Amazon Verified Permissions (AVP) is a fully managed AWS service that hosts Cedar and evaluates authorization requests through AWS APIs. Policies remain in AVP, while applications typically provide entity data from a separate AWS data store. section 9.8
AVP fits an authorization architecture in which a Policy Enforcement Point (PEP) calls the service before protected operations reach backend logic.
- AWS manages infrastructure, scaling, updates, and availability. section 9.8
- AWS integrations support identity, logging, monitoring, and multi-account environments. section 9.8
- Each remote evaluation introduces network latency, so the PEP must construct requests that accurately represent the real operation. section 9.8
Evaluating a document-share request
A PEP can translate a request to share a document into a Cedar evaluation containing principal Alice, the document-share action, the target document, and context such as a managed device and Wednesday at 14:00. AVP returns the authorization decision for enforcement. section 9.8
Figure 9.2 The Policy Enforcement Point (PEP) in ACME’s Customer Collaboration platform translates a real-world /share request into a Cedar evaluation by combining session data (principal), entity data (resource relationships), and context signals (environment attributes). Cedar’s is_authorized API provides an allow or deny decision, which the PEP enforces before forwarding the request to the backend.
Trace how a Policy Enforcement Point combines session identity, entity relationships, and environmental context before forwarding an allowed operation. section 9.8
