Description

Ensure AI Notebooks, AI Training jobs, and AI Deploy apps are created with Restricted access, which requires a username and password or an AI token, rather than Public access, which exposes the service to anyone with its link.

Rationale

With Public access, anyone who gets the link can open the notebook or app and see or change its code and data, with no authentication. This can expose training data, models, and credentials stored in notebooks. Restricted access requires authentication for every request.

Impact

  • Only authenticated users can access AI services

  • Protects code, data, and models

  • Users need a username and password or an AI token

Default Value

When creating a notebook, job, or app, you choose Public access or Restricted access.

Pre-Requisites

  • Permission to manage AI services in the Public Cloud project

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, open AI Notebooks, AI Training, and AI Deploy, and review the access type of each item.

  4. If any item uses Public access, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. For each public item, create a new notebook, job, or app with Restricted access, using the same image and data.

  4. Create AI users or tokens for the people and tools that need access.

  5. Stop and delete the public item.

Backout Plan

  1. Recreate the item with Public access if it must be public, and make sure it contains no sensitive data.

Reference