Cedar Analysis is a static analysis tool that examines Cedar policy sets against their schema instead of testing only selected requests. It helps identify structural authorization problems before deployment. section 10.3
Cedar Analysis can reveal:
- Conflicts, such as one policy granting access while another denies it under the same conditions. section 10.3
- Redundancies, where overlapping policies seldom take effect. section 10.3
- Gaps, where actions or resources lack coverage and may receive unexpected implicit denials. section 10.3
- Structural defects that complement request-driven tests in continuous integration pipelines before policies reach production. section 10.5
// Test: project members can view Project Alpha documents
given:
principal = Employee::"alice"
action = Action::"doc:view"
resource = Document::"alpha-roadmap"
entities = {
Employee::"alice" in Project::"alpha",
Document::"alpha-roadmap" in Project::"alpha"
}
expect:
ALLOW
// Fay is an employee, but not a member of the project
given:
principal = Employee::"fay"
action = Action::"doc:view"
resource = Document::"alpha-roadmap"
entities = {
Employee::"fay" not in Project::"alpha",
Document::"alpha-roadmap" in Project::"alpha"
}
expect:
DENY
Pair static analysis with request-driven Cedar tests that verify concrete allow and deny scenarios, such as project membership controlling document access. section 10.3
