4 ms·

Cedar policy language is now open source

99 points by hakejam 3y ago

mjb 3y ago
One angle on this I'm particularly excited about is the formal methods/automated reasoning work the team did on Cedar: https://www.amazon.science/blog/how-we-built-cedar-with-automated-reasoning-and-differential-testing https://www.amazon.science/blog/how-we-built-cedar-with-auto... "We want to assure developers that Cedar’s authorization decisions will be correct. To provide that assurance, we follow a two-part process we call verification-guided development when we’re working on Cedar. First, we use automated reasoning to prove important correctness properties about formal models of Cedar’s components. Second, we use differential random testing to show that the models match the production code."
- iou 3y ago
  Yes& If you like that angle I think you’d really like the part of this talk https://www.youtube.com/watch?v=k6pPcnLuOXY https://www.youtube.com/watch?v=k6pPcnLuOXY from Emina Torlak, goes into how they were able to have duel implementations to get both performance and formal correctness.
jzelinskie 3y ago
Congratulations on the OSS launch! Was it always in the cards to open source Cedar? I'm excited to see you've found a way to bring verification that exists in non-policy-based authorization solutions to Cedar. Was that functionality the driving factor that made the team create something new instead of leveraging the widely adopted Rego/OPA[0] stack for policy? It looks like this talk[1] briefly covers why you made Cedar, but I'd be eager to hear more about the trade-offs in design, because other policy languages are leveraging decades of formal research on Datalog. Disclosure: I work on SpiceDB[2], an authorization database inspired by Google's Zanzibar system[3], but I wouldn't say Cedar is directly competitive as SpiceDB is not a policy-based system. [0]: https://www.openpolicyagent.org/docs/latest/policy-language/ https://www.openpolicyagent.org/docs/latest/policy-language/ [1]: https://youtu.be/k6pPcnLuOXY?t=2037 https://youtu.be/k6pPcnLuOXY?t=2037 [2]: https://github.com/authzed/spicedb https://github.com/authzed/spicedb [3]: https://zanzibar.tech https://zanzibar.tech
- orweis 3y ago
  I agree with you re:"I wouldn't say Cedar is directly competitive as SpiceDB" - I think Zanzibar and SpiceDB in particular can work well together with Cedar / OPA. By syncing SpiceDB via OPAL[0] into edge nodes with Cedar-agents[1]. [0]: https://github.com/permitio/opal https://github.com/permitio/opal [1]: https://github.com/permitio/cedar-agent https://github.com/permitio/cedar-agent
flurie 3y ago
I tried Cedar out for a small research project when it was first announced, and it felt incredibly clumsy compared to what I could have done in OPA. That was probably 8-9 months ago, so things may have changed.
- 094459 3y ago
  What specifically did you find clumsy and how would you have liked it to work?
aseipp 3y ago
Really exciting to see this and the recent renewed interest in more expressive ACL systems re: policy and (alternatively) relational access control. The pedigree of Cedar is also really interesting to me, coming from the angle that Torlak was previously part of the UNSAT group @ Washington, and was the developer of Rosette. I was hoping there might be a semantic description of Cedar using Rosette as well! Maybe writing one would be a good challenge...
dang 3y ago
Related: AWS Creates New Policy-Based Access Control Language Cedar - https://news.ycombinator.com/item?id=34865768 https://news.ycombinator.com/item?id=34865768 - Feb 2023 (83 comments) Cedar: A New Policy Language - https://news.ycombinator.com/item?id=34449828 https://news.ycombinator.com/item?id=34449828 - Jan 2023 (3 comments)
sakesun 3y ago
The website is neat.
efitz 3y ago
Why do all the web pages have Amazon copyright footers?
- jffry 3y ago
  Because it's a library made by AWS: https://aws.amazon.com/about-aws/whats-new/2023/05/cedar-open-source-language-access-control/ https://aws.amazon.com/about-aws/whats-new/2023/05/cedar-ope...
  - deleted 3y ago
    [deleted]
stev678923 3y ago
Great website— its my favorite part!

99 points by hakejam 3y ago

mjb 3y ago

One angle on this I'm particularly excited about is the formal methods/automated reasoning work the team did on Cedar: https://www.amazon.science/blog/how-we-built-cedar-with-automated-reasoning-and-differential-testing https://www.amazon.science/blog/how-we-built-cedar-with-auto... "We want to assure developers that Cedar’s authorization decisions will be correct. To provide that assurance, we follow a two-part process we call verification-guided development when we’re working on Cedar. First, we use automated reasoning to prove important correctness properties about formal models of Cedar’s components. Second, we use differential random testing to show that the models match the production code."

iou 3y ago
Yes& If you like that angle I think you’d really like the part of this talk https://www.youtube.com/watch?v=k6pPcnLuOXY https://www.youtube.com/watch?v=k6pPcnLuOXY from Emina Torlak, goes into how they were able to have duel implementations to get both performance and formal correctness.

jzelinskie 3y ago

Congratulations on the OSS launch! Was it always in the cards to open source Cedar? I'm excited to see you've found a way to bring verification that exists in non-policy-based authorization solutions to Cedar. Was that functionality the driving factor that made the team create something new instead of leveraging the widely adopted Rego/OPA[0] stack for policy? It looks like this talk[1] briefly covers why you made Cedar, but I'd be eager to hear more about the trade-offs in design, because other policy languages are leveraging decades of formal research on Datalog. Disclosure: I work on SpiceDB[2], an authorization database inspired by Google's Zanzibar system[3], but I wouldn't say Cedar is directly competitive as SpiceDB is not a policy-based system. [0]: https://www.openpolicyagent.org/docs/latest/policy-language/ https://www.openpolicyagent.org/docs/latest/policy-language/ [1]: https://youtu.be/k6pPcnLuOXY?t=2037 https://youtu.be/k6pPcnLuOXY?t=2037 [2]: https://github.com/authzed/spicedb https://github.com/authzed/spicedb [3]: https://zanzibar.tech https://zanzibar.tech

orweis 3y ago
I agree with you re:"I wouldn't say Cedar is directly competitive as SpiceDB" - I think Zanzibar and SpiceDB in particular can work well together with Cedar / OPA. By syncing SpiceDB via OPAL[0] into edge nodes with Cedar-agents[1]. [0]: https://github.com/permitio/opal https://github.com/permitio/opal [1]: https://github.com/permitio/cedar-agent https://github.com/permitio/cedar-agent

flurie 3y ago

I tried Cedar out for a small research project when it was first announced, and it felt incredibly clumsy compared to what I could have done in OPA. That was probably 8-9 months ago, so things may have changed.

094459 3y ago
What specifically did you find clumsy and how would you have liked it to work?

aseipp 3y ago

Really exciting to see this and the recent renewed interest in more expressive ACL systems re: policy and (alternatively) relational access control. The pedigree of Cedar is also really interesting to me, coming from the angle that Torlak was previously part of the UNSAT group @ Washington, and was the developer of Rosette. I was hoping there might be a semantic description of Cedar using Rosette as well! Maybe writing one would be a good challenge...

dang 3y ago

Related: AWS Creates New Policy-Based Access Control Language Cedar - https://news.ycombinator.com/item?id=34865768 https://news.ycombinator.com/item?id=34865768 - Feb 2023 (83 comments) Cedar: A New Policy Language - https://news.ycombinator.com/item?id=34449828 https://news.ycombinator.com/item?id=34449828 - Jan 2023 (3 comments)

sakesun 3y ago

The website is neat.

efitz 3y ago

Why do all the web pages have Amazon copyright footers?

jffry 3y ago
Because it's a library made by AWS: https://aws.amazon.com/about-aws/whats-new/2023/05/cedar-open-source-language-access-control/ https://aws.amazon.com/about-aws/whats-new/2023/05/cedar-ope...
- deleted 3y ago
  [deleted]

stev678923 3y ago

Great website— its my favorite part!