diff --git a/sample-resource-plugin/README.md b/sample-resource-plugin/README.md
new file mode 100644
index 0000000000..ccd73db983
--- /dev/null
+++ b/sample-resource-plugin/README.md
@@ -0,0 +1,152 @@
+# Resource Sharing and Access Control Plugin
+
+This plugin demonstrates resource sharing and access control functionality, providing APIs to create, manage, and verify access to resources. The plugin enables fine-grained permissions for sharing and accessing resources, making it suitable for systems requiring robust security and collaboration.
+
+## Features
+
+- Create and delete resources.
+- Share resources with specific users, roles and/or backend_roles with specific scope(s).
+- Revoke access to shared resources for a list of or all scopes.
+- Verify access permissions for a given user within a given scope.
+- List all resources accessible to current user.
+
+## API Endpoints
+
+The plugin exposes the following six API endpoints:
+
+### 1. Create Resource
+- **Endpoint:** `POST /_plugins/sample_resource_sharing/create`
+- **Description:** Creates a new resource. Also creates a resource sharing entry if security plugin is enabled.
+- **Request Body:**
+  ```json
+  {
+    "name": "<resource_name>"
+  }
+  ```
+- **Response:**
+  ```json
+  {
+    "message": "Resource <resource_name> created successfully."
+  }
+  ```
+
+### 2. Delete Resource
+- **Endpoint:** `DELETE /_plugins/sample_resource_sharing/{resource_id}`
+- **Description:** Deletes a specified resource owned by the requesting user.
+- **Response:**
+  ```json
+  {
+    "message": "Resource <resource_id> deleted successfully."
+  }
+  ```
+
+### 3. Share Resource
+- **Endpoint:** `POST /_plugins/sample_resource_sharing/share`
+- **Description:** Shares a resource with specified users or roles with defined scope.
+- **Request Body:**
+  ```json
+    {
+      "resource_id" :  "{{ADMIN_RESOURCE_ID}}",
+      "share_with" : {
+        "SAMPLE_FULL_ACCESS": {
+            "users": ["test"],
+            "roles": ["test_role"],
+            "backend_roles": ["test_backend_role"]
+        },
+        "READ_ONLY": {
+            "users": ["test"],
+            "roles": ["test_role"],
+            "backend_roles": ["test_backend_role"]
+        },
+        "READ_WRITE": {
+            "users": ["test"],
+            "roles": ["test_role"],
+            "backend_roles": ["test_backend_role"]
+        }
+      }
+    }
+  ```
+- **Response:**
+  ```json
+    {
+    "message": "Resource <resource-id> shared successfully."
+    }
+  ```
+
+### 4. Revoke Access
+- **Endpoint:** `POST /_plugins/sample_resource_sharing/revoke`
+- **Description:** Revokes access to a resource for specified users or roles.
+- **Request Body:**
+  ```json
+    {
+      "resource_id" :  "<resource-id>",
+      "entities" : {
+            "users": ["test", "admin"],
+            "roles": ["test_role", "all_access"],
+            "backend_roles": ["test_backend_role", "admin"]
+      },
+      "scopes": ["SAMPLE_FULL_ACCESS", "READ_ONLY", "READ_WRITE"]
+    }
+  ```
+- **Response:**
+  ```json
+    {
+      "message": "Resource <resource-id> access revoked successfully."
+    }
+  ```
+
+### 5. Verify Access
+- **Endpoint:** `GET /_plugins/sample_resource_sharing/verify_resource_access`
+- **Description:** Verifies if a user or role has access to a specific resource with a specific scope.
+- **Request Body:**
+    ```json
+    {
+      "resource_id": "<resource-id>",
+      "scope": "SAMPLE_FULL_ACCESS"
+    }
+    ```
+- **Response:**
+  ```json
+  {
+    "message": "User has requested scope SAMPLE_FULL_ACCESS access to <resource-id>"
+  }
+  ```
+
+### 6. List Accessible Resources
+- **Endpoint:** `GET /_plugins/sample_resource_sharing/list`
+- **Description:** Lists all resources accessible to the requesting user or role.
+- **Response:**
+  ```json
+  {
+    "resource-ids": [
+        "<resource-id-1>",
+        "<resource-id-2>"
+    ]
+  }
+  ```
+
+## Installation
+
+1. Clone the repository:
+   ```bash
+   git clone git@github.com:opensearch-project/security.git
+   ```
+
+2. Navigate to the project directory:
+   ```bash
+   cd sample-resource-plugin
+   ```
+
+3. Build and deploy the plugin:
+   ```bash
+   $ ./gradlew clean build -x test -x integrationTest -x spotbugsIntegrationTest
+   $ ./bin/opensearch-plugin install file: <path-to-this-plugin>/sample-resource-plugin/build/distributions/opensearch-sample-resource-plugin-3.0.0.0-SNAPSHOT.zip
+   ```
+
+## License
+
+This code is licensed under the Apache 2.0 License.
+
+## Copyright
+
+Copyright OpenSearch Contributors.
diff --git a/sample-resource-plugin/build.gradle b/sample-resource-plugin/build.gradle
new file mode 100644
index 0000000000..e9822c1f22
--- /dev/null
+++ b/sample-resource-plugin/build.gradle
@@ -0,0 +1,166 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+apply plugin: 'opensearch.opensearchplugin'
+apply plugin: 'opensearch.testclusters'
+apply plugin: 'opensearch.java-rest-test'
+
+import org.opensearch.gradle.test.RestIntegTestTask
+
+
+opensearchplugin {
+    name 'opensearch-sample-resource-plugin'
+    description 'Sample plugin that extends OpenSearch Resource Plugin'
+    classname 'org.opensearch.sample.SampleResourcePlugin'
+}
+
+ext {
+    projectSubstitutions = [:]
+    licenseFile = rootProject.file('LICENSE.txt')
+    noticeFile = rootProject.file('NOTICE.txt')
+}
+
+repositories {
+    mavenLocal()
+    mavenCentral()
+    maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
+}
+
+dependencies {
+}
+
+def es_tmp_dir = rootProject.file('build/private/es_tmp').absoluteFile
+es_tmp_dir.mkdirs()
+
+File repo = file("$buildDir/testclusters/repo")
+def _numNodes = findProperty('numNodes') as Integer ?: 1
+
+licenseHeaders.enabled = true
+validateNebulaPom.enabled = false
+testingConventions.enabled = false
+loggerUsageCheck.enabled = false
+
+javaRestTest.dependsOn(rootProject.assemble)
+javaRestTest {
+    systemProperty 'tests.security.manager', 'false'
+}
+testClusters.javaRestTest {
+    testDistribution = 'INTEG_TEST'
+}
+
+task integTest(type: RestIntegTestTask) {
+    description = "Run tests against a cluster"
+    testClassesDirs = sourceSets.test.output.classesDirs
+    classpath = sourceSets.test.runtimeClasspath
+}
+tasks.named("check").configure { dependsOn(integTest) }
+
+integTest {
+    if (project.hasProperty('excludeTests')) {
+        project.properties['excludeTests']?.replaceAll('\\s', '')?.split('[,;]')?.each {
+            exclude "${it}"
+        }
+    }
+    systemProperty 'tests.security.manager', 'false'
+    systemProperty 'java.io.tmpdir', es_tmp_dir.absolutePath
+
+    systemProperty "https", System.getProperty("https")
+    systemProperty "user", System.getProperty("user")
+    systemProperty "password", System.getProperty("password")
+    // Tell the test JVM if the cluster JVM is running under a debugger so that tests can use longer timeouts for
+    // requests. The 'doFirst' delays reading the debug setting on the cluster till execution time.
+    doFirst {
+        // Tell the test JVM if the cluster JVM is running under a debugger so that tests can
+        // use longer timeouts for requests.
+        def isDebuggingCluster = getDebug() || System.getProperty("test.debug") != null
+        systemProperty 'cluster.debug', isDebuggingCluster
+        // Set number of nodes system property to be used in tests
+        systemProperty 'cluster.number_of_nodes', "${_numNodes}"
+        // There seems to be an issue when running multi node run or integ tasks with unicast_hosts
+        // not being written, the waitForAllConditions ensures it's written
+        getClusters().forEach { cluster ->
+            cluster.waitForAllConditions()
+        }
+    }
+
+    // The -Dcluster.debug option makes the cluster debuggable; this makes the tests debuggable
+    if (System.getProperty("test.debug") != null) {
+        jvmArgs '-agentlib:jdwp=transport=dt_socket,server=n,suspend=y,address=8000'
+    }
+    if (System.getProperty("tests.rest.bwcsuite") == null) {
+        filter {
+            excludeTestsMatching "org.opensearch.security.sampleextension.bwc.*IT"
+        }
+    }
+}
+project.getTasks().getByName('bundlePlugin').dependsOn(rootProject.tasks.getByName('build'))
+Zip bundle = (Zip) project.getTasks().getByName("bundlePlugin");
+Zip rootBundle = (Zip) rootProject.getTasks().getByName("bundlePlugin");
+integTest.dependsOn(bundle)
+integTest.getClusters().forEach{c -> {
+    c.plugin(rootProject.getObjects().fileProperty().value(rootBundle.getArchiveFile()))
+    c.plugin(project.getObjects().fileProperty().value(bundle.getArchiveFile()))
+}}
+
+testClusters.integTest {
+    testDistribution = 'INTEG_TEST'
+
+    // Cluster shrink exception thrown if we try to set numberOfNodes to 1, so only apply if > 1
+    if (_numNodes > 1) numberOfNodes = _numNodes
+    // When running integration tests it doesn't forward the --debug-jvm to the cluster anymore
+    // i.e. we have to use a custom property to flag when we want to debug OpenSearch JVM
+    // since we also support multi node integration tests we increase debugPort per node
+    if (System.getProperty("cluster.debug") != null) {
+        def debugPort = 5005
+        nodes.forEach { node ->
+            node.jvmArgs("-agentlib:jdwp=transport=dt_socket,server=n,suspend=y,address=*:${debugPort}")
+            debugPort += 1
+        }
+    }
+    setting 'path.repo', repo.absolutePath
+}
+
+afterEvaluate {
+    testClusters.integTest.nodes.each { node ->
+        def plugins = node.plugins
+        def firstPlugin = plugins.get(0)
+        if (firstPlugin.provider == project.bundlePlugin.archiveFile) {
+            plugins.remove(0)
+            plugins.add(firstPlugin)
+        }
+
+        node.extraConfigFile("kirk.pem", file("src/test/resources/security/kirk.pem"))
+        node.extraConfigFile("kirk-key.pem", file("src/test/resources/security/kirk-key.pem"))
+        node.extraConfigFile("esnode.pem", file("src/test/resources/security/esnode.pem"))
+        node.extraConfigFile("esnode-key.pem", file("src/test/resources/security/esnode-key.pem"))
+        node.extraConfigFile("root-ca.pem", file("src/test/resources/security/root-ca.pem"))
+        node.setting("plugins.security.ssl.transport.pemcert_filepath", "esnode.pem")
+        node.setting("plugins.security.ssl.transport.pemkey_filepath", "esnode-key.pem")
+        node.setting("plugins.security.ssl.transport.pemtrustedcas_filepath", "root-ca.pem")
+        node.setting("plugins.security.ssl.transport.enforce_hostname_verification", "false")
+        node.setting("plugins.security.ssl.http.enabled", "true")
+        node.setting("plugins.security.ssl.http.pemcert_filepath", "esnode.pem")
+        node.setting("plugins.security.ssl.http.pemkey_filepath", "esnode-key.pem")
+        node.setting("plugins.security.ssl.http.pemtrustedcas_filepath", "root-ca.pem")
+        node.setting("plugins.security.allow_unsafe_democertificates", "true")
+        node.setting("plugins.security.allow_default_init_securityindex", "true")
+        node.setting("plugins.security.authcz.admin_dn", "\n - CN=kirk,OU=client,O=client,L=test,C=de")
+        node.setting("plugins.security.audit.type", "internal_opensearch")
+        node.setting("plugins.security.enable_snapshot_restore_privilege", "true")
+        node.setting("plugins.security.check_snapshot_restore_write_privileges", "true")
+        node.setting("plugins.security.restapi.roles_enabled", "[\"all_access\", \"security_rest_api_access\"]")
+    }
+}
+
+run {
+    doFirst {
+        // There seems to be an issue when running multi node run or integ tasks with unicast_hosts
+        // not being written, the waitForAllConditions ensures it's written
+        getClusters().forEach { cluster ->
+            cluster.waitForAllConditions()
+        }
+    }
+    useCluster testClusters.integTest
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResource.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResource.java
new file mode 100644
index 0000000000..abef02ff35
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResource.java
@@ -0,0 +1,69 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ * Modifications Copyright OpenSearch Contributors. See
+ * GitHub history for details.
+ */
+
+package org.opensearch.sample;
+
+import java.io.IOException;
+import java.util.Map;
+
+import org.opensearch.accesscontrol.resources.Resource;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class SampleResource implements Resource {
+
+    private String name;
+    private String description;
+    private Map<String, String> attributes;
+
+    public SampleResource() {}
+
+    public SampleResource(StreamInput in) throws IOException {
+        this.name = in.readString();
+        this.description = in.readString();
+        this.attributes = in.readMap(StreamInput::readString, StreamInput::readString);
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        return builder.startObject().field("name", name).field("description", description).field("attributes", attributes).endObject();
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(name);
+        out.writeString(description);
+        out.writeMap(attributes, StreamOutput::writeString, StreamOutput::writeString);
+    }
+
+    @Override
+    public String getWriteableName() {
+        return "sample_resource";
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public void setAttributes(Map<String, String> attributes) {
+        this.attributes = attributes;
+    }
+
+    @Override
+    public String getResourceName() {
+        return name;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourcePlugin.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourcePlugin.java
new file mode 100644
index 0000000000..3119e2203a
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourcePlugin.java
@@ -0,0 +1,186 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+package org.opensearch.sample;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Supplier;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.action.ActionRequest;
+import org.opensearch.client.Client;
+import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
+import org.opensearch.cluster.node.DiscoveryNodes;
+import org.opensearch.cluster.service.ClusterService;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.common.lifecycle.Lifecycle;
+import org.opensearch.common.lifecycle.LifecycleComponent;
+import org.opensearch.common.lifecycle.LifecycleListener;
+import org.opensearch.common.settings.ClusterSettings;
+import org.opensearch.common.settings.IndexScopedSettings;
+import org.opensearch.common.settings.Settings;
+import org.opensearch.common.settings.SettingsFilter;
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.NamedWriteableRegistry;
+import org.opensearch.core.xcontent.NamedXContentRegistry;
+import org.opensearch.env.Environment;
+import org.opensearch.env.NodeEnvironment;
+import org.opensearch.indices.SystemIndexDescriptor;
+import org.opensearch.plugins.ActionPlugin;
+import org.opensearch.plugins.Plugin;
+import org.opensearch.plugins.ResourcePlugin;
+import org.opensearch.plugins.SystemIndexPlugin;
+import org.opensearch.repositories.RepositoriesService;
+import org.opensearch.rest.RestController;
+import org.opensearch.rest.RestHandler;
+import org.opensearch.sample.actions.access.list.ListAccessibleResourcesAction;
+import org.opensearch.sample.actions.access.list.ListAccessibleResourcesRestAction;
+import org.opensearch.sample.actions.access.revoke.RevokeResourceAccessAction;
+import org.opensearch.sample.actions.access.revoke.RevokeResourceAccessRestAction;
+import org.opensearch.sample.actions.access.share.ShareResourceAction;
+import org.opensearch.sample.actions.access.share.ShareResourceRestAction;
+import org.opensearch.sample.actions.access.verify.VerifyResourceAccessAction;
+import org.opensearch.sample.actions.access.verify.VerifyResourceAccessRestAction;
+import org.opensearch.sample.actions.resource.create.CreateResourceAction;
+import org.opensearch.sample.actions.resource.create.CreateResourceRestAction;
+import org.opensearch.sample.actions.resource.delete.DeleteResourceAction;
+import org.opensearch.sample.actions.resource.delete.DeleteResourceRestAction;
+import org.opensearch.sample.transport.access.ListAccessibleResourcesTransportAction;
+import org.opensearch.sample.transport.access.RevokeResourceAccessTransportAction;
+import org.opensearch.sample.transport.access.ShareResourceTransportAction;
+import org.opensearch.sample.transport.access.VerifyResourceAccessTransportAction;
+import org.opensearch.sample.transport.resource.CreateResourceTransportAction;
+import org.opensearch.sample.transport.resource.DeleteResourceTransportAction;
+import org.opensearch.script.ScriptService;
+import org.opensearch.threadpool.ThreadPool;
+import org.opensearch.watcher.ResourceWatcherService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+/**
+ * Sample Resource plugin.
+ * It uses ".sample_resources" index to manage its resources, and exposes a REST API
+ *
+ */
+public class SampleResourcePlugin extends Plugin implements ActionPlugin, SystemIndexPlugin, ResourcePlugin {
+    private static final Logger log = LogManager.getLogger(SampleResourcePlugin.class);
+
+    @Override
+    public Collection<Object> createComponents(
+        Client client,
+        ClusterService clusterService,
+        ThreadPool threadPool,
+        ResourceWatcherService resourceWatcherService,
+        ScriptService scriptService,
+        NamedXContentRegistry xContentRegistry,
+        Environment environment,
+        NodeEnvironment nodeEnvironment,
+        NamedWriteableRegistry namedWriteableRegistry,
+        IndexNameExpressionResolver indexNameExpressionResolver,
+        Supplier<RepositoriesService> repositoriesServiceSupplier
+    ) {
+        log.info("Loaded SampleResourcePlugin components.");
+        return Collections.emptyList();
+    }
+
+    @Override
+    public List<RestHandler> getRestHandlers(
+        Settings settings,
+        RestController restController,
+        ClusterSettings clusterSettings,
+        IndexScopedSettings indexScopedSettings,
+        SettingsFilter settingsFilter,
+        IndexNameExpressionResolver indexNameExpressionResolver,
+        Supplier<DiscoveryNodes> nodesInCluster
+    ) {
+        return List.of(
+            new CreateResourceRestAction(),
+            new ListAccessibleResourcesRestAction(),
+            new VerifyResourceAccessRestAction(),
+            new RevokeResourceAccessRestAction(),
+            new ShareResourceRestAction(),
+            new DeleteResourceRestAction()
+        );
+    }
+
+    @Override
+    public List<ActionHandler<? extends ActionRequest, ? extends ActionResponse>> getActions() {
+        return List.of(
+            new ActionHandler<>(CreateResourceAction.INSTANCE, CreateResourceTransportAction.class),
+            new ActionHandler<>(ListAccessibleResourcesAction.INSTANCE, ListAccessibleResourcesTransportAction.class),
+            new ActionHandler<>(ShareResourceAction.INSTANCE, ShareResourceTransportAction.class),
+            new ActionHandler<>(RevokeResourceAccessAction.INSTANCE, RevokeResourceAccessTransportAction.class),
+            new ActionHandler<>(VerifyResourceAccessAction.INSTANCE, VerifyResourceAccessTransportAction.class),
+            new ActionHandler<>(DeleteResourceAction.INSTANCE, DeleteResourceTransportAction.class)
+        );
+    }
+
+    @Override
+    public Collection<SystemIndexDescriptor> getSystemIndexDescriptors(Settings settings) {
+        final SystemIndexDescriptor systemIndexDescriptor = new SystemIndexDescriptor(RESOURCE_INDEX_NAME, "Sample index with resources");
+        return Collections.singletonList(systemIndexDescriptor);
+    }
+
+    @Override
+    public String getResourceType() {
+        return "";
+    }
+
+    @Override
+    public String getResourceIndex() {
+        return RESOURCE_INDEX_NAME;
+    }
+
+    @Override
+    public Collection<Class<? extends LifecycleComponent>> getGuiceServiceClasses() {
+        final List<Class<? extends LifecycleComponent>> services = new ArrayList<>(1);
+        services.add(GuiceHolder.class);
+        return services;
+    }
+
+    public static class GuiceHolder implements LifecycleComponent {
+
+        private static ResourceService resourceService;
+
+        @Inject
+        public GuiceHolder(final ResourceService resourceService) {
+            GuiceHolder.resourceService = resourceService;
+        }
+
+        public static ResourceService getResourceService() {
+            return resourceService;
+        }
+
+        @Override
+        public void close() {}
+
+        @Override
+        public Lifecycle.State lifecycleState() {
+            return null;
+        }
+
+        @Override
+        public void addLifecycleListener(LifecycleListener listener) {}
+
+        @Override
+        public void removeLifecycleListener(LifecycleListener listener) {}
+
+        @Override
+        public void start() {}
+
+        @Override
+        public void stop() {}
+
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceScope.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceScope.java
new file mode 100644
index 0000000000..1d6de8c1f7
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceScope.java
@@ -0,0 +1,35 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ * Modifications Copyright OpenSearch Contributors. See
+ * GitHub history for details.
+ */
+
+package org.opensearch.sample;
+
+import org.opensearch.accesscontrol.resources.ResourceAccessScope;
+
+/**
+ * This class demonstrates a sample implementation of Basic Access Scopes to fit each plugin's use-case.
+ * The plugin then uses this scope when seeking access evaluation for a user on a particular resource.
+ */
+public enum SampleResourceScope implements ResourceAccessScope {
+
+    SAMPLE_FULL_ACCESS("sample_full_access"),
+
+    PUBLIC("public");
+
+    private final String name;
+
+    SampleResourceScope(String scopeName) {
+        this.name = scopeName;
+    }
+
+    public String getName() {
+        return name;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesAction.java
new file mode 100644
index 0000000000..3bea515a19
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesAction.java
@@ -0,0 +1,29 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.list;
+
+import org.opensearch.action.ActionType;
+
+/**
+ * Action to list sample resources
+ */
+public class ListAccessibleResourcesAction extends ActionType<ListAccessibleResourcesResponse> {
+    /**
+     * List sample resource action instance
+     */
+    public static final ListAccessibleResourcesAction INSTANCE = new ListAccessibleResourcesAction();
+    /**
+     * List sample resource action name
+     */
+    public static final String NAME = "cluster:admin/sample-resource-plugin/list";
+
+    private ListAccessibleResourcesAction() {
+        super(NAME, ListAccessibleResourcesResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRequest.java
new file mode 100644
index 0000000000..4a9315bfd9
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRequest.java
@@ -0,0 +1,39 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.list;
+
+import java.io.IOException;
+
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+
+/**
+ * Request object for ListSampleResource transport action
+ */
+public class ListAccessibleResourcesRequest extends ActionRequest {
+
+    public ListAccessibleResourcesRequest() {}
+
+    /**
+     * Constructor with stream input
+     * @param in the stream input
+     * @throws IOException IOException
+     */
+    public ListAccessibleResourcesRequest(final StreamInput in) throws IOException {}
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {}
+
+    @Override
+    public ActionRequestValidationException validate() {
+        return null;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesResponse.java
new file mode 100644
index 0000000000..9c5d2a3e8a
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesResponse.java
@@ -0,0 +1,47 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.list;
+
+import java.io.IOException;
+import java.util.Set;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+import org.opensearch.sample.SampleResource;
+
+/**
+ * Response to a ListAccessibleResourcesRequest
+ */
+public class ListAccessibleResourcesResponse extends ActionResponse implements ToXContentObject {
+    private final Set<SampleResource> resources;
+
+    public ListAccessibleResourcesResponse(Set<SampleResource> resources) {
+        this.resources = resources;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeCollection(resources);
+    }
+
+    public ListAccessibleResourcesResponse(final StreamInput in) throws IOException {
+        this.resources = in.readSet(SampleResource::new);
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("resources", resources);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRestAction.java
new file mode 100644
index 0000000000..c387eacf90
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/list/ListAccessibleResourcesRestAction.java
@@ -0,0 +1,44 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.list;
+
+import java.util.List;
+
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.GET;
+
+public class ListAccessibleResourcesRestAction extends BaseRestHandler {
+
+    public ListAccessibleResourcesRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(GET, "/_plugins/sample_resource_sharing/list"));
+    }
+
+    @Override
+    public String getName() {
+        return "list_sample_resources";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) {
+        final ListAccessibleResourcesRequest listAccessibleResourcesRequest = new ListAccessibleResourcesRequest();
+        return channel -> client.executeLocally(
+            ListAccessibleResourcesAction.INSTANCE,
+            listAccessibleResourcesRequest,
+            new RestToXContentListener<>(channel)
+        );
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessAction.java
new file mode 100644
index 0000000000..a040cb0732
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessAction.java
@@ -0,0 +1,21 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.revoke;
+
+import org.opensearch.action.ActionType;
+
+public class RevokeResourceAccessAction extends ActionType<RevokeResourceAccessResponse> {
+    public static final RevokeResourceAccessAction INSTANCE = new RevokeResourceAccessAction();
+
+    public static final String NAME = "cluster:admin/sample-resource-plugin/revoke";
+
+    private RevokeResourceAccessAction() {
+        super(NAME, RevokeResourceAccessResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRequest.java
new file mode 100644
index 0000000000..f7b4e7b5d7
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRequest.java
@@ -0,0 +1,72 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.revoke;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.Set;
+
+import org.opensearch.accesscontrol.resources.RecipientType;
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.sample.utils.Validation;
+
+public class RevokeResourceAccessRequest extends ActionRequest {
+
+    private final String resourceId;
+    private final Map<RecipientType, Set<String>> revokeAccess;
+    private final Set<String> scopes;
+
+    public RevokeResourceAccessRequest(String resourceId, Map<RecipientType, Set<String>> revokeAccess, Set<String> scopes) {
+        this.resourceId = resourceId;
+        this.revokeAccess = revokeAccess;
+        this.scopes = scopes;
+    }
+
+    public RevokeResourceAccessRequest(StreamInput in) throws IOException {
+        this.resourceId = in.readString();
+        this.revokeAccess = in.readMap(input -> new RecipientType(input.readString()), input -> input.readSet(StreamInput::readString));
+        this.scopes = in.readSet(StreamInput::readString);
+    }
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {
+        out.writeString(resourceId);
+        out.writeMap(
+            revokeAccess,
+            (streamOutput, recipientType) -> streamOutput.writeString(recipientType.getType()),
+            StreamOutput::writeStringCollection
+        );
+        out.writeStringCollection(scopes);
+    }
+
+    @Override
+    public ActionRequestValidationException validate() {
+
+        if (!(this.scopes == null)) {
+            return Validation.validateScopes(this.scopes);
+        }
+
+        return null;
+    }
+
+    public String getResourceId() {
+        return resourceId;
+    }
+
+    public Map<RecipientType, Set<String>> getRevokeAccess() {
+        return revokeAccess;
+    }
+
+    public Set<String> getScopes() {
+        return scopes;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessResponse.java
new file mode 100644
index 0000000000..4cfd3d74e5
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessResponse.java
@@ -0,0 +1,42 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.revoke;
+
+import java.io.IOException;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class RevokeResourceAccessResponse extends ActionResponse implements ToXContentObject {
+    private final String message;
+
+    public RevokeResourceAccessResponse(String message) {
+        this.message = message;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(message);
+    }
+
+    public RevokeResourceAccessResponse(final StreamInput in) throws IOException {
+        message = in.readString();
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("message", message);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRestAction.java
new file mode 100644
index 0000000000..387d02502f
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/revoke/RevokeResourceAccessRestAction.java
@@ -0,0 +1,62 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.revoke;
+
+import java.io.IOException;
+import java.util.*;
+import java.util.stream.Collectors;
+
+import org.opensearch.accesscontrol.resources.RecipientType;
+import org.opensearch.accesscontrol.resources.RecipientTypeRegistry;
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.core.xcontent.XContentParser;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.POST;
+
+public class RevokeResourceAccessRestAction extends BaseRestHandler {
+
+    public RevokeResourceAccessRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(POST, "/_plugins/sample_resource_sharing/revoke"));
+    }
+
+    @Override
+    public String getName() {
+        return "revoke_sample_resources_access";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException {
+        Map<String, Object> source;
+        try (XContentParser parser = request.contentParser()) {
+            source = parser.map();
+        }
+
+        String resourceId = (String) source.get("resource_id");
+        @SuppressWarnings("unchecked")
+        Map<String, Set<String>> revokeSource = (Map<String, Set<String>>) source.get("entities");
+        Map<RecipientType, Set<String>> revoke = revokeSource.entrySet()
+            .stream()
+            .collect(Collectors.toMap(entry -> RecipientTypeRegistry.fromValue(entry.getKey()), Map.Entry::getValue));
+        @SuppressWarnings("unchecked")
+        Set<String> scopes = new HashSet<>(source.containsKey("scopes") ? (List<String>) source.get("scopes") : List.of());
+        final RevokeResourceAccessRequest revokeResourceAccessRequest = new RevokeResourceAccessRequest(resourceId, revoke, scopes);
+        return channel -> client.executeLocally(
+            RevokeResourceAccessAction.INSTANCE,
+            revokeResourceAccessRequest,
+            new RestToXContentListener<>(channel)
+        );
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceAction.java
new file mode 100644
index 0000000000..768a811e27
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceAction.java
@@ -0,0 +1,26 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.share;
+
+import org.opensearch.action.ActionType;
+
+public class ShareResourceAction extends ActionType<ShareResourceResponse> {
+    /**
+     * List sample resource action instance
+     */
+    public static final ShareResourceAction INSTANCE = new ShareResourceAction();
+    /**
+     * List sample resource action name
+     */
+    public static final String NAME = "cluster:admin/sample-resource-plugin/share";
+
+    private ShareResourceAction() {
+        super(NAME, ShareResourceResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRequest.java
new file mode 100644
index 0000000000..6c2ed12e73
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRequest.java
@@ -0,0 +1,58 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.share;
+
+import java.io.IOException;
+import java.util.stream.Collectors;
+
+import org.opensearch.accesscontrol.resources.ShareWith;
+import org.opensearch.accesscontrol.resources.SharedWithScope;
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.sample.utils.Validation;
+
+public class ShareResourceRequest extends ActionRequest {
+
+    private final String resourceId;
+    private final ShareWith shareWith;
+
+    public ShareResourceRequest(String resourceId, ShareWith shareWith) {
+        this.resourceId = resourceId;
+        this.shareWith = shareWith;
+    }
+
+    public ShareResourceRequest(StreamInput in) throws IOException {
+        this.resourceId = in.readString();
+        this.shareWith = in.readNamedWriteable(ShareWith.class);
+    }
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {
+        out.writeString(resourceId);
+        out.writeNamedWriteable(shareWith);
+    }
+
+    @Override
+    public ActionRequestValidationException validate() {
+
+        return Validation.validateScopes(
+            shareWith.getSharedWithScopes().stream().map(SharedWithScope::getScope).collect(Collectors.toSet())
+        );
+    }
+
+    public String getResourceId() {
+        return resourceId;
+    }
+
+    public ShareWith getShareWith() {
+        return shareWith;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceResponse.java
new file mode 100644
index 0000000000..035a9a245e
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceResponse.java
@@ -0,0 +1,52 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.share;
+
+import java.io.IOException;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class ShareResourceResponse extends ActionResponse implements ToXContentObject {
+    private final String message;
+
+    /**
+     * Default constructor
+     *
+     * @param message The message
+     */
+    public ShareResourceResponse(String message) {
+        this.message = message;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(message);
+    }
+
+    /**
+     * Constructor with StreamInput
+     *
+     * @param in the stream input
+     */
+    public ShareResourceResponse(final StreamInput in) throws IOException {
+        message = in.readString();
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("message", message);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRestAction.java
new file mode 100644
index 0000000000..0db4208c05
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/share/ShareResourceRestAction.java
@@ -0,0 +1,75 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.share;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+import org.opensearch.accesscontrol.resources.ShareWith;
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.common.xcontent.LoggingDeprecationHandler;
+import org.opensearch.common.xcontent.XContentFactory;
+import org.opensearch.common.xcontent.XContentType;
+import org.opensearch.core.xcontent.NamedXContentRegistry;
+import org.opensearch.core.xcontent.XContentParser;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.POST;
+
+public class ShareResourceRestAction extends BaseRestHandler {
+
+    public ShareResourceRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(POST, "/_plugins/sample_resource_sharing/share"));
+    }
+
+    @Override
+    public String getName() {
+        return "share_sample_resources";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException {
+        Map<String, Object> source;
+        try (XContentParser parser = request.contentParser()) {
+            source = parser.map();
+        }
+
+        String resourceId = (String) source.get("resource_id");
+
+        ShareWith shareWith = parseShareWith(source);
+        final ShareResourceRequest shareResourceRequest = new ShareResourceRequest(resourceId, shareWith);
+        return channel -> client.executeLocally(ShareResourceAction.INSTANCE, shareResourceRequest, new RestToXContentListener<>(channel));
+    }
+
+    private ShareWith parseShareWith(Map<String, Object> source) throws IOException {
+        @SuppressWarnings("unchecked")
+        Map<String, Object> shareWithMap = (Map<String, Object>) source.get("share_with");
+        if (shareWithMap == null || shareWithMap.isEmpty()) {
+            throw new IllegalArgumentException("share_with is required and cannot be empty");
+        }
+
+        String jsonString = XContentFactory.jsonBuilder().map(shareWithMap).toString();
+
+        try (
+            XContentParser parser = XContentType.JSON.xContent()
+                .createParser(NamedXContentRegistry.EMPTY, LoggingDeprecationHandler.INSTANCE, jsonString)
+        ) {
+            return ShareWith.fromXContent(parser);
+        } catch (IllegalArgumentException e) {
+            throw new IllegalArgumentException("Invalid share_with structure: " + e.getMessage(), e);
+        }
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessAction.java
new file mode 100644
index 0000000000..466cc901c6
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessAction.java
@@ -0,0 +1,25 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.verify;
+
+import org.opensearch.action.ActionType;
+
+/**
+ * Action to verify resource access for current user
+ */
+public class VerifyResourceAccessAction extends ActionType<VerifyResourceAccessResponse> {
+
+    public static final VerifyResourceAccessAction INSTANCE = new VerifyResourceAccessAction();
+
+    public static final String NAME = "cluster:admin/sample-resource-plugin/verify/resource_access";
+
+    private VerifyResourceAccessAction() {
+        super(NAME, VerifyResourceAccessResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRequest.java
new file mode 100644
index 0000000000..b9ab4134c6
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRequest.java
@@ -0,0 +1,62 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.verify;
+
+import java.io.IOException;
+import java.util.Set;
+
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.sample.utils.Validation;
+
+public class VerifyResourceAccessRequest extends ActionRequest {
+
+    private final String resourceId;
+
+    private final String scope;
+
+    /**
+     * Default constructor
+     */
+    public VerifyResourceAccessRequest(String resourceId, String scope) {
+        this.resourceId = resourceId;
+        this.scope = scope;
+    }
+
+    /**
+     * Constructor with stream input
+     * @param in the stream input
+     * @throws IOException IOException
+     */
+    public VerifyResourceAccessRequest(final StreamInput in) throws IOException {
+        this.resourceId = in.readString();
+        this.scope = in.readString();
+    }
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {
+        out.writeString(resourceId);
+        out.writeString(scope);
+    }
+
+    @Override
+    public ActionRequestValidationException validate() {
+        return Validation.validateScopes(Set.of(scope));
+    }
+
+    public String getResourceId() {
+        return resourceId;
+    }
+
+    public String getScope() {
+        return scope;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessResponse.java
new file mode 100644
index 0000000000..f7c419b9d1
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessResponse.java
@@ -0,0 +1,52 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.verify;
+
+import java.io.IOException;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class VerifyResourceAccessResponse extends ActionResponse implements ToXContentObject {
+    private final String message;
+
+    /**
+     * Default constructor
+     *
+     * @param message The message
+     */
+    public VerifyResourceAccessResponse(String message) {
+        this.message = message;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(message);
+    }
+
+    /**
+     * Constructor with StreamInput
+     *
+     * @param in the stream input
+     */
+    public VerifyResourceAccessResponse(final StreamInput in) throws IOException {
+        message = in.readString();
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("message", message);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRestAction.java
new file mode 100644
index 0000000000..3118fd54e6
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/access/verify/VerifyResourceAccessRestAction.java
@@ -0,0 +1,55 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.access.verify;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.core.xcontent.XContentParser;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.GET;
+
+public class VerifyResourceAccessRestAction extends BaseRestHandler {
+
+    public VerifyResourceAccessRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(GET, "/_plugins/sample_resource_sharing/verify_resource_access"));
+    }
+
+    @Override
+    public String getName() {
+        return "verify_resource_access";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException {
+        Map<String, Object> source;
+        try (XContentParser parser = request.contentParser()) {
+            source = parser.map();
+        }
+
+        String resourceId = (String) source.get("resource_id");
+        String scope = (String) source.get("scope");
+
+        final VerifyResourceAccessRequest verifyResourceAccessRequest = new VerifyResourceAccessRequest(resourceId, scope);
+        return channel -> client.executeLocally(
+            VerifyResourceAccessAction.INSTANCE,
+            verifyResourceAccessRequest,
+            new RestToXContentListener<>(channel)
+        );
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceAction.java
new file mode 100644
index 0000000000..a2b91185e1
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceAction.java
@@ -0,0 +1,29 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.create;
+
+import org.opensearch.action.ActionType;
+
+/**
+ * Action to create a sample resource
+ */
+public class CreateResourceAction extends ActionType<CreateResourceResponse> {
+    /**
+     * Create sample resource action instance
+     */
+    public static final CreateResourceAction INSTANCE = new CreateResourceAction();
+    /**
+     * Create sample resource action name
+     */
+    public static final String NAME = "cluster:admin/sample-resource-plugin/create";
+
+    private CreateResourceAction() {
+        super(NAME, CreateResourceResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRequest.java
new file mode 100644
index 0000000000..abad5cd1c3
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRequest.java
@@ -0,0 +1,50 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.create;
+
+import java.io.IOException;
+
+import org.opensearch.accesscontrol.resources.Resource;
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+
+/**
+ * Request object for CreateSampleResource transport action
+ */
+public class CreateResourceRequest extends ActionRequest {
+
+    private final Resource resource;
+
+    /**
+     * Default constructor
+     */
+    public CreateResourceRequest(Resource resource) {
+        this.resource = resource;
+    }
+
+    public CreateResourceRequest(StreamInput in) throws IOException {
+        this.resource = in.readNamedWriteable(Resource.class);
+    }
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {
+        resource.writeTo(out);
+    }
+
+    @Override
+    public ActionRequestValidationException validate() {
+        return null;
+    }
+
+    public Resource getResource() {
+        return this.resource;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceResponse.java
new file mode 100644
index 0000000000..6b980c9912
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceResponse.java
@@ -0,0 +1,55 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.create;
+
+import java.io.IOException;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+/**
+ * Response to a CreateSampleResourceRequest
+ */
+public class CreateResourceResponse extends ActionResponse implements ToXContentObject {
+    private final String message;
+
+    /**
+     * Default constructor
+     *
+     * @param message The message
+     */
+    public CreateResourceResponse(String message) {
+        this.message = message;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(message);
+    }
+
+    /**
+     * Constructor with StreamInput
+     *
+     * @param in the stream input
+     */
+    public CreateResourceResponse(final StreamInput in) throws IOException {
+        message = in.readString();
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("message", message);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRestAction.java
new file mode 100644
index 0000000000..f7aa1c76b5
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/create/CreateResourceRestAction.java
@@ -0,0 +1,60 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.create;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.core.xcontent.XContentParser;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+import org.opensearch.sample.SampleResource;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.POST;
+
+public class CreateResourceRestAction extends BaseRestHandler {
+
+    public CreateResourceRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(POST, "/_plugins/sample_resource_sharing/create"));
+    }
+
+    @Override
+    public String getName() {
+        return "create_sample_resource";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException {
+        Map<String, Object> source;
+        try (XContentParser parser = request.contentParser()) {
+            source = parser.map();
+        }
+
+        String name = (String) source.get("name");
+        String description = source.containsKey("description") ? (String) source.get("description") : null;
+        Map<String, String> attributes = source.containsKey("attributes") ? (Map<String, String>) source.get("attributes") : null;
+        SampleResource resource = new SampleResource();
+        resource.setName(name);
+        resource.setDescription(description);
+        resource.setAttributes(attributes);
+        final CreateResourceRequest createSampleResourceRequest = new CreateResourceRequest(resource);
+        return channel -> client.executeLocally(
+            CreateResourceAction.INSTANCE,
+            createSampleResourceRequest,
+            new RestToXContentListener<>(channel)
+        );
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceAction.java
new file mode 100644
index 0000000000..ccb31f7ab2
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceAction.java
@@ -0,0 +1,29 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.delete;
+
+import org.opensearch.action.ActionType;
+
+/**
+ * Action to create a sample resource
+ */
+public class DeleteResourceAction extends ActionType<DeleteResourceResponse> {
+    /**
+     * Create sample resource action instance
+     */
+    public static final DeleteResourceAction INSTANCE = new DeleteResourceAction();
+    /**
+     * Create sample resource action name
+     */
+    public static final String NAME = "cluster:admin/sample-resource-plugin/delete";
+
+    private DeleteResourceAction() {
+        super(NAME, DeleteResourceResponse::new);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRequest.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRequest.java
new file mode 100644
index 0000000000..1cb58989d3
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRequest.java
@@ -0,0 +1,49 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.delete;
+
+import java.io.IOException;
+
+import org.opensearch.action.ActionRequest;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+
+/**
+ * Request object for CreateSampleResource transport action
+ */
+public class DeleteResourceRequest extends ActionRequest {
+
+    private final String resourceId;
+
+    /**
+     * Default constructor
+     */
+    public DeleteResourceRequest(String resourceId) {
+        this.resourceId = resourceId;
+    }
+
+    public DeleteResourceRequest(StreamInput in) throws IOException {
+        this.resourceId = in.readString();
+    }
+
+    @Override
+    public void writeTo(final StreamOutput out) throws IOException {
+        out.writeString(this.resourceId);
+    }
+
+    @Override
+    public ActionRequestValidationException validate() {
+        return null;
+    }
+
+    public String getResourceId() {
+        return this.resourceId;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceResponse.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceResponse.java
new file mode 100644
index 0000000000..ba3cddc04b
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceResponse.java
@@ -0,0 +1,52 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.delete;
+
+import java.io.IOException;
+
+import org.opensearch.core.action.ActionResponse;
+import org.opensearch.core.common.io.stream.StreamInput;
+import org.opensearch.core.common.io.stream.StreamOutput;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class DeleteResourceResponse extends ActionResponse implements ToXContentObject {
+    private final String message;
+
+    /**
+     * Default constructor
+     *
+     * @param message The message
+     */
+    public DeleteResourceResponse(String message) {
+        this.message = message;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        out.writeString(message);
+    }
+
+    /**
+     * Constructor with StreamInput
+     *
+     * @param in the stream input
+     */
+    public DeleteResourceResponse(final StreamInput in) throws IOException {
+        message = in.readString();
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject();
+        builder.field("message", message);
+        builder.endObject();
+        return builder;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRestAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRestAction.java
new file mode 100644
index 0000000000..9a10ca2a62
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/actions/resource/delete/DeleteResourceRestAction.java
@@ -0,0 +1,49 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.actions.resource.delete;
+
+import java.util.List;
+
+import org.opensearch.client.node.NodeClient;
+import org.opensearch.core.common.Strings;
+import org.opensearch.rest.BaseRestHandler;
+import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.action.RestToXContentListener;
+
+import static java.util.Collections.singletonList;
+import static org.opensearch.rest.RestRequest.Method.DELETE;
+
+public class DeleteResourceRestAction extends BaseRestHandler {
+
+    public DeleteResourceRestAction() {}
+
+    @Override
+    public List<Route> routes() {
+        return singletonList(new Route(DELETE, "/_plugins/sample_resource_sharing/delete/{resource_id}"));
+    }
+
+    @Override
+    public String getName() {
+        return "delete_sample_resource";
+    }
+
+    @Override
+    protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) {
+        String resourceId = request.param("resource_id");
+        if (Strings.isNullOrEmpty(resourceId)) {
+            throw new IllegalArgumentException("resource_id parameter is required");
+        }
+        final DeleteResourceRequest createSampleResourceRequest = new DeleteResourceRequest(resourceId);
+        return channel -> client.executeLocally(
+            DeleteResourceAction.INSTANCE,
+            createSampleResourceRequest,
+            new RestToXContentListener<>(channel)
+        );
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ListAccessibleResourcesTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ListAccessibleResourcesTransportAction.java
new file mode 100644
index 0000000000..57c2c7889f
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ListAccessibleResourcesTransportAction.java
@@ -0,0 +1,55 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.access;
+
+import java.util.Set;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.sample.SampleResource;
+import org.opensearch.sample.SampleResourcePlugin;
+import org.opensearch.sample.actions.access.list.ListAccessibleResourcesAction;
+import org.opensearch.sample.actions.access.list.ListAccessibleResourcesRequest;
+import org.opensearch.sample.actions.access.list.ListAccessibleResourcesResponse;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class ListAccessibleResourcesTransportAction extends HandledTransportAction<
+    ListAccessibleResourcesRequest,
+    ListAccessibleResourcesResponse> {
+    private static final Logger log = LogManager.getLogger(ListAccessibleResourcesTransportAction.class);
+
+    @Inject
+    public ListAccessibleResourcesTransportAction(TransportService transportService, ActionFilters actionFilters) {
+        super(ListAccessibleResourcesAction.NAME, transportService, actionFilters, ListAccessibleResourcesRequest::new);
+    }
+
+    @Override
+    protected void doExecute(Task task, ListAccessibleResourcesRequest request, ActionListener<ListAccessibleResourcesResponse> listener) {
+        try {
+            ResourceService rs = SampleResourcePlugin.GuiceHolder.getResourceService();
+            Set<SampleResource> resources = rs.getResourceAccessControlPlugin()
+                .getAccessibleResourcesForCurrentUser(RESOURCE_INDEX_NAME, SampleResource.class);
+            log.info("Successfully fetched accessible resources for current user : {}", resources);
+            listener.onResponse(new ListAccessibleResourcesResponse(resources));
+        } catch (Exception e) {
+            log.info("Failed to list accessible resources for current user: ", e);
+            listener.onFailure(e);
+        }
+
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/RevokeResourceAccessTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/RevokeResourceAccessTransportAction.java
new file mode 100644
index 0000000000..027e1fffe3
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/RevokeResourceAccessTransportAction.java
@@ -0,0 +1,62 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.access;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.accesscontrol.resources.ResourceSharing;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.sample.SampleResourcePlugin;
+import org.opensearch.sample.actions.access.revoke.RevokeResourceAccessAction;
+import org.opensearch.sample.actions.access.revoke.RevokeResourceAccessRequest;
+import org.opensearch.sample.actions.access.revoke.RevokeResourceAccessResponse;
+import org.opensearch.sample.utils.SampleResourcePluginException;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class RevokeResourceAccessTransportAction extends HandledTransportAction<RevokeResourceAccessRequest, RevokeResourceAccessResponse> {
+    private static final Logger log = LogManager.getLogger(RevokeResourceAccessTransportAction.class);
+
+    @Inject
+    public RevokeResourceAccessTransportAction(TransportService transportService, ActionFilters actionFilters) {
+        super(RevokeResourceAccessAction.NAME, transportService, actionFilters, RevokeResourceAccessRequest::new);
+    }
+
+    @Override
+    protected void doExecute(Task task, RevokeResourceAccessRequest request, ActionListener<RevokeResourceAccessResponse> listener) {
+        try {
+            ResourceSharing revoke = revokeAccess(request);
+            if (revoke == null) {
+                log.error("Failed to revoke access to resource {}", request.getResourceId());
+                SampleResourcePluginException se = new SampleResourcePluginException(
+                    "Failed to revoke access to resource " + request.getResourceId()
+                );
+                listener.onFailure(se);
+                return;
+            }
+            log.info("Revoked resource access for resource: {} with {}", request.getResourceId(), revoke.toString());
+            listener.onResponse(new RevokeResourceAccessResponse("Resource " + request.getResourceId() + " access revoked successfully."));
+        } catch (Exception e) {
+            listener.onFailure(e);
+        }
+    }
+
+    private ResourceSharing revokeAccess(RevokeResourceAccessRequest request) {
+        ResourceService rs = SampleResourcePlugin.GuiceHolder.getResourceService();
+        return rs.getResourceAccessControlPlugin()
+            .revokeAccess(request.getResourceId(), RESOURCE_INDEX_NAME, request.getRevokeAccess(), request.getScopes());
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ShareResourceTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ShareResourceTransportAction.java
new file mode 100644
index 0000000000..3288352d0b
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/ShareResourceTransportAction.java
@@ -0,0 +1,60 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.access;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.accesscontrol.resources.ResourceSharing;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.sample.SampleResourcePlugin;
+import org.opensearch.sample.actions.access.share.ShareResourceAction;
+import org.opensearch.sample.actions.access.share.ShareResourceRequest;
+import org.opensearch.sample.actions.access.share.ShareResourceResponse;
+import org.opensearch.sample.utils.SampleResourcePluginException;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class ShareResourceTransportAction extends HandledTransportAction<ShareResourceRequest, ShareResourceResponse> {
+    private static final Logger log = LogManager.getLogger(ShareResourceTransportAction.class);
+
+    @Inject
+    public ShareResourceTransportAction(TransportService transportService, ActionFilters actionFilters) {
+        super(ShareResourceAction.NAME, transportService, actionFilters, ShareResourceRequest::new);
+    }
+
+    @Override
+    protected void doExecute(Task task, ShareResourceRequest request, ActionListener<ShareResourceResponse> listener) {
+        ResourceSharing sharing = null;
+        try {
+            sharing = shareResource(request);
+            if (sharing == null) {
+                log.error("Failed to share resource {}", request.getResourceId());
+                SampleResourcePluginException se = new SampleResourcePluginException("Failed to share resource " + request.getResourceId());
+                listener.onFailure(se);
+                return;
+            }
+            log.info("Shared resource : {} with {}", request.getResourceId(), sharing.toString());
+            listener.onResponse(new ShareResourceResponse("Resource " + request.getResourceId() + " shared successfully."));
+        } catch (Exception e) {
+            listener.onFailure(e);
+        }
+    }
+
+    private ResourceSharing shareResource(ShareResourceRequest request) throws Exception {
+        ResourceService rs = SampleResourcePlugin.GuiceHolder.getResourceService();
+        return rs.getResourceAccessControlPlugin().shareWith(request.getResourceId(), RESOURCE_INDEX_NAME, request.getShareWith());
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/VerifyResourceAccessTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/VerifyResourceAccessTransportAction.java
new file mode 100644
index 0000000000..681e4546cc
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/access/VerifyResourceAccessTransportAction.java
@@ -0,0 +1,60 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.access;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.client.Client;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.sample.SampleResourcePlugin;
+import org.opensearch.sample.actions.access.verify.VerifyResourceAccessAction;
+import org.opensearch.sample.actions.access.verify.VerifyResourceAccessRequest;
+import org.opensearch.sample.actions.access.verify.VerifyResourceAccessResponse;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class VerifyResourceAccessTransportAction extends HandledTransportAction<VerifyResourceAccessRequest, VerifyResourceAccessResponse> {
+    private static final Logger log = LogManager.getLogger(VerifyResourceAccessTransportAction.class);
+
+    @Inject
+    public VerifyResourceAccessTransportAction(TransportService transportService, ActionFilters actionFilters, Client nodeClient) {
+        super(VerifyResourceAccessAction.NAME, transportService, actionFilters, VerifyResourceAccessRequest::new);
+    }
+
+    @Override
+    protected void doExecute(Task task, VerifyResourceAccessRequest request, ActionListener<VerifyResourceAccessResponse> listener) {
+        try {
+            ResourceService rs = SampleResourcePlugin.GuiceHolder.getResourceService();
+            boolean hasRequestedScopeAccess = rs.getResourceAccessControlPlugin()
+                .hasPermission(request.getResourceId(), RESOURCE_INDEX_NAME, request.getScope());
+
+            StringBuilder sb = new StringBuilder();
+            sb.append("User ");
+            sb.append(hasRequestedScopeAccess ? "has" : "does not have");
+            sb.append(" requested scope ");
+            sb.append(request.getScope());
+            sb.append(" access to ");
+            sb.append(request.getResourceId());
+
+            log.info(sb.toString());
+            listener.onResponse(new VerifyResourceAccessResponse(sb.toString()));
+        } catch (Exception e) {
+            log.info("Failed to check user permissions for resource {}", request.getResourceId(), e);
+            listener.onFailure(e);
+        }
+    }
+
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/CreateResourceTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/CreateResourceTransportAction.java
new file mode 100644
index 0000000000..052783a90b
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/CreateResourceTransportAction.java
@@ -0,0 +1,82 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.resource;
+
+import java.io.IOException;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.accesscontrol.resources.Resource;
+import org.opensearch.action.index.IndexRequest;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.action.support.WriteRequest;
+import org.opensearch.client.Client;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.common.util.concurrent.ThreadContext;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.core.xcontent.ToXContent;
+import org.opensearch.core.xcontent.XContentBuilder;
+import org.opensearch.sample.actions.resource.create.CreateResourceAction;
+import org.opensearch.sample.actions.resource.create.CreateResourceRequest;
+import org.opensearch.sample.actions.resource.create.CreateResourceResponse;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.common.xcontent.XContentFactory.jsonBuilder;
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class CreateResourceTransportAction extends HandledTransportAction<CreateResourceRequest, CreateResourceResponse> {
+    private static final Logger log = LogManager.getLogger(CreateResourceTransportAction.class);
+
+    private final TransportService transportService;
+    private final Client nodeClient;
+
+    @Inject
+    public CreateResourceTransportAction(TransportService transportService, ActionFilters actionFilters, Client nodeClient) {
+        super(CreateResourceAction.NAME, transportService, actionFilters, CreateResourceRequest::new);
+        this.transportService = transportService;
+        this.nodeClient = nodeClient;
+    }
+
+    @Override
+    protected void doExecute(Task task, CreateResourceRequest request, ActionListener<CreateResourceResponse> listener) {
+        ThreadContext threadContext = transportService.getThreadPool().getThreadContext();
+        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
+            createResource(request, listener);
+            listener.onResponse(
+                new CreateResourceResponse("Resource " + request.getResource().getResourceName() + " created successfully.")
+            );
+        } catch (Exception e) {
+            log.info("Failed to create resource", e);
+            listener.onFailure(e);
+        }
+    }
+
+    private void createResource(CreateResourceRequest request, ActionListener<CreateResourceResponse> listener) {
+        Resource sample = request.getResource();
+        try (XContentBuilder builder = jsonBuilder()) {
+            IndexRequest ir = nodeClient.prepareIndex(RESOURCE_INDEX_NAME)
+                .setWaitForActiveShards(1)
+                .setRefreshPolicy(WriteRequest.RefreshPolicy.IMMEDIATE)
+                .setSource(sample.toXContent(builder, ToXContent.EMPTY_PARAMS))
+                .request();
+
+            log.info("Index Request: {}", ir.toString());
+
+            nodeClient.index(
+                ir,
+                ActionListener.wrap(idxResponse -> { log.info("Created resource: {}", idxResponse.toString()); }, listener::onFailure)
+            );
+        } catch (IOException e) {
+            listener.onFailure(new RuntimeException(e));
+        }
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/DeleteResourceTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/DeleteResourceTransportAction.java
new file mode 100644
index 0000000000..bb403e3704
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/transport/resource/DeleteResourceTransportAction.java
@@ -0,0 +1,76 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.transport.resource;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.opensearch.ResourceNotFoundException;
+import org.opensearch.action.DocWriteResponse;
+import org.opensearch.action.delete.DeleteRequest;
+import org.opensearch.action.delete.DeleteResponse;
+import org.opensearch.action.support.ActionFilters;
+import org.opensearch.action.support.HandledTransportAction;
+import org.opensearch.action.support.WriteRequest;
+import org.opensearch.client.Client;
+import org.opensearch.common.inject.Inject;
+import org.opensearch.common.util.concurrent.ThreadContext;
+import org.opensearch.core.action.ActionListener;
+import org.opensearch.sample.actions.resource.delete.DeleteResourceAction;
+import org.opensearch.sample.actions.resource.delete.DeleteResourceRequest;
+import org.opensearch.sample.actions.resource.delete.DeleteResourceResponse;
+import org.opensearch.tasks.Task;
+import org.opensearch.transport.TransportService;
+
+import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
+
+public class DeleteResourceTransportAction extends HandledTransportAction<DeleteResourceRequest, DeleteResourceResponse> {
+    private static final Logger log = LogManager.getLogger(DeleteResourceTransportAction.class);
+
+    private final TransportService transportService;
+    private final Client nodeClient;
+
+    @Inject
+    public DeleteResourceTransportAction(TransportService transportService, ActionFilters actionFilters, Client nodeClient) {
+        super(DeleteResourceAction.NAME, transportService, actionFilters, DeleteResourceRequest::new);
+        this.transportService = transportService;
+        this.nodeClient = nodeClient;
+    }
+
+    @Override
+    protected void doExecute(Task task, DeleteResourceRequest request, ActionListener<DeleteResourceResponse> listener) {
+        if (request.getResourceId() == null || request.getResourceId().isEmpty()) {
+            listener.onFailure(new IllegalArgumentException("Resource ID cannot be null or empty"));
+            return;
+        }
+
+        ThreadContext threadContext = transportService.getThreadPool().getThreadContext();
+        try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
+            deleteResource(request, ActionListener.wrap(deleteResponse -> {
+                if (deleteResponse.getResult() == DocWriteResponse.Result.NOT_FOUND) {
+                    listener.onFailure(new ResourceNotFoundException("Resource " + request.getResourceId() + " not found."));
+                } else {
+                    listener.onResponse(new DeleteResourceResponse("Resource " + request.getResourceId() + " deleted successfully."));
+                }
+            }, exception -> {
+                log.error("Failed to delete resource: " + request.getResourceId(), exception);
+                listener.onFailure(exception);
+            }));
+        }
+    }
+
+    private void deleteResource(DeleteResourceRequest request, ActionListener<DeleteResponse> listener) {
+        DeleteRequest deleteRequest = new DeleteRequest(RESOURCE_INDEX_NAME, request.getResourceId()).setRefreshPolicy(
+            WriteRequest.RefreshPolicy.IMMEDIATE
+        );
+
+        nodeClient.delete(deleteRequest, listener);
+    }
+
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Constants.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Constants.java
new file mode 100644
index 0000000000..ff7404d2cd
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Constants.java
@@ -0,0 +1,13 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.utils;
+
+public class Constants {
+    public static final String RESOURCE_INDEX_NAME = ".sample_resource_sharing_plugin";
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/SampleResourcePluginException.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/SampleResourcePluginException.java
new file mode 100644
index 0000000000..1ac2baaaae
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/SampleResourcePluginException.java
@@ -0,0 +1,17 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.utils;
+
+import org.opensearch.OpenSearchException;
+
+public class SampleResourcePluginException extends OpenSearchException {
+    public SampleResourcePluginException(String msg, Object... args) {
+        super(msg, args);
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Validation.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Validation.java
new file mode 100644
index 0000000000..a057d41eed
--- /dev/null
+++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/utils/Validation.java
@@ -0,0 +1,36 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.utils;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.opensearch.accesscontrol.resources.ResourceAccessScope;
+import org.opensearch.action.ActionRequestValidationException;
+import org.opensearch.sample.SampleResourceScope;
+
+public class Validation {
+    public static ActionRequestValidationException validateScopes(Set<String> scopes) {
+        Set<String> validScopes = new HashSet<>();
+        for (SampleResourceScope scope : SampleResourceScope.values()) {
+            validScopes.add(scope.name());
+        }
+        validScopes.add(ResourceAccessScope.READ_ONLY);
+        validScopes.add(ResourceAccessScope.READ_WRITE);
+
+        for (String s : scopes) {
+            if (!validScopes.contains(s)) {
+                ActionRequestValidationException exception = new ActionRequestValidationException();
+                exception.addValidationError("Invalid scope: " + s + ". Scope must be one of: " + validScopes);
+                return exception;
+            }
+        }
+        return null;
+    }
+}
diff --git a/sample-resource-plugin/src/main/plugin-metadata/plugin-security.policy b/sample-resource-plugin/src/main/plugin-metadata/plugin-security.policy
new file mode 100644
index 0000000000..a5dfc33a87
--- /dev/null
+++ b/sample-resource-plugin/src/main/plugin-metadata/plugin-security.policy
@@ -0,0 +1,3 @@
+grant {
+  permission java.lang.RuntimePermission "getClassLoader";
+};
\ No newline at end of file
diff --git a/sample-resource-plugin/src/main/resources/META-INF/services/org.opensearch.plugins.ResourcePlugin b/sample-resource-plugin/src/main/resources/META-INF/services/org.opensearch.plugins.ResourcePlugin
new file mode 100644
index 0000000000..1ca89eaf74
--- /dev/null
+++ b/sample-resource-plugin/src/main/resources/META-INF/services/org.opensearch.plugins.ResourcePlugin
@@ -0,0 +1 @@
+org.opensearch.sample.SampleResourcePlugin
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/esnode-key.pem b/sample-resource-plugin/src/test/resources/security/esnode-key.pem
new file mode 100644
index 0000000000..e90562be43
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/esnode-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCm93kXteDQHMAv
+bUPNPW5pyRHKDD42XGWSgq0k1D29C/UdyL21HLzTJa49ZU2ldIkSKs9JqbkHdyK0
+o8MO6L8dotLoYbxDWbJFW8bp1w6tDTU0HGkn47XVu3EwbfrTENg3jFu+Oem6a/50
+1SzITzJWtS0cn2dIFOBimTVpT/4Zv5qrXA6Cp4biOmoTYWhi/qQl8d0IaADiqoZ1
+MvZbZ6x76qTrRAbg+UWkpTEXoH1xTc8ndibR7+HP6OTqCKvo1NhE8uP4pY+fWd6b
+6l+KLo3IKpfTbAIJXIO+M67FLtWKtttDao94B069skzKk6FPgW/OZh6PRCD0oxOa
+vV+ld2SjAgMBAAECggEAQK1+uAOZeaSZggW2jQut+MaN4JHLi61RH2cFgU3COLgo
+FIiNjFn8f2KKU3gpkt1It8PjlmprpYut4wHI7r6UQfuv7ZrmncRiPWHm9PB82+ZQ
+5MXYqj4YUxoQJ62Cyz4sM6BobZDrjG6HHGTzuwiKvHHkbsEE9jQ4E5m7yfbVvM0O
+zvwrSOM1tkZihKSTpR0j2+taji914tjBssbn12TMZQL5ItGnhR3luY8mEwT9MNkZ
+xg0VcREoAH+pu9FE0vPUgLVzhJ3be7qZTTSRqv08bmW+y1plu80GbppePcgYhEow
+dlW4l6XPJaHVSn1lSFHE6QAx6sqiAnBz0NoTPIaLyQKBgQDZqDOlhCRciMRicSXn
+7yid9rhEmdMkySJHTVFOidFWwlBcp0fGxxn8UNSBcXdSy7GLlUtH41W9PWl8tp9U
+hQiiXORxOJ7ZcB80uNKXF01hpPj2DpFPWyHFxpDkWiTAYpZl68rOlYujxZUjJIej
+VvcykBC2BlEOG9uZv2kxcqLyJwKBgQDEYULTxaTuLIa17wU3nAhaainKB3vHxw9B
+Ksy5p3ND43UNEKkQm7K/WENx0q47TA1mKD9i+BhaLod98mu0YZ+BCUNgWKcBHK8c
+uXpauvM/pLhFLXZ2jvEJVpFY3J79FSRK8bwE9RgKfVKMMgEk4zOyZowS8WScOqiy
+hnQn1vKTJQKBgElhYuAnl9a2qXcC7KOwRsJS3rcKIVxijzL4xzOyVShp5IwIPbOv
+hnxBiBOH/JGmaNpFYBcBdvORE9JfA4KMQ2fx53agfzWRjoPI1/7mdUk5RFI4gRb/
+A3jZRBoopgFSe6ArCbnyQxzYzToG48/Wzwp19ZxYrtUR4UyJct6f5n27AoGBAJDh
+KIpQQDOvCdtjcbfrF4aM2DPCfaGPzENJriwxy6oEPzDaX8Bu/dqI5Ykt43i/zQrX
+GpyLaHvv4+oZVTiI5UIvcVO9U8hQPyiz9f7F+fu0LHZs6f7hyhYXlbe3XFxeop3f
+5dTKdWgXuTTRF2L9dABkA2deS9mutRKwezWBMQk5AoGBALPtX0FrT1zIosibmlud
+tu49A/0KZu4PBjrFMYTSEWGNJez3Fb2VsJwylVl6HivwbP61FhlYfyksCzQQFU71
++x7Nmybp7PmpEBECr3deoZKQ/acNHn0iwb0It+YqV5+TquQebqgwK6WCLsMuiYKT
+bg/ch9Rhxbq22yrVgWHh6epp
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/esnode.pem b/sample-resource-plugin/src/test/resources/security/esnode.pem
new file mode 100644
index 0000000000..44101f0b37
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/esnode.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPDCCAySgAwIBAgIUaYSlET3nzsotWTrWueVPPh10yLYwDQYJKoZIhvcNAQEL
+BQAwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFt
+cGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFtcGxl
+IENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4gUm9v
+dCBDQTAeFw0yNDAyMjAxNzAzMjVaFw0zNDAyMTcxNzAzMjVaMFcxCzAJBgNVBAYT
+AmRlMQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDARub2RlMQ0wCwYDVQQLDARub2Rl
+MRswGQYDVQQDDBJub2RlLTAuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCm93kXteDQHMAvbUPNPW5pyRHKDD42XGWSgq0k1D29C/Ud
+yL21HLzTJa49ZU2ldIkSKs9JqbkHdyK0o8MO6L8dotLoYbxDWbJFW8bp1w6tDTU0
+HGkn47XVu3EwbfrTENg3jFu+Oem6a/501SzITzJWtS0cn2dIFOBimTVpT/4Zv5qr
+XA6Cp4biOmoTYWhi/qQl8d0IaADiqoZ1MvZbZ6x76qTrRAbg+UWkpTEXoH1xTc8n
+dibR7+HP6OTqCKvo1NhE8uP4pY+fWd6b6l+KLo3IKpfTbAIJXIO+M67FLtWKtttD
+ao94B069skzKk6FPgW/OZh6PRCD0oxOavV+ld2SjAgMBAAGjgcYwgcMwRwYDVR0R
+BEAwPogFKgMEBQWCEm5vZGUtMC5leGFtcGxlLmNvbYIJbG9jYWxob3N0hxAAAAAA
+AAAAAAAAAAAAAAABhwR/AAABMAsGA1UdDwQEAwIF4DAdBgNVHSUEFjAUBggrBgEF
+BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU0/qDQaY10jIo
+wCjLUpz/HfQXyt8wHwYDVR0jBBgwFoAUF4ffoFrrZhKn1dD4uhJFPLcrAJwwDQYJ
+KoZIhvcNAQELBQADggEBAGbij5WyF0dKhQodQfTiFDb73ygU6IyeJkFSnxF67gDz
+pQJZKFvXuVBa3cGP5e7Qp3TK50N+blXGH0xXeIV9lXeYUk4hVfBlp9LclZGX8tGi
+7Xa2enMvIt5q/Yg3Hh755ZxnDYxCoGkNOXUmnMusKstE0YzvZ5Gv6fcRKFBUgZLh
+hUBqIEAYly1EqH/y45APiRt3Nor1yF6zEI4TnL0yNrHw6LyQkUNCHIGMJLfnJQ9L
+camMGIXOx60kXNMTigF9oXXwixWAnDM9y3QT8QXA7hej/4zkbO+vIeV/7lGUdkyg
+PAi92EvyxmsliEMyMR0VINl8emyobvfwa7oMeWMR+hg=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/kirk-key.pem b/sample-resource-plugin/src/test/resources/security/kirk-key.pem
new file mode 100644
index 0000000000..1949c26139
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/kirk-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCVXDgEJQorgfXp
+gpY0TgF55bD2xuzxN5Dc9rDfgWxrsOvOloMpd7k6FR71bKWjJi1KptSmM/cDElky
+AWYKSfYWGiGxsQ+EQW+6kwCfEOHXQldn+0+JcWqP+osSPjtJfwRvRN5kRqP69MPo
+7U0N2kdqenqMWjmG1chDGLRSOEGU5HIBiDxsZtOcvMaJ8b1eaW0lvS+6gFQ80AvB
+GBkDDCOHHLtDXBylrZk2CQP8AzxNicIZ4B8G3CG3OHA8+nBtEtxZoIihrrkqlMt+
+b/5N8u8zB0Encew0kdrc4R/2wS//ahr6U+9Siq8T7WsUtGwKj3BJClg6OyDJRhlu
+y2gFnxoPAgMBAAECggEAP5TOycDkx+megAWVoHV2fmgvgZXkBrlzQwUG/VZQi7V4
+ZGzBMBVltdqI38wc5MtbK3TCgHANnnKgor9iq02Z4wXDwytPIiti/ycV9CDRKvv0
+TnD2hllQFjN/IUh5n4thHWbRTxmdM7cfcNgX3aZGkYbLBVVhOMtn4VwyYu/Mxy8j
+xClZT2xKOHkxqwmWPmdDTbAeZIbSv7RkIGfrKuQyUGUaWhrPslvYzFkYZ0umaDgQ
+OAthZew5Bz3OfUGOMPLH61SVPuJZh9zN1hTWOvT65WFWfsPd2yStI+WD/5PU1Doo
+1RyeHJO7s3ug8JPbtNJmaJwHe9nXBb/HXFdqb976yQKBgQDNYhpu+MYSYupaYqjs
+9YFmHQNKpNZqgZ4ceRFZ6cMJoqpI5dpEMqToFH7tpor72Lturct2U9nc2WR0HeEs
+/6tiptyMPTFEiMFb1opQlXF2ae7LeJllntDGN0Q6vxKnQV+7VMcXA0Y8F7tvGDy3
+qJu5lfvB1mNM2I6y/eMxjBuQhwKBgQC6K41DXMFro0UnoO879pOQYMydCErJRmjG
+/tZSy3Wj4KA/QJsDSViwGfvdPuHZRaG9WtxdL6kn0w1exM9Rb0bBKl36lvi7o7xv
+M+Lw9eyXMkww8/F5d7YYH77gIhGo+RITkKI3+5BxeBaUnrGvmHrpmpgRXWmINqr0
+0jsnN3u0OQKBgCf45vIgItSjQb8zonLz2SpZjTFy4XQ7I92gxnq8X0Q5z3B+o7tQ
+K/4rNwTju/sGFHyXAJlX+nfcK4vZ4OBUJjP+C8CTjEotX4yTNbo3S6zjMyGQqDI5
+9aIOUY4pb+TzeUFJX7If5gR+DfGyQubvvtcg1K3GHu9u2l8FwLj87sRzAoGAflQF
+RHuRiG+/AngTPnZAhc0Zq0kwLkpH2Rid6IrFZhGLy8AUL/O6aa0IGoaMDLpSWUJp
+nBY2S57MSM11/MVslrEgGmYNnI4r1K25xlaqV6K6ztEJv6n69327MS4NG8L/gCU5
+3pEm38hkUi8pVYU7in7rx4TCkrq94OkzWJYurAkCgYATQCL/rJLQAlJIGulp8s6h
+mQGwy8vIqMjAdHGLrCS35sVYBXG13knS52LJHvbVee39AbD5/LlWvjJGlQMzCLrw
+F7oILW5kXxhb8S73GWcuMbuQMFVHFONbZAZgn+C9FW4l7XyRdkrbR1MRZ2km8YMs
+/AHmo368d4PSNRMMzLHw8Q==
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/kirk.pem b/sample-resource-plugin/src/test/resources/security/kirk.pem
new file mode 100644
index 0000000000..36b7e19a75
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/kirk.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEmDCCA4CgAwIBAgIUaYSlET3nzsotWTrWueVPPh10yLcwDQYJKoZIhvcNAQEL
+BQAwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFt
+cGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFtcGxl
+IENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4gUm9v
+dCBDQTAeFw0yNDAyMjAxNzA0MjRaFw0zNDAyMTcxNzA0MjRaME0xCzAJBgNVBAYT
+AmRlMQ0wCwYDVQQHDAR0ZXN0MQ8wDQYDVQQKDAZjbGllbnQxDzANBgNVBAsMBmNs
+aWVudDENMAsGA1UEAwwEa2lyazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAJVcOAQlCiuB9emCljROAXnlsPbG7PE3kNz2sN+BbGuw686Wgyl3uToVHvVs
+paMmLUqm1KYz9wMSWTIBZgpJ9hYaIbGxD4RBb7qTAJ8Q4ddCV2f7T4lxao/6ixI+
+O0l/BG9E3mRGo/r0w+jtTQ3aR2p6eoxaOYbVyEMYtFI4QZTkcgGIPGxm05y8xonx
+vV5pbSW9L7qAVDzQC8EYGQMMI4ccu0NcHKWtmTYJA/wDPE2JwhngHwbcIbc4cDz6
+cG0S3FmgiKGuuSqUy35v/k3y7zMHQSdx7DSR2tzhH/bBL/9qGvpT71KKrxPtaxS0
+bAqPcEkKWDo7IMlGGW7LaAWfGg8CAwEAAaOCASswggEnMAwGA1UdEwEB/wQCMAAw
+DgYDVR0PAQH/BAQDAgXgMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMCMB0GA1UdDgQW
+BBSjMS8tgguX/V7KSGLoGg7K6XMzIDCBzwYDVR0jBIHHMIHEgBQXh9+gWutmEqfV
+0Pi6EkU8tysAnKGBlaSBkjCBjzETMBEGCgmSJomT8ixkARkWA2NvbTEXMBUGCgmS
+JomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1wbGUgQ29tIEluYy4xITAf
+BgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEhMB8GA1UEAwwYRXhhbXBs
+ZSBDb20gSW5jLiBSb290IENBghQNZAmZZn3EFOxBR4630XlhI+mo4jANBgkqhkiG
+9w0BAQsFAAOCAQEACEUPPE66/Ot3vZqRGpjDjPHAdtOq+ebaglQhvYcnDw8LOZm8
+Gbh9M88CiO6UxC8ipQLTPh2yyeWArkpJzJK/Pi1eoF1XLiAa0sQ/RaJfQWPm9dvl
+1ZQeK5vfD4147b3iBobwEV+CR04SKow0YeEEzAJvzr8YdKI6jqr+2GjjVqzxvRBy
+KRVHWCFiR7bZhHGLq3br8hSu0hwjb3oGa1ZI8dui6ujyZt6nm6BoEkau3G/6+zq9
+E6vX3+8Fj4HKCAL6i0SwfGmEpTNp5WUhqibK/fMhhmMT4Mx6MxkT+OFnIjdUU0S/
+e3kgnG8qjficUr38CyEli1U0M7koIXUZI7r+LQ==
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/root-ca.pem b/sample-resource-plugin/src/test/resources/security/root-ca.pem
new file mode 100644
index 0000000000..d33f5f7216
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/root-ca.pem
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIExjCCA66gAwIBAgIUDWQJmWZ9xBTsQUeOt9F5YSPpqOIwDQYJKoZIhvcNAQEL
+BQAwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFt
+cGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFtcGxl
+IENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4gUm9v
+dCBDQTAeFw0yNDAyMjAxNzAwMzZaFw0zNDAyMTcxNzAwMzZaMIGPMRMwEQYKCZIm
+iZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEZMBcGA1UECgwQ
+RXhhbXBsZSBDb20gSW5jLjEhMB8GA1UECwwYRXhhbXBsZSBDb20gSW5jLiBSb290
+IENBMSEwHwYDVQQDDBhFeGFtcGxlIENvbSBJbmMuIFJvb3QgQ0EwggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEPyN7J9VGPyJcQmCBl5TGwfSzvVdWwoQU
+j9aEsdfFJ6pBCDQSsj8Lv4RqL0dZra7h7SpZLLX/YZcnjikrYC+rP5OwsI9xEE/4
+U98CsTBPhIMgqFK6SzNE5494BsAk4cL72dOOc8tX19oDS/PvBULbNkthQ0aAF1dg
+vbrHvu7hq7LisB5ZRGHVE1k/AbCs2PaaKkn2jCw/b+U0Ml9qPuuEgz2mAqJDGYoA
+WSR4YXrOcrmPuRqbws464YZbJW898/0Pn/U300ed+4YHiNYLLJp51AMkR4YEw969
+VRPbWIvLrd0PQBooC/eLrL6rvud/GpYhdQEUx8qcNCKd4bz3OaQ5AgMBAAGjggEW
+MIIBEjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQU
+F4ffoFrrZhKn1dD4uhJFPLcrAJwwgc8GA1UdIwSBxzCBxIAUF4ffoFrrZhKn1dD4
+uhJFPLcrAJyhgZWkgZIwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJ
+k/IsZAEZFgdleGFtcGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYD
+VQQLDBhFeGFtcGxlIENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUg
+Q29tIEluYy4gUm9vdCBDQYIUDWQJmWZ9xBTsQUeOt9F5YSPpqOIwDQYJKoZIhvcN
+AQELBQADggEBAL3Q3AHUhMiLUy6OlLSt8wX9I2oNGDKbBu0atpUNDztk/0s3YLQC
+YuXgN4KrIcMXQIuAXCx407c+pIlT/T1FNn+VQXwi56PYzxQKtlpoKUL3oPQE1d0V
+6EoiNk+6UodvyZqpdQu7fXVentRMk1QX7D9otmiiNuX+GSxJhJC2Lyzw65O9EUgG
+1yVJon6RkUGtqBqKIuLksKwEr//ELnjmXit4LQKSnqKr0FTCB7seIrKJNyb35Qnq
+qy9a/Unhokrmdda1tr6MbqU8l7HmxLuSd/Ky+L0eDNtYv6YfMewtjg0TtAnFyQov
+rdXmeq1dy9HLo3Ds4AFz3Gx9076TxcRS/iI=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/sample.pem b/sample-resource-plugin/src/test/resources/security/sample.pem
new file mode 100644
index 0000000000..44101f0b37
--- /dev/null
+++ b/sample-resource-plugin/src/test/resources/security/sample.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPDCCAySgAwIBAgIUaYSlET3nzsotWTrWueVPPh10yLYwDQYJKoZIhvcNAQEL
+BQAwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFt
+cGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFtcGxl
+IENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4gUm9v
+dCBDQTAeFw0yNDAyMjAxNzAzMjVaFw0zNDAyMTcxNzAzMjVaMFcxCzAJBgNVBAYT
+AmRlMQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDARub2RlMQ0wCwYDVQQLDARub2Rl
+MRswGQYDVQQDDBJub2RlLTAuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCm93kXteDQHMAvbUPNPW5pyRHKDD42XGWSgq0k1D29C/Ud
+yL21HLzTJa49ZU2ldIkSKs9JqbkHdyK0o8MO6L8dotLoYbxDWbJFW8bp1w6tDTU0
+HGkn47XVu3EwbfrTENg3jFu+Oem6a/501SzITzJWtS0cn2dIFOBimTVpT/4Zv5qr
+XA6Cp4biOmoTYWhi/qQl8d0IaADiqoZ1MvZbZ6x76qTrRAbg+UWkpTEXoH1xTc8n
+dibR7+HP6OTqCKvo1NhE8uP4pY+fWd6b6l+KLo3IKpfTbAIJXIO+M67FLtWKtttD
+ao94B069skzKk6FPgW/OZh6PRCD0oxOavV+ld2SjAgMBAAGjgcYwgcMwRwYDVR0R
+BEAwPogFKgMEBQWCEm5vZGUtMC5leGFtcGxlLmNvbYIJbG9jYWxob3N0hxAAAAAA
+AAAAAAAAAAAAAAABhwR/AAABMAsGA1UdDwQEAwIF4DAdBgNVHSUEFjAUBggrBgEF
+BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU0/qDQaY10jIo
+wCjLUpz/HfQXyt8wHwYDVR0jBBgwFoAUF4ffoFrrZhKn1dD4uhJFPLcrAJwwDQYJ
+KoZIhvcNAQELBQADggEBAGbij5WyF0dKhQodQfTiFDb73ygU6IyeJkFSnxF67gDz
+pQJZKFvXuVBa3cGP5e7Qp3TK50N+blXGH0xXeIV9lXeYUk4hVfBlp9LclZGX8tGi
+7Xa2enMvIt5q/Yg3Hh755ZxnDYxCoGkNOXUmnMusKstE0YzvZ5Gv6fcRKFBUgZLh
+hUBqIEAYly1EqH/y45APiRt3Nor1yF6zEI4TnL0yNrHw6LyQkUNCHIGMJLfnJQ9L
+camMGIXOx60kXNMTigF9oXXwixWAnDM9y3QT8QXA7hej/4zkbO+vIeV/7lGUdkyg
+PAi92EvyxmsliEMyMR0VINl8emyobvfwa7oMeWMR+hg=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/sample-resource-plugin/src/test/resources/security/test-kirk.jks b/sample-resource-plugin/src/test/resources/security/test-kirk.jks
new file mode 100644
index 0000000000..6c8c5ef77e
Binary files /dev/null and b/sample-resource-plugin/src/test/resources/security/test-kirk.jks differ
diff --git a/settings.gradle b/settings.gradle
index 1c3e7ff5aa..0bb3c5639d 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -5,3 +5,6 @@
  */
 
 rootProject.name = 'opensearch-security'
+
+include "sample-resource-plugin"
+project(":sample-resource-plugin").name = "opensearch-sample-resource-plugin"