AWS Creates New Policy-Based Access Control Language Cedar

https://www.infoq.com/news/2023/02/aws-policy-language-cedar/

by msolujic • 3 years ago

82 83 3 years ago

bradhe2• 3 years ago

Meh, looks like just another contrived configuration DSL to me. Doesn’t seem particularly innovative. Maybe needs some more complicated examples, but I bet 99% of the rules people will write look basically like the examples in the article.

Seems like a missed opportunity to invest in, say, OPA or something in the community to me. Probably was some dude’s L7 promo project in AWS.

fuklief• 3 years ago

Probably was some dude’s L7 promo project in AWS.

Actually a former CS prof at Maryland moving to industry. https://mhicks.me/

margorczynski• 3 years ago

So a theoretician who had little experience actually using such solutions in real life?

cryptos• 3 years ago

Does anyone actually like the policy language of OPA? Maybe I didn't invest enough time in learning, but I found it a terrible experience and the language to be counter intuitive.

supriyo-biswas• 3 years ago

Is this any different than a layer of syntactic sugar over IAM policies?

anthlax• 3 years ago

Yes, it is not for IAM policies

krab9• 3 years ago

For me personally, it would be much more useful if I could play with the policies interactively - issue requests with some tagging (a special access key maybe?) and see what permissions they need, what context they have and which of them are allowed/denied by the policies. And what if I edit this part, would it affect the recorded requests?

At the moment, it usually takes me several iterations to tune the policy.

rollthehard62• 3 years ago

So much this, I don't understand why cloud providers don't offer an easy way to view this sort of thing as really it should all be in the logging anyway.

lozenge• 3 years ago

It seems like AWS isn't good with cross cutting concerns. Eg instead of Cloudformation being part of a service during development, that they could even use during testing the service, every team creates a custom api and cf is an afterthought. It wouldn't surprise me if every service is also evaluating against iam policies independently as well.

cperciva• 3 years ago

The execution of rulesets needs to be performed synchronously and as fast as possible, since requests are blocked until they pass the permission checks; but it doesn't need any sort of replication since each request is validated independently.

Request logging can be performed asynchronously and has much more relaxed latency requirements, but data needs to be aggregated and replicated for durability.

The extremely different requirements pretty much guarantee that these will be two completely separate systems; by Conway's Law, this means two completely separate teams. In practice, logging is more aimed at business analytics and billing.

You're right that the information should be available, and there's no technical reason why it can't be made available, but there are technical reasons which influence the social reasons why it's not available.

fulafel6• 3 years ago

AWS had the policy simulator for IAM policies but it hasn't been kept up to date wrt new features (like SCP)... Maybe they'll have something similar for this.

lockedinspace• 3 years ago

You can simulate a policy with AWS IAM Policy Simulator

krab9• 3 years ago

This doesn't cut it. That tool helps if your role/user has a lot of policies that might interact between each other. But you already need to know the exact "actions" and context.

On the other hand, I have a tool that calls some AWS services that may in turn call other AWS services. Now if something fails because of IAM denial, I have to go through the logs to figure out what it needed, sometimes it's not even in the logs (S3). Then add it to the policy and repeat to see the next failed call.

I imagine being able to call real API calls, make them succeed and record what permissions it needed for each of those API calls. I don't need that as a permanent log, just as a development tool.

distcs5• 3 years ago

You can simulate a policy with AWS IAM Policy Simulator

Is it reliable though? I have experienced many situations where a role has access to a policy and yet the policy simulator said that access is denied due to "organization policy" with no further ability to drill down to which policy it thinks denies access. And it did that when the role did have access to the resource and could work with that resource successfully. So I stopped trusting the simulator. I wonder if others too have experienced similar issues with the simulator.

ProjectMoonShot• 3 years ago

The book AWS Cookbook section 1.2 is on 'Generating a Least Privilege IAM Policy Based on Access Patterns'.

[1] https://www.oreilly.com/library/view/aws-cookbook/9781492092...

[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/access-anal...

krab9• 3 years ago

This goes in the right direction. Still it's not 100% reliable (e.g. S3 isn't logged by default to cloudtrail, probably due to volume). Also, not really interactive. I'm talking mostly about ergonomics. Obviously we can solve the issue and create the right policy - but it's not as easy as it could be. That in turn leads to some people skipping the process and staying with too powerful keys.

alex-olivier• 3 years ago

(Disclaimer: I work for Cerbos[1])

When we started working on Cerbos[1] the very first external bit of tooling we released was the Cerbos Playground[2] which does exactly what you say - allows you to see the requests and responses as they make changes to their policies, making it easier to test and refine their rules.

This is a great starting point to prototype and test whether a decoupled authorization system is right for your use case. Cerbos uses YAML rather than a custom DSL to try and address the fact that authorization requirements generally don't sit with developers, rather a product owner of some sorts who is going to want to be able to comprehend the logic behind the permissions model.

[1] https://cerbos.dev [2] https://play.cerbos.dev

ctvo6• 3 years ago

Cedar has a playground that supports much of what you're asking for or were you referring to IAM (AWS specific, and not model policies for your business).

https://www.cedarpolicy.com/en/playground

ctvo6• 3 years ago

Interesting thing about the playground: the entire evaluator is apparently in a WebAssembly binary located at https://www.cedarpolicy.com/waterford_wasm_bg.wasm

It gives me a little hope on the direction and ability to embed Cedar in non-AWS contexts.

krab9• 3 years ago

It seems more akin to the IAM policy simulator to me. You need to know the specific action and context to play with the policy.

In the real case I don't know what context the actions carry that I may use for filtering, I don't know the action names and I may not even know the full list of API calls the tool I use wants to make.

AWS knows (could record) all of the above for me.

fulafel6• 3 years ago

This has nice air of familiarity in relation to RDF (subject-predicate-object) and Datalog. And of course much more concise and readable than IAM JSON or YAML.

  permit(
      principal == ?principal,
      action == Action::"download",
      resource in ?resource
  ) when {
      context.mfa == true
  };

danw1979• 3 years ago

Looks like a decent improvement on readability of JSON IAM policy and the templating thing is cool.

I’m a bit unclear on why they needed a new DSL to be able to do “automated reasoning” on policy effects though. It doesn’t seem semantically that different from the existing policy docs we all know and love.

abofh• 3 years ago

It's not a substitute/replacement for IAM, it's for their verified access product - basically IAM for your own applications. Nothing to do with IAM for your AWS account

fulafel6• 3 years ago

DSLs rarely strictly need custom syntax. It's for ergonomics.

unxdfa• 3 years ago

At least it's not YAML

bradhe2• 3 years ago

ALINAML

Hamuko• 3 years ago

Sites should really stop using title case for news articles. Seeing the title on HN made me ask "what's an access control language cedar", even though it's "access control language Cedar".

theusus• 3 years ago

Why?

ripper1138• 3 years ago

Someone needed a promotion

pjmlp• 3 years ago

AWS should know better about checking beforehand for existing names.

http://toastytech.com/guis/cedar.html

distcs5• 3 years ago

I really think that ship has sailed. I mean recently there was an ASDF tool version manager that had nothing to do with ASDF the system definition facility. It is becoming more and more common to reuse names without any regards for tradition or history.

zmmmmm• 3 years ago

Oh yay more proprietary cloud technologies to learn ...

dadadad100• 3 years ago

This is an entry into the application AuthZ world. The space is in need of a general approach to get away from ad hoc solutions in every application or in the IDP. Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach. It’s not clear which direction will win out, but it is time that this problem got some attention.

alexisread2• 3 years ago

Personally I prefer cuelang operating on JSON (aka IAM policy, kafka ACLs, IP blocklists, elasticsearch database config etc.) documents - cuelang-js is a wasm execution engine I can use with the cue binary across most apps/databases/kafka etc to have a unified policy engine.

The advantage here is that I can then simulate end-to-end policy what-ifs, and do build-time policy unit tests.

I can also handle business rules in a similar fashion for better visibility - how much of the business understands python/Go/Java/etc code?

bogomipz2• 3 years ago

Is there an online console somewhere you can paly with and test these cuelang-based policies using cuelang-js?

bogomipz2• 3 years ago

"Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach."

I understand the OPA from your description of it as a "datalog(prolog) based search approach" but you didn't characterize what the "Zanzibar based approach" is. Is there a similar short descriptive summary of its approach?

jschorr2• 3 years ago

Zanzibar is an authorization system Google built and describes in a paper [1], which uses relationships to make authorization decisions (aka ReBAC): if there exists a path of such relationships between a resource's permission and, say, a user, then the user is considered to have that permission on the resource. This structural approach to permission checking allows for high levels of scaling and low latency on checks.

Disclaimer: I am the cofounder of AuthZed, where we are building an open source version of Zanzibar known as SpiceDB [2]

[1] https://zanzibar.tech [2] https://github.com/authzed/spicedb

msolujic• 3 years ago

I hope some of open solutions for policy management will prevail soon,like OPA, and all public cloud providers give support for it.

I did not expect from AWS to simply support OPA in this phase of problem/market fit for the complex system Auth. Still, not happy with yet another siloed solution which is proprietary to one cloud.

0xbadcafebee5• 3 years ago

Why didn't they just support Open Policy Agent? It's been in CNCF for 5 years: https://www.cncf.io/projects/open-policy-agent-opa/

yegle• 3 years ago

Google has a CEL (common expression language) that seems easier to understand and extend: https://github.com/google/cel-spec

Using CEL for writing IAM policy: https://cloud.google.com/iam/docs/conditions-overview

brodouevencode• 3 years ago

Imagine if cloudformation had taken this approach

grogenaut8• 3 years ago

At this point realize that cloud formation is machine code, and cdk or terraform are the language you, a human, should use, like c/c++ but more like typescript.

What the machine needs is usually different from what you need. The machine solution sometimes comes first

perpil• 3 years ago

I don't understand why there isn't a language spec on the official website: https://www.cedarpolicy.com It's nice that the AWS heroes have filled in some of the documentation holes on their sites, but we need the spec! Right now there is just a tutorial that reveals pieces of the spec and a simulator for a language that isn't defined anywhere.

AWS Creates New Policy-Based Access Control Language Cedar

Related Stories