Cerbos v0.41.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.41.0

Highlights

Since the last release, a lot of behind-the-scenes work has gone into revamping the Cerbos engine to better support scope permissions and role policies. Scope permissions allow users to change how scoped policies are evaluated by Cerbos. The default behaviour of scoped policies for a given action is to stop at the first policy in the scope chain that produces a decision. However, if the scopePermissions field of a scoped resource or principal policy is set to SCOPE_PERMISSIONS_REQUIRE_PARENTAL_CONSENT_FOR_ALLOWS, any ALLOW decision produced by that policy requires another ALLOW decision from a policy higher up in the scope chain. Effectively, scope permissions is a way to restrict child scopes from being more permissive than their parents.

Role policies supplement resource policies by allowing policy authors to further narrow the set of permissions for a given role. Any action not explicitly allowed by a role policy is immediately denied. Any allowed actions must still be allowed by the relevant resource policies as well. Role policies are activated based on the set of roles sent as principal.roles in the Cerbos CheckResources request and can be used to implement custom roles within applications.

Time-based functions used in condition expressions such as getHours and getMinutes default to UTC unless the time zone is explicitly provided as an argument to the function. Before upgrading, it’s recommended to review your policies to make sure that time calculations use the correct time zone. Refer to timestamps documentation to identify the affected functions.

Query planner now correctly handles expressions that refer to the principal or resource scope.

Policy tests are now stricter and will fail if a test defines an output expectation for an action that doesn’t exist in the input actions list.

Cerbos now correctly detects the number of available CPUs in Amazon ECS deployments. This should help reduce CPU throttling of the Cerbos process and make it more responsive.

Changelog

Bug fixes

Features

Enhancements

Documentation

Chores