Next Generation Authorisation using Cedar
summary
Cedar decouples authorization into a readable policy DSL that uses permit/forbid effects and a principal-action-resource scope with conditional clauses; policies and an application schema plus session context yield one of three outputs: allow, deny, or error. The engine is implemented in Rust and is provably correct via Lean then verified by differential testing across hundreds of millions of randomized inputs so results match the formal spec. Python uses OY3 bindings, there’s a CLI and policy playground, and an AWS managed option (Amazon Verified Permissions).
AI-written summary · about
chapters (10)
- 0:00Introduction to Cedar
- 1:12Authorization challenges
- 7:42Policy-based authorization
- 10:51Modeling application resources
- 13:20Ensuring trust and correctness
- 17:32Policy analysis tools
- 18:25Practical demonstration
- 28:58Architecture and performance
- 32:15Resources and community
- 34:27Q&A session
related talks
20mCedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization
52mAccess management: Customer use of Cedar policy & Verified Permissions
43mBuilding Authorization with Node.js: Dos and Don’ts
49mLove, Hate, And Policy Languages
59mProvably secure authorization
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
45mThe Future of Authorization in Applications
59mFine-grained authorization for apps with Amazon Verified Permissions