Cedar Policies
Attribute-based access control policies — permit and forbid rules evaluated at access time
Filter:
✅
engineer-read-aws
permitActivev1
permit(Engineering, read, res-aws-prod)Evaluation: When an identity's type or department matches the identity pattern, the requested action matches the action pattern, and the target resource ID/type/classification matches the resource pattern — access is permitted. Forbid always takes precedence over permit.
🚫
hr-pii-deny
forbidActivev1
forbid(*, *, res-hr-db)Evaluation: When an identity's type or department matches the identity pattern, the requested action matches the action pattern, and the target resource ID/type/classification matches the resource pattern — access is denied. Forbid always takes precedence over permit.
🚫
finance-deny
forbidActivev1
forbid(*, *, res-finance-db)Evaluation: When an identity's type or department matches the identity pattern, the requested action matches the action pattern, and the target resource ID/type/classification matches the resource pattern — access is denied. Forbid always takes precedence over permit.
✅
admin-all-permit
permitActivev1
permit(*, *, *)Evaluation: When an identity's type or department matches the identity pattern, the requested action matches the action pattern, and the target resource ID/type/classification matches the resource pattern — access is permitted. Forbid always takes precedence over permit.
Evaluation Rules
1. Forbid policies are checked first (forbid always wins)
2. Permit policies are checked second (at least one must match)
3. If no policy matches and no Neo4j path exists → deny
4. If no active forbid + Neo4j path exists → allow (default allow by path)