Cedar language preview
1. Permit with when
entity UIDs and a when condition
horizon-dark
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };atom-one-dark
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };github-dark
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };dracula
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };nord
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };github
permit (
principal == User::"alice",
action == Action::"viewPhoto",
resource
)
when { resource.owner == principal };2. Forbid unless MFA
unless clause over context
horizon-dark
forbid (principal, action, resource)
unless { context.mfa == true };atom-one-dark
forbid (principal, action, resource)
unless { context.mfa == true };github-dark
forbid (principal, action, resource)
unless { context.mfa == true };dracula
forbid (principal, action, resource)
unless { context.mfa == true };nord
forbid (principal, action, resource)
unless { context.mfa == true };github
forbid (principal, action, resource)
unless { context.mfa == true };3. Set membership
in and has operators
horizon-dark
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};atom-one-dark
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};github-dark
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};dracula
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};nord
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};github
permit (principal, action, resource)
when {
principal in Group::"admins" &&
resource has owner
};