4 ms·
How does this compare to Open Policy Agent, or oso? Why would I use this instead?
by thayne 3y ago
How does this compare to Open Policy Agent, or oso? Why would I use this instead?
- sarahcec 3y agoThe main benefits of Cedar are: *Verifiable/Analyzable *Deterministic Low Latencies *No Security Sandboxing Needed *Ergonomic (easily readable) *Enables parallel execution More here: https://www.youtube.com/watch?t=1798&v=k6pPcnLuOXY&feature=youtu.be https://www.youtube.com/watch?t=1798&v=k6pPcnLuOXY&feature=y...
- alexeldeib 3y agoI love the dual implementation, I hadn’t heard of Dafny. Can you speak to the point about latency? I wasn’t aware it made performance guarantees
- abrahms 3y agoOPA allows you to make API calls from it. This doesn't. This makes the latency more deterministic.
- alexeldeib 3y agoAh, I didn’t realize that. I was thinking in the context of pure policy evaluation. I know rego/opa had a policy performance doc so was curious. Thanks :)
- candiddevmike 3y agoIf you're all in on AWS, use it, if not, use OPA. Lots of vendors support OPA/rego, I can't think of anything I use outside of AWS that supports Cedar.
- mooreds 3y agoI think that is part of why they open sourced it, to try to get more folks to use it. :)
- mritun 3y agoThe challenge with authorization is that mistakes are catastrophic. The foremost benefit of Cedar is that the implementation is formally proven. Which means that you are extremely unlikely to have to deal with unexpected behavior! Of course, the modeling needs to be reviewed manually for completeness, but the verifier can tell if the model is buggy or inconsistent.