9 ms·

AWS Creates New Policy-Based Access Control Language Cedar

82 points by msolujic 4y ago

bradhe 4y ago
Meh, looks like just another contrived configuration DSL to me. Doesn’t seem particularly innovative. Maybe needs some more complicated examples, but I bet 99% of the rules people will write look basically like the examples in the article. Seems like a missed opportunity to invest in, say, OPA or something in the community to me. Probably was some dude’s L7 promo project in AWS.
- fuklief 4y ago
  > Probably was some dude’s L7 promo project in AWS. Actually a former CS prof at Maryland moving to industry. https://mhicks.me/ https://mhicks.me/
  - margorczynski 4y ago
    So a theoretician who had little experience actually using such solutions in real life?
    - distcs 4y ago
      > So a theoretician who had little experience actually using such solutions in real life? These low-effort, borderline ad-hominem comments like yours make these comment threads a terrible reading experience. These comments add nothing to the discussion.
      - devopsArch 4y ago
        I disagree. when some tech seems to come out of nowhere, and disconnected from the general community practices, understanding the background of who made it can help understanding its blindspots. also, the whole thing did not start with some kind of open white paper explaining the need, the rational for a new framework or language and comparing with alternatives, etc. which is often how oss projects start.
        distcs 4y ago
        > understanding the background of who made it can help understanding its blindspots That background was already provided in the comment by fuklief. What value does the comment by margorczynski add to this discussion?
        cmeacham98 4y ago
        Creating a DSL is not particularly innovative but is definitely not "disconnected from the general community practices". > which is often how oss projects start lol
      - 0xbadcafebee 4y ago
        The comment added a very specific and valid criticism to the discussion: academics don't design for the real world. (In case I have to lead you down the path... the point being, the design will lack insight into how such a policy language might function in the real world, and thus not provide any significant advantage over existing policy languages, while simultaneously fragmenting said ecosystem)
        distcs 4y ago
        > academics don't design for the real world This is yet another ad hominem which I frankly find very distasteful. Plenty of real world software that you see around has been designed by academics and are hugely successful in the real world. Academics come in all varieties just like your engineers. There are good engineers and there are engineers with years of experience who design terrible software. There are academics who do not design for real world and there are academics who do. Just throwing around the term "academic" in a loose manner offers no insight on the quality of the work. If there is any valid criticism it should be made on the work, not about the person behind it. That you come to defend ad hominem in more elaborate words goes to reaffirm my original point about why these comments make these threads a terrible reading experience! They often seem to show a shallow understanding of both the academia and the professional IT industry.
        0xbadcafebee 4y ago
        You realize the phrase ad hominem means a personal attack, right? None of us have made a personal attack. If anything, we are attacking the distinction between one institution and another. We're pointing out that experience provides essential knowledge that a person who hasn't had experience lacks, a simple truth of life. Reading a book about performing surgery is much different than having actually performed the surgery. And someone who has worked in academia (aka "an academic") lacks experience in industry. An academic has not been actually applying the policies in a large organization for years, and thus cannot know or predict all the ways in which the practice of applying the policy can cause problems that do not present themselves in a non-industry setting. Again, we are not attacking a person. We are specifically saying that any person who lacks experience is not going to make as good of a solution. This is not a controversial statement.
- cryptos 4y ago
  Does anyone actually like the policy language of OPA? Maybe I didn't invest enough time in learning, but I found it a terrible experience and the language to be counter intuitive.
supriyo-biswas 4y ago
Is this any different than a layer of syntactic sugar over IAM policies?
- anthlax 4y ago
  Yes, it is not for IAM policies
krab 4y ago
For me personally, it would be much more useful if I could play with the policies interactively - issue requests with some tagging (a special access key maybe?) and see what permissions they need, what context they have and which of them are allowed/denied by the policies. And what if I edit this part, would it affect the recorded requests? At the moment, it usually takes me several iterations to tune the policy.
- rollthehard6 4y ago
  So much this, I don't understand why cloud providers don't offer an easy way to view this sort of thing as really it should all be in the logging anyway.
  - lozenge 4y ago
    It seems like AWS isn't good with cross cutting concerns. Eg instead of Cloudformation being part of a service during development, that they could even use during testing the service, every team creates a custom api and cf is an afterthought. It wouldn't surprise me if every service is also evaluating against iam policies independently as well.
    - rollthehard6 4y ago
      That reminds me of the latter stages of Sun Microsystems, where it seemed like multiple teams were developing competing solutions for system management and patching. Seems a wasteful model and not one that is servicing customers.
    - grogenaut 4y ago
      Much of the services were built well before clod formation... Or cloud formation became popular... Or before everyone was willing to make the trade-off that features come later because they had to have cloud formation. Like any other best practice you invent along the way. I'll bet there's something about your 1/3/5/10/15 year old that isn't up to current snuff. People forget, AWS is massive and taking care of edge case after edge case while being in a bullet point war with other cloud providers.
fulafel 4y ago
This has nice air of familiarity in relation to RDF (subject-predicate-object) and Datalog. And of course much more concise and readable than IAM JSON or YAML. permit( principal == ?principal, action == Action::"download", resource in ?resource ) when { context.mfa == true };
danw1979 4y ago
Looks like a decent improvement on readability of JSON IAM policy and the templating thing is cool. I’m a bit unclear on why they needed a new DSL to be able to do “automated reasoning” on policy effects though. It doesn’t seem semantically that different from the existing policy docs we all know and love.
- abofh 4y ago
  It's not a substitute/replacement for IAM, it's for their verified access product - basically IAM for your own applications. Nothing to do with IAM for your AWS account
- fulafel 4y ago
  DSLs rarely strictly need custom syntax. It's for ergonomics.
unxdfa 4y ago
At least it's not YAML
- bradhe 4y ago
  ALINAML
Hamuko 4y ago
Sites should really stop using title case for news articles. Seeing the title on HN made me ask "what's an access control language cedar", even though it's "access control language Cedar".
theusus 4y ago
Why?
ripper1138 4y ago
Someone needed a promotion
pjmlp 4y ago
AWS should know better about checking beforehand for existing names. http://toastytech.com/guis/cedar.html http://toastytech.com/guis/cedar.html
- distcs 4y ago
  I really think that ship has sailed. I mean recently there was an ASDF tool version manager that had nothing to do with ASDF the system definition facility. It is becoming more and more common to reuse names without any regards for tradition or history.
zmmmmm 4y ago
Oh yay more proprietary cloud technologies to learn ...
dadadad100 4y ago
This is an entry into the application AuthZ world. The space is in need of a general approach to get away from ad hoc solutions in every application or in the IDP. Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach. It’s not clear which direction will win out, but it is time that this problem got some attention.
- alexisread 4y ago
  Personally I prefer cuelang operating on JSON (aka IAM policy, kafka ACLs, IP blocklists, elasticsearch database config etc.) documents - cuelang-js is a wasm execution engine I can use with the cue binary across most apps/databases/kafka etc to have a unified policy engine. The advantage here is that I can then simulate end-to-end policy what-ifs, and do build-time policy unit tests. I can also handle business rules in a similar fashion for better visibility - how much of the business understands python/Go/Java/etc code?
  - bogomipz 4y ago
    Is there an online console somewhere you can paly with and test these cuelang-based policies using cuelang-js?
    - alexisread 4y ago
      https://cuelang.org/play/#cue@export@cue https://cuelang.org/play/#cue@export@cue https://cuetorials.com/ https://cuetorials.com/ is also useful
- bogomipz 4y ago
  >"Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach." I understand the OPA from your description of it as a "datalog(prolog) based search approach" but you didn't characterize what the "Zanzibar based approach" is. Is there a similar short descriptive summary of its approach?
  - 4y ago
msolujic 4y ago
I hope some of open solutions for policy management will prevail soon,like OPA, and all public cloud providers give support for it. I did not expect from AWS to simply support OPA in this phase of problem/market fit for the complex system Auth. Still, not happy with yet another siloed solution which is proprietary to one cloud.
0xbadcafebee 4y ago
Why didn't they just support Open Policy Agent? It's been in CNCF for 5 years: https://www.cncf.io/projects/open-policy-agent-opa/ https://www.cncf.io/projects/open-policy-agent-opa/
yegle 4y ago
Google has a CEL (common expression language) that seems easier to understand and extend: https://github.com/google/cel-spec https://github.com/google/cel-spec Using CEL for writing IAM policy: https://cloud.google.com/iam/docs/conditions-overview https://cloud.google.com/iam/docs/conditions-overview
- brodouevencode 4y ago
  Imagine if cloudformation had taken this approach
  - grogenaut 4y ago
    At this point realize that cloud formation is machine code, and cdk or terraform are the language you, a human, should use, like c/c++ but more like typescript. What the machine needs is usually different from what you need. The machine solution sometimes comes first
    - fulafel 4y ago
      A lot of people think CDK is a wrong turn. CF is just data. CDK generates CF without letting you do CF level transforms. It's an imperative wrapper to a inherently functional / declarative thing, and married to JavaScript to top it off. Generally wrapping a declarative, data based expression in a Turing complete API is a backwards direction - makes it less amenable to automated reasoning and risks intertwining incidental complexity of the GP programming environment like dependency churn and breakage in there. Terraform is better but lots of shops are wary of relying on third party foundations.
      - grogenaut 4y ago
        I don't really get these arguemnts on why CDK is bad. I've got around 3k accounts, 300k aws resources, 1k devs, all working fine on CDK... I've never seen where functional / declarative change mattered. My issue with TFN is a half baked turing language that I fight a lot, and CFN is terrible for IFs or massifly repaeated. I talked with the team building CDK... their market analysis was essentially: SysDEs love CFN or declarative. Developers hate repeating themselves and lack of abstractions. I generally agree with the latter. The lack of real modules, dependency management, compilers, etc are a put off for CFN and TFN for me. I'm loving CDK.
perpil 4y ago
I don't understand why there isn't a language spec on the official website: https://www.cedarpolicy.com https://www.cedarpolicy.com It's nice that the AWS heroes have filled in some of the documentation holes on their sites, but we need the spec! Right now there is just a tutorial that reveals pieces of the spec and a simulator for a language that isn't defined anywhere.

82 points by msolujic 4y ago

Meh, looks like just another contrived configuration DSL to me. Doesn’t seem particularly innovative. Maybe needs some more complicated examples, but I bet 99% of the rules people will write look basically like the examples in the article. Seems like a missed opportunity to invest in, say, OPA or something in the community to me. Probably was some dude’s L7 promo project in AWS.

fuklief 4y ago
> Probably was some dude’s L7 promo project in AWS. Actually a former CS prof at Maryland moving to industry. https://mhicks.me/ https://mhicks.me/
- margorczynski 4y ago
  So a theoretician who had little experience actually using such solutions in real life?
  - distcs 4y ago
    > So a theoretician who had little experience actually using such solutions in real life? These low-effort, borderline ad-hominem comments like yours make these comment threads a terrible reading experience. These comments add nothing to the discussion.
    - devopsArch 4y ago
      I disagree. when some tech seems to come out of nowhere, and disconnected from the general community practices, understanding the background of who made it can help understanding its blindspots. also, the whole thing did not start with some kind of open white paper explaining the need, the rational for a new framework or language and comparing with alternatives, etc. which is often how oss projects start.
      - distcs 4y ago
        > understanding the background of who made it can help understanding its blindspots That background was already provided in the comment by fuklief. What value does the comment by margorczynski add to this discussion?
      - cmeacham98 4y ago
        Creating a DSL is not particularly innovative but is definitely not "disconnected from the general community practices". > which is often how oss projects start lol
    - 0xbadcafebee 4y ago
      The comment added a very specific and valid criticism to the discussion: academics don't design for the real world. (In case I have to lead you down the path... the point being, the design will lack insight into how such a policy language might function in the real world, and thus not provide any significant advantage over existing policy languages, while simultaneously fragmenting said ecosystem)
      - distcs 4y ago
        > academics don't design for the real world This is yet another ad hominem which I frankly find very distasteful. Plenty of real world software that you see around has been designed by academics and are hugely successful in the real world. Academics come in all varieties just like your engineers. There are good engineers and there are engineers with years of experience who design terrible software. There are academics who do not design for real world and there are academics who do. Just throwing around the term "academic" in a loose manner offers no insight on the quality of the work. If there is any valid criticism it should be made on the work, not about the person behind it. That you come to defend ad hominem in more elaborate words goes to reaffirm my original point about why these comments make these threads a terrible reading experience! They often seem to show a shallow understanding of both the academia and the professional IT industry.
        0xbadcafebee 4y ago
        You realize the phrase ad hominem means a personal attack, right? None of us have made a personal attack. If anything, we are attacking the distinction between one institution and another. We're pointing out that experience provides essential knowledge that a person who hasn't had experience lacks, a simple truth of life. Reading a book about performing surgery is much different than having actually performed the surgery. And someone who has worked in academia (aka "an academic") lacks experience in industry. An academic has not been actually applying the policies in a large organization for years, and thus cannot know or predict all the ways in which the practice of applying the policy can cause problems that do not present themselves in a non-industry setting. Again, we are not attacking a person. We are specifically saying that any person who lacks experience is not going to make as good of a solution. This is not a controversial statement.
cryptos 4y ago
Does anyone actually like the policy language of OPA? Maybe I didn't invest enough time in learning, but I found it a terrible experience and the language to be counter intuitive.

supriyo-biswas 4y ago

Is this any different than a layer of syntactic sugar over IAM policies?

anthlax 4y ago
Yes, it is not for IAM policies

krab 4y ago

For me personally, it would be much more useful if I could play with the policies interactively - issue requests with some tagging (a special access key maybe?) and see what permissions they need, what context they have and which of them are allowed/denied by the policies. And what if I edit this part, would it affect the recorded requests? At the moment, it usually takes me several iterations to tune the policy.

rollthehard6 4y ago
So much this, I don't understand why cloud providers don't offer an easy way to view this sort of thing as really it should all be in the logging anyway.
- lozenge 4y ago
  It seems like AWS isn't good with cross cutting concerns. Eg instead of Cloudformation being part of a service during development, that they could even use during testing the service, every team creates a custom api and cf is an afterthought. It wouldn't surprise me if every service is also evaluating against iam policies independently as well.
  - rollthehard6 4y ago
    That reminds me of the latter stages of Sun Microsystems, where it seemed like multiple teams were developing competing solutions for system management and patching. Seems a wasteful model and not one that is servicing customers.
  - grogenaut 4y ago
    Much of the services were built well before clod formation... Or cloud formation became popular... Or before everyone was willing to make the trade-off that features come later because they had to have cloud formation. Like any other best practice you invent along the way. I'll bet there's something about your 1/3/5/10/15 year old that isn't up to current snuff. People forget, AWS is massive and taking care of edge case after edge case while being in a bullet point war with other cloud providers.

fulafel 4y ago

This has nice air of familiarity in relation to RDF (subject-predicate-object) and Datalog. And of course much more concise and readable than IAM JSON or YAML. permit( principal == ?principal, action == Action::"download", resource in ?resource ) when { context.mfa == true };

danw1979 4y ago

Looks like a decent improvement on readability of JSON IAM policy and the templating thing is cool. I’m a bit unclear on why they needed a new DSL to be able to do “automated reasoning” on policy effects though. It doesn’t seem semantically that different from the existing policy docs we all know and love.

abofh 4y ago
It's not a substitute/replacement for IAM, it's for their verified access product - basically IAM for your own applications. Nothing to do with IAM for your AWS account
fulafel 4y ago
DSLs rarely strictly need custom syntax. It's for ergonomics.

unxdfa 4y ago

At least it's not YAML

bradhe 4y ago
ALINAML

Hamuko 4y ago

Sites should really stop using title case for news articles. Seeing the title on HN made me ask "what's an access control language cedar", even though it's "access control language Cedar".

theusus 4y ago

Why?

ripper1138 4y ago

Someone needed a promotion

pjmlp 4y ago

AWS should know better about checking beforehand for existing names. http://toastytech.com/guis/cedar.html http://toastytech.com/guis/cedar.html

distcs 4y ago
I really think that ship has sailed. I mean recently there was an ASDF tool version manager that had nothing to do with ASDF the system definition facility. It is becoming more and more common to reuse names without any regards for tradition or history.

zmmmmm 4y ago

Oh yay more proprietary cloud technologies to learn ...

dadadad100 4y ago

This is an entry into the application AuthZ world. The space is in need of a general approach to get away from ad hoc solutions in every application or in the IDP. Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach. It’s not clear which direction will win out, but it is time that this problem got some attention.

alexisread 4y ago
Personally I prefer cuelang operating on JSON (aka IAM policy, kafka ACLs, IP blocklists, elasticsearch database config etc.) documents - cuelang-js is a wasm execution engine I can use with the cue binary across most apps/databases/kafka etc to have a unified policy engine. The advantage here is that I can then simulate end-to-end policy what-ifs, and do build-time policy unit tests. I can also handle business rules in a similar fashion for better visibility - how much of the business understands python/Go/Java/etc code?
- bogomipz 4y ago
  Is there an online console somewhere you can paly with and test these cuelang-based policies using cuelang-js?
  - alexisread 4y ago
    https://cuelang.org/play/#cue@export@cue https://cuelang.org/play/#cue@export@cue https://cuetorials.com/ https://cuetorials.com/ is also useful
bogomipz 4y ago
>"Cedar falls somewhere between OPA with its datalog (prolog) based search approach and a Zanzibar based approach." I understand the OPA from your description of it as a "datalog(prolog) based search approach" but you didn't characterize what the "Zanzibar based approach" is. Is there a similar short descriptive summary of its approach?
- 4y ago

msolujic 4y ago

I hope some of open solutions for policy management will prevail soon,like OPA, and all public cloud providers give support for it. I did not expect from AWS to simply support OPA in this phase of problem/market fit for the complex system Auth. Still, not happy with yet another siloed solution which is proprietary to one cloud.

0xbadcafebee 4y ago

Why didn't they just support Open Policy Agent? It's been in CNCF for 5 years: https://www.cncf.io/projects/open-policy-agent-opa/ https://www.cncf.io/projects/open-policy-agent-opa/

yegle 4y ago

Google has a CEL (common expression language) that seems easier to understand and extend: https://github.com/google/cel-spec https://github.com/google/cel-spec Using CEL for writing IAM policy: https://cloud.google.com/iam/docs/conditions-overview https://cloud.google.com/iam/docs/conditions-overview

brodouevencode 4y ago
Imagine if cloudformation had taken this approach
- grogenaut 4y ago
  At this point realize that cloud formation is machine code, and cdk or terraform are the language you, a human, should use, like c/c++ but more like typescript. What the machine needs is usually different from what you need. The machine solution sometimes comes first
  - fulafel 4y ago
    A lot of people think CDK is a wrong turn. CF is just data. CDK generates CF without letting you do CF level transforms. It's an imperative wrapper to a inherently functional / declarative thing, and married to JavaScript to top it off. Generally wrapping a declarative, data based expression in a Turing complete API is a backwards direction - makes it less amenable to automated reasoning and risks intertwining incidental complexity of the GP programming environment like dependency churn and breakage in there. Terraform is better but lots of shops are wary of relying on third party foundations.
    - grogenaut 4y ago
      I don't really get these arguemnts on why CDK is bad. I've got around 3k accounts, 300k aws resources, 1k devs, all working fine on CDK... I've never seen where functional / declarative change mattered. My issue with TFN is a half baked turing language that I fight a lot, and CFN is terrible for IFs or massifly repaeated. I talked with the team building CDK... their market analysis was essentially: SysDEs love CFN or declarative. Developers hate repeating themselves and lack of abstractions. I generally agree with the latter. The lack of real modules, dependency management, compilers, etc are a put off for CFN and TFN for me. I'm loving CDK.

perpil 4y ago

I don't understand why there isn't a language spec on the official website: https://www.cedarpolicy.com https://www.cedarpolicy.com It's nice that the AWS heroes have filled in some of the documentation holes on their sites, but we need the spec! Right now there is just a tutorial that reveals pieces of the spec and a simulator for a language that isn't defined anywhere.