[Upload Model] Secure model location URL

[khoaisohd]

Background
Hi experts, today customers are able to upload models that already exist on another server, such as GitHub or S3 by providing the model URL. In the implementation, it looks like the model URL needs to be public so that it can be downloadable.
https://opensearch.org/docs/latest/ml-commons-plugin/ml-framework/#upload-model-to-opensearch
Current use case
In our use case, our customers want to bring their own model but they don't want to make it publicly, for example, the model is stored in a private S3 bucket
Question
Do we have a plan to support private access for model location URL, or is there any approach to make the model location access secure?

[austintlee]

You mean ml-commons does not use the AWS SDK for S3 to download models hosted in an S3 bucket?

[austintlee]

Is this covered by #1371 ?

[khoaisohd]

Yeah it is covered by #1371

[khoaisohd]

Hi @austintlee , yeah ml-commons does not use the AWS SDK for S3 to download models hosted in an S3 bucket.
I'm curious how people work with models in private S3 bucket, does people get pre-signed URL (within a short period of time) and then use that link to upload model?

[austintlee]

I am not sure, but I would guess people just download to a local storage and upload from there?

[ylwu-amzn]

@khoaisohd , your understanding is correct. ml-commons only supports public URL, so pre-signed URL works.

The second way is using pretrained model https://opensearch.org/docs/latest/ml-commons-plugin/pretrained-models/

@austintlee , correct , people can also download to a local storage , then upload from local file.

[khoaisohd]

I see, so here is what customers can do to use the model in a private bucket

• Create a pre-signed URL for the model in a private bucket with an expiration time of 5 minutes (assumed that should be enough to upload the model)
• Upload model using pre-signed URL

Do you think it is good enough or do we still need to wait for #1371
I'm considering the tradeoff between complexity and security perspective, it looks like the model URL only needs to be public for a short period of time