Future Paths for the OpenSearch Security Layer
summary
Proposal introduces an feature flag gated change that returns only the indices a user actually has privileges for (RFC #584814) by reusing ignore_unavailable and tightening alias semantics; a new ownership based resource sharing model stores creator, supports public/private/restricted scopes and four access levels (read/comment/editor/full); API tokens carry permissions directly and enable token-based job security plus a dashboards UI for token lifecycle; plans also include an API-backed thin client to replace the security admin CLI (RFC #5838), sandboxed plugins (5052) and FIPS and field level security work.
AI-written summary · about
chapters (12)
- 0:00OpenSearch Security Layer intro
- 1:06Community governance
- 3:34Security plugin architecture
- 4:59Enhanced index privileges
- 8:31Ownership-based authorization
- 15:12Dashboards app permissions
- 16:17Privileges fine-tuning
- 19:49API tokens for permissions
- 23:42Security tooling improvements
- 25:46FIPS compliance features
- 27:10Plugin sandboxing roadmap
- 28:57Q&A
related talks
40mUpcoming Changes for the OpenSearch Index Authorization Mechanisms
38mEnabling Secure, Fine-Grained Resource Sharing for Team Collaboration in OpenSearch
21mA Brief Guide to Secure Agentic Knowledge Retrieval
17mFine-Grained Authorization for Secure RAG With OpenSearch
36mThe Forbidden Index: How We Turned OpenSearch Into a Privacy-Preserving Superhero
29mThreat Modeling for OpenSearch: Identifying and Mitigating Security Risks
41mSecuring OpenSearch: Hints for avoiding common hassles
13mOpenSearch Project Roadmap 2022 and Beyond