Skip to content

Commit 3977aac

Browse files
Updates doc and addresses review dog errors
Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
1 parent 6483f70 commit 3977aac

File tree

1 file changed

+32
-5
lines changed

1 file changed

+32
-5
lines changed

_ml-commons-plugin/model-sharing-access-control.md

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ nav_order: 15
99
# ML model group access control
1010

1111
**Status:** Experimental
12-
**Replaces:** `plugins.ml_commons.model_access_control_enabled` (on deprecation path; see note below)
12+
**Replaces:** `plugins.ml_commons.model_access_control_enabled`
1313
{: .warning }
1414

1515
This page explains how **ML Commons** integrates with the Security plugin’s **Resource Sharing and Access Control** framework to provide **document-level** authorization for **ML model groups**.
@@ -23,20 +23,47 @@ This page explains how **ML Commons** integrates with the Security plugin’s **
2323

2424
- **Resource type:** `ml-model-group`
2525
- **System index:** `.plugins-ml-model-group`
26-
- **Onboarded in:** 3.3
26+
- **Onboarded in:** `3.3`
2727

2828
When resource-level authorization is enabled for this type, each model group’s visibility is governed by a central sharing record. Owners and users with share capability can grant or revoke access for specific **users**, **roles**, or **backend roles**.
2929

3030
Model-groups control access to models.
3131
{: .note } green
3232

33+
---
34+
## Enable or disable for this resource type
35+
36+
Add the type to the protected list and enable the feature.
37+
38+
### `opensearch.yml` (3.3+)
39+
40+
```yaml
41+
plugins.security.experimental.resource_sharing.enabled: true
42+
plugins.security.system_indices.enabled: true
43+
plugins.security.experimental.resource_sharing.protected_types:
44+
- "ml-model-group"
45+
````
46+
47+
### Dev Tools (3.4+)
48+
49+
```curl
50+
PUT _cluster/settings
51+
{
52+
"transient": {
53+
"plugins.security.experimental.resource_sharing.enabled": true,
54+
"plugins.security.experimental.resource_sharing.protected_types": ["ml-model-group", <existing-resource-types>]
55+
}
56+
}
57+
```
58+
{% include copy-curl.html %}
59+
3360
---
3461

3562
## ML model group access levels
3663

3764
ML-commons exposes **three access levels** for granting access to a ml-model-group:
3865

39-
### 1. ml_read_only
66+
### ml_read_only
4067
This read-only access level grants a read and search only access to the shared model-group.
4168

4269
Following actions are allowed with this access-level:
@@ -45,15 +72,15 @@ Following actions are allowed with this access-level:
4572
- "cluster:admin/opensearch/ml/models/get"
4673
```
4774

48-
### 2. ml_read_write
75+
### ml_read_write
4976
This read-write access level grants full access to a ml-model-group except share.
5077

5178
Following actions are allowed with this access level:
5279
```yaml
5380
- "cluster:admin/opensearch/ml/*"
5481
```
5582

56-
### 3. ml_full_access
83+
### ml_full_access
5784
This access level grants complete access to a ml-model-group and will allow shared user owner-like permission.
5885

5986
Following actions are allowed with this access level:

0 commit comments

Comments
 (0)