Fine-Grained Authorization with Amazon Verified Permissions - Access Control Using Cedar Policies
Learn how to externalize authorization logic from application code using the Cedar policy language and implement token-based authorization decisions with Cognito integration.
Overview of Verified Permissions
Verified Permissions is a managed service that provides fine-grained authorization for applications, processing thousands of authorization requests per second. Traditionally, authorization logic was often implemented as if-statements within application code, requiring code deployments to change policies. Verified Permissions externalizes authorization rules using the Cedar policy language, allowing policy changes to take effect without code deployments.
Cedar Policies and Cognito Integration
Cedar policies consist of permit (allow) and forbid (deny) statements. You can declaratively write rules such as "User A is permitted to perform the read action on Document X" or "The admin role is permitted to perform all actions on all resources." With Cognito integration, ID token claims (groups, custom attributes) are used as principal attributes in Cedar policies, enabling token-based authorization decisions. A common pattern is to place a Lambda function as an API Gateway authorizer that calls the Verified Permissions IsAuthorized API.
Policy Stores and Batch Authorization
A policy store is a collection of Cedar policies, created per application. You define entity types (User, Document, Folder) and actions (Read, Write, Delete) in a schema to automate policy syntax validation. The IsAuthorized API authorizes a single request, while the BatchIsAuthorized API authorizes multiple requests at once. Policy templates define common patterns, and template-linked policies dynamically bind users and resources, streamlining policy management. CloudTrail records authorization request logs for access pattern analysis and auditing. For a comprehensive look at Verified Permissions best practices, check out technical books (Amazon).
Verified Permissions Pricing
Verified Permissions is priced based on the number of authorization requests. It costs approximately $15 per million requests, with no additional charges for policy store management or schema definitions. By integrating with Cognito, you can separate user authentication (Cognito) from authorization (Verified Permissions) and externalize authorization logic from application code. For applications with high request volumes, caching authorization results to reduce request counts is an effective cost optimization strategy.
Summary
Verified Permissions is a service that externalizes application authorization using the Cedar policy language. It separates user authentication from authorization through Cognito integration and automates syntax validation with policy store schemas. The BatchIsAuthorized API enables bulk authorization of multiple requests, and policy templates streamline common pattern management. CloudTrail records audit logs for authorization requests.