Skip to content
Search

Cerbos

lastmod 2024-12-18created 2024-12-182 edits

A language-agnostic, scalable user permission management solution

About

  • A permission management layer that lets you define powerful, context-aware access control rules for application resources
  • Written as simple YAML policies, and can be managed and deployed through GitOps-based infrastructure
  • Self-host the Cerbos Policy Decision Point (PDP), and evaluate policies and make dynamic access decisions through a highly available API

Cerbos key features

  • Policy authoring and deployment:
    • Policies defined in YAML format
    • Policies stored on disk, in cloud object stores, Git repositories, or databases
  • Scalability and integration:
    • Can be deployed in various environments such as K8s services, sidecars, systemd services, and AWS Lambda
    • Easily integrates into serverless and edge deployments
  • Powerful policy management features:
    • Implements ABAC (Attribute-Based Access Control) beyond simple RBAC (Role-Based Access Control)
    • Fine-grained conditions can be evaluated using context data at runtime

Core concepts

  • Principal: the entity trying to perform an action (e.g. user, application, service)
  • Action: the operation the principal is trying to perform (e.g. create, read, update, delete, etc.)
  • Resource: the target whose access is controlled (e.g. reports, receipts, card information, etc.)
  • Policies: YAML files that define access rules for each resource
  • Cerbos PDP:
    • A Stateless service that executes policies and makes access decisions
    • Main APIs:
      • CheckResources: checks whether a given principal can access a resource
      • PlanResources: checks which resources a given principal can access
  • SDKs and adapters:
    • SDKs provided for various programming languages
    • Adapters provided to convert PlanResources responses into queries

Use cases

  • Extending RBAC -> ABAC:
    • Add dynamic roles through condition evaluation at runtime
    • Detailed policy overrides possible for specific users
  • Collaboration and policy deployment:
    • Author policies in collaboration with your team via Cerbos Hub
    • Efficiently deploy policy updates across the entire PDP fleet
  • Cloud and edge environment integration:
    • Well suited to cloud-based services and edge deployments

Usage 

docker run --rm --name cerbos -d -v $(pwd)/cerbos-quickstart/policies:/policies -p 3592:3592 -p 3593:3593  ghcr.io/cerbos/cerbos:0.40.0

See also

Favorite site

author Zer0 sitemap