Cerbos v0.33.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.33.0

Highlights

Producing user-defined output from policy evaluation is now more expressive and includes the option when.conditionNotMet to produce output when the condition of a rule is not satisfied as well. This simplifies crafting policies for certain scenarios where it’s useful to know that some criteria was not met. As a part of this update, the structure of the output block has changed to make it clearer and easier to understand. Old policies will continue to work but we recommend updating your policies to use the new output syntax as follows.

Old syntax New syntax
yaml<br>- actions: ['view']<br> effect: EFFECT_ALLOW<br> roles: ["user"]<br> condition:<br> match:<br> expr: request.resource.attr.public == true<br> output:<br> expr: ><br> "%s allowed to view".format([request.principal.id])<br>
yamlCopied!		 yaml<br>- actions: ['view']<br> effect: EFFECT_ALLOW<br> roles: ["user"]<br> condition:<br> match:<br> expr: request.resource.attr.public == true<br> output:<br> when:<br> ruleActivated: ><br> "%s allowed to view".format([request.principal.id])<br>
yamlCopied!

This release contains audit log improvements to provide more comprehensive visibility over policy revisions used for access decisions and ways to easily join application logs to Cerbos audit logs.

Audit log entries now contain store-specific metadata about the policies used to make the decision. For example, if the git store is used, the git commit hash of the policy used by the Cerbos engine is recorded in the audit log. This information can then be used to match access control decisions to the revision history of the policy repository during a security investigation.

The API response now includes the unique call ID generated by Cerbos to create the audit log entry for that request. Applications can record this ID in their own logs to enable cross-referencing Cerbos audit logs with application logs.

As announced earlier, this release removes the deprecated client package and drops support for configuring distributed traces using the tracing configuration block. The official Go SDK is available at https://github.com/cerbos/cerbos-sdk-go and is largely a drop-in replacement with a few package renames. For the new way of configuring traces, refer to the migration instructions.

Changelog

Bug Fixes

Features

Enhancements

Documentation

Chores