AWS.VerifiedPermissions reference

GetPolicies

Source: src/AWS/VerifiedPermissions/GetPolicies.ts

Runtime binding for bulk policy retrieval — bind it to a PolicyStore inside a function runtime to fetch policy definitions (e.g. for admin / audit surfaces) without granting mutation rights.

GetPolicies: Reading Policies at Runtime

// init
const policies = yield* AWS.VerifiedPermissions.GetPolicies(store);

// runtime
const { results, errors } = yield* policies.batchGetPolicy({
  policyIds: ["9wYixMplbbZQb5fcZHyJhY"],
});

IdentitySource

Source: src/AWS/VerifiedPermissions/IdentitySource.ts

An identity source connects a Verified Permissions policy store to an identity provider — an Amazon Cognito user pool or any OpenID Connect (OIDC) IdP — so that IsAuthorizedWithToken and BatchIsAuthorizedWithToken can derive the principal directly from a JWT.

IdentitySource: Connecting an Identity Provider

Cognito User Pool

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.IdentitySource("Users", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  cognito: {
    userPoolArn: userPool.userPoolArn,
  },
});

OpenID Connect Provider

yield* AWS.VerifiedPermissions.IdentitySource("Oidc", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  openIdConnect: {
    issuer: "https://accounts.google.com",
    tokenSelection: {
      identityTokenOnly: { clientIds: ["my-oauth-client-id"] },
    },
  },
});

IsAuthorized

Source: src/AWS/VerifiedPermissions/IsAuthorized.ts

Runtime binding for Verified Permissions authorization — bind it to a PolicyStore inside a function runtime to get a client that evaluates authorization requests against the store’s Cedar policies.

This is the effectful-function DX for authorization: a Lambda calls isAuthorized(...) and Verified Permissions returns Allow or Deny along with the determining policies.

IsAuthorized: Authorizing Requests

Decide a Request in a Lambda

// init
const authz = yield* AWS.VerifiedPermissions.IsAuthorized(store);

// runtime
const { decision } = yield* authz.isAuthorized({
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});
// decision === "ALLOW" | "DENY"

Decide from a JWT

const { decision } = yield* authz.isAuthorizedWithToken({
  identityToken,
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});

Policy

Source: src/AWS/VerifiedPermissions/Policy.ts

A static Cedar policy in a Verified Permissions policy store. Static policies contain a complete Cedar statement and are evaluated for every matching authorization request.

Policy: Creating Policies

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.Policy("AllowAlice", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == PhotoApp::User::"alice",
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
  description: "Alice can view any photo",
});

Policy: Template-Linked Policies

const template = yield* AWS.VerifiedPermissions.PolicyTemplate("ViewPhoto", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == ?principal,
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
});

yield* AWS.VerifiedPermissions.Policy("AliceCanView", {
  policyStoreId: store.policyStoreId,
  templateId: template.policyTemplateId,
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
});

PolicyStore

Source: src/AWS/VerifiedPermissions/PolicyStore.ts

An Amazon Verified Permissions policy store — the container for Cedar policies, policy templates, and a schema. Authorization requests (IsAuthorized) are evaluated against all policies in a store.

PolicyStore: Creating a Policy Store

Basic Policy Store

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "OFF",
});

Strict Validation with a Schema

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "STRICT",
  description: "Photo app authorization",
});

yield* AWS.VerifiedPermissions.Schema("Schema", {
  policyStoreId: store.policyStoreId,
  cedarJson: JSON.stringify({
    PhotoApp: {
      entityTypes: { User: {}, Photo: {} },
      actions: { viewPhoto: { appliesTo: { principalTypes: ["User"], resourceTypes: ["Photo"] } } },
    },
  }),
});

PolicyStoreAlias

Source: src/AWS/VerifiedPermissions/PolicyStoreAlias.ts

A named alias for a Verified Permissions policy store. Aliases let callers reference a policy store by a stable name (e.g. in IsAuthorized requests) so the underlying store can be swapped without reconfiguring clients.

PolicyStoreAlias: Creating an Alias

Alias with a Generated Name

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

const alias = yield* AWS.VerifiedPermissions.PolicyStoreAlias("Alias", {
  policyStoreId: store.policyStoreId,
});

Named Alias with Hard Delete

yield* AWS.VerifiedPermissions.PolicyStoreAlias("Alias", {
  policyStoreId: store.policyStoreId,
  aliasName: "photo-app-prod",
  deletionMode: "HardDelete",
});

PolicyTemplate

Source: src/AWS/VerifiedPermissions/PolicyTemplate.ts

A Cedar policy template in a Verified Permissions policy store. Templates contain ?principal / ?resource placeholders; template-linked policies instantiate the template for a concrete principal and resource, and every linked policy automatically picks up template updates.

PolicyTemplate: Creating Policy Templates

Template with a Principal Placeholder

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

const template = yield* AWS.VerifiedPermissions.PolicyTemplate("ViewPhoto", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == ?principal,
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
  description: "Grant a user access to view photos",
});

Link a Policy to the Template

yield* AWS.VerifiedPermissions.Policy("AliceCanView", {
  policyStoreId: store.policyStoreId,
  templateId: template.policyTemplateId,
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
});

Schema

Source: src/AWS/VerifiedPermissions/Schema.ts

The Cedar schema for a Verified Permissions policy store. The schema declares the entity types and actions your policies reference; with validationMode: "STRICT" on the store, policies and templates are validated against it at submission time.

A policy store has at most one schema — PutSchema is an upsert that fully replaces the previous schema.

Schema: Defining a Schema

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "STRICT",
});

yield* AWS.VerifiedPermissions.Schema("Schema", {
  policyStoreId: store.policyStoreId,
  cedarJson: JSON.stringify({
    PhotoApp: {
      entityTypes: {
        User: {},
        Photo: {},
      },
      actions: {
        viewPhoto: {
          appliesTo: {
            principalTypes: ["User"],
            resourceTypes: ["Photo"],
          },
        },
      },
    },
  }),
});