Cedar Cheat Sheet [WIP]

This is intended as a quick cheat sheet for the conditions part of a cedar policy.

Check presence of some_claim in any token

...
when {
   principal has some_claim
};

Example: Allow access if access token has the scope claim

permit (
   principal, 
   action, 
   resource
)
when {
   principal has scope
};

Check presence of some_claim in any token and some_attribute in some claim

...
when {
   principal has some_claim.some_attribute
};

Example: Allow access if the ID token has email_address

permit (
   principal, 
   action, 
   resource
)
when {
   principal has id_token.email_address
};

Checking equality against some value for some attribute in any token

...
when {
   principal has some_claim.some_attribute &&
   principal.some_claim.some_attribute == "some value"
};

Example: Allow access if the login type is "otp", which is provided via the acr claim in the ID token

permit (
   principal, 
   action, 
   resource
)
when {
   principal has id_token.acr &&
   principal.id_token.acr == "otp"
};

Check comparison of <some value> in the context against a static value

...
when {
   context has current_time &&
   context.current_time > <some value>
};

Example: deny access when the request time is older than a certain timestamp

forbid (
   principal, 
   action, 
   resource
)
when {
   context has current_time &&
   context.current_time > 1739809517
};