Enabling Secure, Fine-Grained Resource Sharing for Team Collaboration in OpenSearch
summary
OpenSearch adds an owner-driven sharing layer to the Security plugin called Resource Sharing Framework that replaces ad-hoc “filter by backend role” and tenant models with per-resource owners, named access levels, REST APIs (PUT/PATCH/GET/list/types), and a migration API that assigns a default owner. Implementation uses one-to-one companion indices, DLS query-time filtering via stored shared principals, a new doc-request type and an async authorizer. Four plugins already onboard (anomaly detection, ML, reporting, flow); demo shows a Google-Docs–style plugin working with real-time edits and expected permission enforcement.
AI-written summary · about
chapters (8)
- 0:00Resource sharing in OpenSearch
- 1:05Current sharing models limits
- 9:16Extensibility for security plugins
- 12:06Ownership-based access control
- 18:10APIs for plugin developers
- 23:46Live demo: Docs plugin
- 30:32Future work and dashboards
- 33:26Summary and Q&A
related talks
30mFuture Paths for the OpenSearch Security Layer
17mFine-Grained Authorization for Secure RAG With OpenSearch
14mOpenSearch Data Separation With JWT Authentication for Multi-tenant Applications
29mThreat Modeling for OpenSearch: Identifying and Mitigating Security Risks
41mSecuring OpenSearch: Hints for avoiding common hassles
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
13mOpenSearch at Atlassian Scale
35mManaging the Managed: Advanced Automation and Security for Amazon...