s resource sharing and access control framework to provide document-level authorization for these model group resources.

This resource sharing approach is the new method for controlling model group access and provides more flexible sharing capabilities than the original model access control system. Resource owners can grant specific access levels to users, roles, or backend roles for individual model groups.

For the end-to-end framework concepts and APIs, see Resource sharing and access control.

Resource configuration

The following table describes the machine learning (ML) model group resource configuration.

Field Value
Resource type ml-model-group
System index .plugins-ml-model-group
Onboarded version OpenSearch 3.3

When resource-level authorization is enabled for ML model groups, each model group’s visibility is governed by a central sharing record. Resource owners and users with sharing capabilities can grant or revoke access permissions for specific users, roles, or backend roles.

Enable ML model group resource sharing

To enable resource sharing for ML model groups, you must add the ml-model-group resource type to the protected types list and enable resource sharing cluster-wide.

Admin-only: These settings can be configured only by cluster administrators with superadmin privileges.

Configuration using opensearch.yml

Add the following settings to your opensearch.yml configuration file to enable resource sharing for ML model groups:

plugins.security.experimental.resource_sharing.enabled: true
plugins.security.system_indices.enabled: true
plugins.security.experimental.resource_sharing.protected_types:
  - "ml-model-group"

Configuration using the Cluster Settings API

Alternatively, you can enable resource sharing dynamically using the Cluster Settings API:

PUT _cluster/settings
{
  "transient": {
    "plugins.security.experimental.resource_sharing.enabled": true,
    "plugins.security.experimental.resource_sharing.protected_types": ["ml-model-group"]
  }
}

When adding the ml-model-group resource type to an existing configuration, include all previously configured resource types in the protected_types array.

ML model group access levels

ML Commons provides three predefined access levels for ML model group documents. These access levels determine the specific permissions granted to users who have been granted access to a model group resource.

ml_read_only

The ml_read_only read-only access level grants users the ability to view and search shared ML model groups but not modify them. This access level includes the following permissions:

- "cluster:admin/opensearch/ml/model_groups/get"
- "cluster:admin/opensearch/ml/models/get"

ml_read_write

The ml_read_write read-write access level grants users full access to ML model group operations except for sharing capabilities. This access level includes all read permissions plus write operations:

- "cluster:admin/opensearch/ml/*"

ml_full_access

The ml_full_access full access level grants users complete control over an ML model group, including owner-like permissions such as sharing the resource with other users. This access level includes all ML model group operations plus resource sharing permissions:

- "cluster:admin/opensearch/ml/*"
- "cluster:admin/security/resource/share"

These access levels are predefined and cannot be modified. To request additional access levels, create an issue in the ML Commons GitHub repository.

Migrating from the legacy framework

After enabling resource sharing and marking ML model groups as a protected resource type, cluster administrators must run the migration API to transfer existing model group sharing information from the legacy framework to the new resource sharing system.

Admin-only: The Migrate API can only be executed by cluster administrators with superadmin or REST admin privileges.

Use the following API call to migrate legacy ML model group sharing data to the resource sharing framework:

POST _plugins/_security/api/resources/migrate
{
  "source_index": ".plugins-ml-model-group",
  "username_path": "/owner/name",
  "backend_roles_path": "/owner/backend_roles",
  "default_owner": "<replace-with-existing-user>",
  "default_access_level": {
    "ml-model-group": "<select-appropriate-access-level>"
  }
}

Replace <replace-with-existing-user> with the username of an existing user who should own ML model groups without explicit ownership information. Replace <select-appropriate-access-level> with one of the available ML model group access levels: ml_read_only, ml_read_write, or ml_full_access.

350 characters left

Have a question? .

Want to contribute? or .