Policy

Source: src/AWS/VerifiedPermissions/Policy.ts

A static Cedar policy in a Verified Permissions policy store. Static policies contain a complete Cedar statement and are evaluated for every matching authorization request.

Creating Policies

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.Policy("AllowAlice", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == PhotoApp::User::"alice",
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
  description: "Alice can view any photo",
});

Template-Linked Policies

const template = yield* AWS.VerifiedPermissions.PolicyTemplate("ViewPhoto", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == ?principal,
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
});

yield* AWS.VerifiedPermissions.Policy("AliceCanView", {
  policyStoreId: store.policyStoreId,
  templateId: template.policyTemplateId,
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
});