A developer defines a schema describing the types of principals, actions, resources and their attributes, and then a set of policies in the Cedar language (e.g. 'permit(principal in Group::"admins", action, resource);'). At runtime the application passes the Cedar engine an authorization request made of four elements: principal (who), action (what), resource (on what) and context (extra data, e.g. time, IP, MFA). The engine evaluates all matching policies and returns a decision: Deny by default, unless a matching 'permit' policy exists and no 'forbid' applies. Because the language allows no loops or unbounded recursion, evaluation always terminates, and a validator can statically check policies against the schema and analyze their equivalence.
Traditionally authorization logic is woven directly into application code, making it hard to audit, test, reuse and change without risking security bugs. Cedar externalizes this logic into declarative policies that can be analyzed, versioned and verified independently of the application.
A single permit/forbid rule expressed in the principal-action-resource-context model.
A declaration of principal, action and resource types and their attributes, enabling static validation of policies.
The component that evaluates an authorization request against the policy set and returns an Allow/Deny decision with the determining policies.
A tool that checks policies against the schema and analyzes their properties (e.g. equivalence after refactoring).
Official
Absence of a matching 'permit' policy means denial. Missing a required policy silently blocks access.
If the attributes passed in a request do not match the schema, validation and decisions can be wrong.
AWS announced and open-sourced the Cedar language and its Rust implementation; Amazon Verified Permissions launched in parallel.
A paper describing the language and a formal Lean model with proofs of key properties (soundness, safety, analyzability) was published.
Time complexity: O(P) — liniowa wzgledem liczby i rozmiaru polityk.
Cedar can express different authorization models within one language.
Cedar is a policy-evaluation engine running on a general-purpose CPU; it needs no accelerators.
