Skip to content
This repository was archived by the owner on Jul 9, 2025. It is now read-only.

Commit 8a19853

Browse files
bentskuHarshCasper
bentsku
and
HarshCasper
authored
add AVP service documentation (#1738)
Co-authored-by: Harsh Mishra <erbeusgriffincasper@gmail.com>
1 parent 8b7150a commit 8a19853

File tree

2 files changed

+144
-0
lines changed

2 files changed

+144
-0
lines changed

‎content/en/user-guide/aws/cloudformation/index.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -437,6 +437,10 @@ When utilizing the Community image, any resources within the stack that are not
437437
| AWS::SES::ReceiptRuleSet | ✅ | ✅ | - |
438438
| AWS::SES::Template | ✅ | ✅ | ✅ |
439439
| AWS::SecretsManager::SecretTargetAttachment | ✅ | ✅ | - |
440+
| AWS::VerifiedPermissions::IdentitySource | ✅ | ✅ | - |
441+
| AWS::VerifiedPermissions::Policy | ✅ | ✅ | - |
442+
| AWS::VerifiedPermissions::PolicyStore | ✅ | ✅ | - |
443+
| AWS::VerifiedPermissions::PolicyTemplate | ✅ | ✅ | - |
440444
| AWS::WAFv2::IPSet | ✅ | ✅ | - |
441445
| AWS::WAFv2::LoggingConfiguration | ✅ | ✅ | - |
442446
| AWS::WAFv2::WebACL | ✅ | ✅ | - |

‎content/en/user-guide/aws/verifiedpermissions/index.md

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
---
2+
title: "Verified Permissions"
3+
linkTitle: "Verified Permissions"
4+
description: Get started with Verified Permissions on LocalStack
5+
tags: ["Enterprise plan"]
6+
---
7+
8+
## Introduction
9+
10+
Amazon Verified Permissions is a scalable service for managing fine-grained permissions and authorization in custom applications.
11+
It helps secure applications by moving authorization logic outside the app and managing policies in one place, using the [Cedar policy language](https://docs.cedarpolicy.com/) to define access rules.
12+
It checks if a principal can take an action on a resource in a specific context in your application.
13+
14+
LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito.
15+
The supported APIs are available on our [API coverage page](https://docs.localstack.cloud/references/coverage/coverage_verifiedpermissions/), which provides information on the extent of Verified Permissions' integration with LocalStack.
16+
17+
{{< callout >}}
18+
Verified Permissions is available as part of the LocalStack Enterprise plan.
19+
If you'd like to try it out, please [contact us](https://www.localstack.cloud/demo) to request access.
20+
{{< /callout >}}
21+
22+
## Getting started
23+
24+
This guide is designed for users new to Verified Permissions and assumes basic knowledge of the AWS CLI and our [`awslocal`](https://github.com/localstack/awscli-local) wrapper script.
25+
26+
Start your LocalStack container using your preferred method.
27+
We will demonstrate how to create a Verified Permissions Policy Store, add a policy to it, and authorize a request with the AWS CLI.
28+
29+
### Create a Policy Store
30+
31+
To create a Verified Permissions Policy Store, use the [`CreatePolicyStore`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicyStore.html) API.
32+
Run the following command to create a Policy Store with Schema validation settings set to `OFF`:
33+
34+
{{< command >}}
35+
$ awslocal verifiedpermissions create-policy-store \
36+
--validation-settings mode=OFF \
37+
--description "A local Policy Store"
38+
{{< /command >}}
39+
40+
The above command returns the following response:
41+
42+
```json
43+
{
44+
"policyStoreId": "q5PCScu9qo4aswMVc0owNN",
45+
"arn": "arn:aws:verifiedpermissions::000000000000:policy-store/q5PCScu9qo4aswMVc0owNN",
46+
"createdDate": "2025-04-22T19:24:11.175557Z",
47+
"lastUpdatedDate": "2025-04-22T19:24:11.175557Z"
48+
}
49+
```
50+
51+
You can list all the Verified Permissions policy stores using the [`ListPolicyStores`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicyStores.html) API.
52+
Run the following command to list all the Verified Permissions policy stores:
53+
54+
{{< command >}}
55+
$ awslocal verifiedpermissions list-policy-stores
56+
{{< /command >}}
57+
58+
### Create a Policy
59+
60+
To create a Verified Permissions Policy, use the [`CreatePolicy`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicy.html) API.
61+
62+
Create a JSON file named `static_policy.json` with the following content:
63+
64+
```json
65+
{
66+
"static": {
67+
"description": "Grant the User alice access to view the trip Album",
68+
"statement": "permit(principal == User::\"alice\", action == Action::\"view\", resource == Album::\"trip\");"
69+
}
70+
}
71+
```
72+
73+
You can then run this command to create the policy:
74+
{{< command >}}
75+
$ awslocal verifiedpermissions create-policy \
76+
--definition file://static_policy.json \
77+
--policy-store-id q5PCScu9qo4aswMVc0owNN
78+
{{< /command >}}
79+
80+
Replace the policy store ID with the ID of the policy store you created previously.
81+
82+
You should see the following output:
83+
84+
```json
85+
{
86+
"policyStoreId": "q5PCScu9qo4aswMVc0owNN",
87+
"policyId": "MfsIseJDeZsr5WUm3tB4FX",
88+
"policyType": "STATIC",
89+
"principal": {
90+
"entityType": "User",
91+
"entityId": "alice"
92+
},
93+
"resource": {
94+
"entityType": "Album",
95+
"entityId": "trip"
96+
},
97+
"actions": [
98+
{
99+
"actionType": "Action",
100+
"actionId": "view"
101+
}
102+
],
103+
"createdDate": "2025-04-22T19:25:25.161652Z",
104+
"lastUpdatedDate": "2025-04-22T19:25:25.161652Z",
105+
"effect": "Permit"
106+
}
107+
```
108+
109+
### Authorize a request
110+
111+
We can now make use of the Policy Store and the Policy to start authorizing requests.
112+
To authorize a request using Verified Permissions, use the [`IsAuthorized`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html) API.
113+
114+
{{< command >}}
115+
$ awslocal verifiedpermissions is-authorized \
116+
--policy-store-id q5PCScu9qo4aswMVc0owNN \
117+
--principal entityType=User,entityId=alice \
118+
--action actionType=Action,actionId=view \
119+
--resource entityType=Album,entityId=trip
120+
{{< /command >}}
121+
122+
You should get the following output, indicating that your request was allowed:
123+
124+
```json
125+
{
126+
"decision": "ALLOW",
127+
"determiningPolicies": [
128+
{
129+
"policyId": "MfsIseJDeZsr5WUm3tB4FX"
130+
}
131+
],
132+
"errors": []
133+
}
134+
```
135+
136+
## Current limitations
137+
138+
- No Schema validation when creating a new schema using `PutSchema`, and no Policy validation using said schema when creating policies and template policies.
139+
- Only Cognito is supported as an `IdentitySource`, external OIDC providers are not yet implemented.
140+
- The validation around Identity Sources and JWT is not fully yet implemented: the identity source is not validated to have a valid `jwks.json` endpoint, and the issuer, signature and expiration of the incoming JWT are not validated.

0 commit comments

Comments
 (0)