IsAuthorized

Source: src/AWS/VerifiedPermissions/IsAuthorized.ts

Runtime binding for Verified Permissions authorization — bind it to a PolicyStore inside a function runtime to get a client that evaluates authorization requests against the store’s Cedar policies.

This is the effectful-function DX for authorization: a Lambda calls isAuthorized(...) and Verified Permissions returns Allow or Deny along with the determining policies.

Authorizing Requests

Decide a Request in a Lambda

// init
const authz = yield* AWS.VerifiedPermissions.IsAuthorized(store);

// runtime
const { decision } = yield* authz.isAuthorized({
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});
// decision === "ALLOW" | "DENY"

Decide from a JWT

const { decision } = yield* authz.isAuthorizedWithToken({
  identityToken,
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});