Targeting multiple resources with one policy about cerbos HOT 5 CLOSED

This has been asked for a couple of times. We don't support regexes for several reasons. Resource names are part of the policy identity and, from a usability perspective, regexes make it difficult for people to reason about policies because there's no longer a 1:1 mapping between resources. One of our goals is to make authorization logic human readable. Incomprehensible regexes defeat that purpose.

From a technical point of view, supporting this consistently and efficiently in the various storage backends we have is not easy. On some of them policy lookup could go from O(1) to O(n) + whatever the complexity of the regex is. We won't be able to use a compact index anymore so the memory and CPU use would go up quite a bit as well.

If you want to use the same policy for multiple resources, you could use scopes with lenient scope search to do that.

from cerbos.

No worries. This is a critical requirement for our use case to avoid duplicating policies many times, so I wanted to implement this myself in a fork.

What's the best way to do so? I've read through a lot of the Cerbos code so feel free to go into low level details.

My understanding is Cerbos has a internal hashmap: resource name -> policy. We'd no longer be able to look up the policy using this hash map. Instead, we'd need to:

1. take the resource name regex
2. find all keys in the hashmap matching that regex
3. evaluate all those policies.

Is this what you would suggest?

from cerbos.

Or, if I wanted to do it using scopes and lenient scope search, how would I do that? Sorry, not getting the suggested idea, any additional details would be good :)

from cerbos.

If you want to reuse a single policy for a bunch of resources, you can use scopes for that.

• Define your policy. Let's call it shared.
• When you make an API call to Cerbos, use the resource kind shared and set the scope to your actual resource kind.
• When lenient scope search is enabled, if there's no policy matching the requested scope, Cerbos will fall back to the parent policy (shared)
• If you want to override the policy rules for a particular resource, all you need to do is add a policy definition with its scope set to that resource kind.

from cerbos.

Ok, that makes sense -- thank you!

from cerbos.