Cedar policy language is now open source(cedarpolicy.com)
cedarpolicy.com
Cedar policy language is now open source
https://www.cedarpolicy.com/en
13 comments
Yes&
If you like that angle I think you’d really like the part of this talk https://www.youtube.com/watch?v=k6pPcnLuOXY from Emina Torlak, goes into how they were able to have duel implementations to get both performance and formal correctness.
If you like that angle I think you’d really like the part of this talk https://www.youtube.com/watch?v=k6pPcnLuOXY from Emina Torlak, goes into how they were able to have duel implementations to get both performance and formal correctness.
Congratulations on the OSS launch! Was it always in the cards to open source Cedar?
I'm excited to see you've found a way to bring verification that exists in non-policy-based authorization solutions to Cedar. Was that functionality the driving factor that made the team create something new instead of leveraging the widely adopted Rego/OPA[0] stack for policy?
It looks like this talk[1] briefly covers why you made Cedar, but I'd be eager to hear more about the trade-offs in design, because other policy languages are leveraging decades of formal research on Datalog.
Disclosure: I work on SpiceDB[2], an authorization database inspired by Google's Zanzibar system[3], but I wouldn't say Cedar is directly competitive as SpiceDB is not a policy-based system.
[0]: https://www.openpolicyagent.org/docs/latest/policy-language/
[1]: https://youtu.be/k6pPcnLuOXY?t=2037
[2]: https://github.com/authzed/spicedb
[3]: https://zanzibar.tech
I'm excited to see you've found a way to bring verification that exists in non-policy-based authorization solutions to Cedar. Was that functionality the driving factor that made the team create something new instead of leveraging the widely adopted Rego/OPA[0] stack for policy?
It looks like this talk[1] briefly covers why you made Cedar, but I'd be eager to hear more about the trade-offs in design, because other policy languages are leveraging decades of formal research on Datalog.
Disclosure: I work on SpiceDB[2], an authorization database inspired by Google's Zanzibar system[3], but I wouldn't say Cedar is directly competitive as SpiceDB is not a policy-based system.
[0]: https://www.openpolicyagent.org/docs/latest/policy-language/
[1]: https://youtu.be/k6pPcnLuOXY?t=2037
[2]: https://github.com/authzed/spicedb
[3]: https://zanzibar.tech
I agree with you re:"I wouldn't say Cedar is directly competitive as SpiceDB" - I think Zanzibar and SpiceDB in particular can work well together with Cedar / OPA. By syncing SpiceDB via OPAL[0] into edge nodes with Cedar-agents[1].
[0]: https://github.com/permitio/opal
[1]: https://github.com/permitio/cedar-agent
[0]: https://github.com/permitio/opal
[1]: https://github.com/permitio/cedar-agent
Related:
AWS Creates New Policy-Based Access Control Language Cedar - https://news.ycombinator.com/item?id=34865768 - Feb 2023 (83 comments)
Cedar: A New Policy Language - https://news.ycombinator.com/item?id=34449828 - Jan 2023 (3 comments)
AWS Creates New Policy-Based Access Control Language Cedar - https://news.ycombinator.com/item?id=34865768 - Feb 2023 (83 comments)
Cedar: A New Policy Language - https://news.ycombinator.com/item?id=34449828 - Jan 2023 (3 comments)
I tried Cedar out for a small research project when it was first announced, and it felt incredibly clumsy compared to what I could have done in OPA. That was probably 8-9 months ago, so things may have changed.
What specifically did you find clumsy and how would you have liked it to work?
Really exciting to see this and the recent renewed interest in more expressive ACL systems re: policy and (alternatively) relational access control.
The pedigree of Cedar is also really interesting to me, coming from the angle that Torlak was previously part of the UNSAT group @ Washington, and was the developer of Rosette. I was hoping there might be a semantic description of Cedar using Rosette as well! Maybe writing one would be a good challenge...
The pedigree of Cedar is also really interesting to me, coming from the angle that Torlak was previously part of the UNSAT group @ Washington, and was the developer of Rosette. I was hoping there might be a semantic description of Cedar using Rosette as well! Maybe writing one would be a good challenge...
Why do all the web pages have Amazon copyright footers?
Because it's a library made by AWS: https://aws.amazon.com/about-aws/whats-new/2023/05/cedar-ope...
[deleted]
The website is neat.
Great website— its my favorite part!
"We want to assure developers that Cedar’s authorization decisions will be correct. To provide that assurance, we follow a two-part process we call verification-guided development when we’re working on Cedar. First, we use automated reasoning to prove important correctness properties about formal models of Cedar’s components. Second, we use differential random testing to show that the models match the production code."