OPA vs Cedar (Amazon Verified Permissions)
Charlie Egan
Rego, the policy language used by Open Policy Agent (OPA) and Cedar, a policy language developed by AWS, are two different policy as code languages capable of building externalized authorization. However, the languages are best compared in the context in which they are typically used. Policy code needs to be authored, packaged, distributed, evaluated, enforced and audited too – functions which cannot be provided by a language in isolation.
OPA is a general-purpose policy engine. It supports a range of policy as code use cases, including authorization, with the Rego language. OPA is an open source project created and maintained by Styra and is hosted by the Cloud Native Computing Foundation.
Enterprise OPA Platform builds on the capabilities of OPA, offering a comprehensive authorization platform. The platform provides compliance, governance, no-code policy, and lifecycle management capabilities to scale policy as code authorization in complex, enterprise domains.
Cedar is an open source policy language for authorization policy. While it can describe authorization policies, being only a language, it is not a standalone solution. For policy to be enforced, Cedar code needs to be evaluated within a policy engine or product.
Amazon Verified Permissions is a managed service offered by AWS that leverages the Cedar language to enforce authorization policy. This service simplifies policy evaluation and enforcement within the AWS ecosystem where users call AWS endpoints rather than running a policy engine themselves.
Key Differences:
- Availability: Amazon Verified Permissions is exclusive to AWS customers. In contrast, OPA and the Enterprise OPA Platform can be deployed on any public or private cloud, offering greater flexibility.
- Use Cases: OPA is a general-purpose policy engine suitable for various use cases, while Cedar is only suitable for authorization policy. The Enterprise OPA Platform provides an extended set of tools and features built around OPA for enterprise needs.
See also OPA vs Cedar (Cedar Agent and OPAL)
| Enterprise OPA Platform | Open Source OPA | Cedar (with Amazon Verified Permissions) |
|
|---|---|---|---|
Use Cases |
|||
| Application Authorization | |||
| Run as a sidecar | ✅ | ✅ | ❌ |
| Run as a centralized service | ✅ | ✅ | ✅ |
| Run as a daemon on the same host | ✅ | ✅ | ❌ |
| Custom Integration via REST | ✅ | ✅ | ✅ |
| Custom Embedded Integration | ✅ | ✅ | ❌ |
| Istio / Envoy Proxy | ✅ | ✅ | ❌ |
| Kong Gateway & Mesh | ✅ | ✅ | ❌ |
| Gloo Gateway | ✅ | ✅ | ❌ |
| Emissary | ✅ | ✅ | ❌ |
| AWS API Gateway | ✅ | ✅ | ✅ |
| Arbitrary JSON in/out | ✅ | ✅ | ❌ |
| Other Authorization | |||
| Kubernetes Admission | ✅ | 🟡Via OPA Gatekeeper or kube-mgmt | ❌ |
| Terraform | ✅ | 🟡 Via conftest | ❌ |
| Kafka Topics | ✅ | ✅ | ❌ |
| Cloud Formation | ✅ | ✅ | ❌ |
| Docker | ✅ | ✅ | ❌ |
| SSH | ✅ | ✅ | ❌ |
| Arbitrary JSON in/out | ✅ | ✅ | ❌ |
| Runtime Data Sources | |||
| SQL | ✅ | ❌ | ❌ |
| HTTP | ✅ | ✅ | ❌ |
| MongoDB | ✅ | ❌ | ❌ |
| Neo4j | ✅ | ❌ | ❌ |
| Kafka | ✅ | ❌ | ❌ |
| S3 | ✅ | ❌ | ❌ |
| Git | ✅ | ❌ | ❌ |
| Identity Data Sources | |||
| Okta | ✅ | ❌ | ❌ |
| LDAP | ✅ | ❌ | ❌ |
| AWS Cognito | ❌ | ❌ | ✅ |
| Language SDK Availability | |||
| Java | ✅ | Community REST Client | Via AWS SDK |
| C# | ✅ | Community REST Client | Via AWS SDK |
| Typescript | ✅ | Community REST Client | Via AWS SDK |
| Python | Community REST Client | Community REST Client | Via AWS SDK |
| Go | ✅ | ✅ | Via AWS SDK |
| Node.js | ✅ | Community REST Client | Via AWS SDK |
| PHP | Community REST Client | Community REST Client | Via AWS SDK |
| Web Assembly | 🟡 Agent Support Only | ✅ | ❌ |
Policy Lifecycle |
|||
| ‘Policy as Code’ | |||
| Versioned Policy Distribution | ✅ via management APIs | ✅ via management APIs | ✅ via AWS CLI |
| Git / GitOps Updates | ✅ | ❌ | ❌ |
| Policy Testing | |||
| Policy Testing (CLI) | ✅ | ✅ | ❌ |
| Policy Testing (UI) | ✅ | ❌ | ✅ |
| Historic Impact Analysis | ✅ | ❌ | ❌ |
| Live Impact Analysis | ✅ | ❌ | ❌ |
| Policy Authoring | |||
| Editor Extensions | ✅ | ✅ | ✅ |
| CLI REPL | ✅ | ✅ | ❌ |
| Web IDE | ✅ | ❌ | ✅ |
| Learning Resources | |||
| Online Playground | ✅ | ✅ | ✅ |
| Linter | ✅ | ✅ | ❌ |
| Free Online Courses | ✅ | ✅ | ❌ Not Available |
Audit Functionality |
|||
| Logging of Policy Version | ✅ | ✅ | ❌ |
| Log Sinks | |||
| Console (stdout) Log Sink | ✅ | ✅ | ✅ via AWS CLI |
| HTTP Log Sink | ✅ | ✅ | ❌ |
| Splunk Log Sink | ✅ | ❌ | ❌ |
| Kafka Log Sink | ✅ | ❌ | ❌ |
| S3 Log Sink | ✅ | ❌ | ❌ |
| Cloudwatch Log Sink | ❌ | ❌ | ✅ |
Language Functionality |
|||
| General Functionality | |||
| Logic Operations | ✅ | ✅ | ✅ |
| Built-in Type Comparisons | ✅ | ✅ | ✅ |
| Arithmetic Operations | ✅ | ✅ | 🟡 +, -, * only |
| Regex | ✅ | ✅ | ❌ |
| String Operations | ✅ | ✅ | 🟡 LIKE with Wildcard Only |
| HTTP Request Support | ✅ | ✅ | ❌ |
| base64 Enc/Dec | ✅ | ✅ | ❌ |
| Authz-specific Functionality | |||
| CIDR Range Testing | ✅ | ✅ | 🟡 In Range Testing only |
| IP Address Validation | 🟡 User Defined | 🟡 User Defined | ✅ |
| JWT Parsing and Verification | ✅ | ✅ | ❌ |
| X509 Certificate & Key Pair Parsing and Verification | ✅ | ✅ | ❌ |
| UUID Functionality | ✅ | ✅ | ❌ |
