POLICY LANGUAGE SECURITY COMPARISON

Summary from the TLDR InfoSec newsletter

AWS engaged Trail of Bits to evaluate three major authorization and access management policy languages: Cedar, Rego, and OpenFGA. Trail of Bits evaluated sixteen threat scenarios and grouped them by attack surface and mitigation similarity. Cedar's predictable evaluation model protects against DoS from users and the formalized semantics, testing, and typing system prevent language misuse and mis-evaluation, but data ingestion and engineering may cause complexities. Rego provides a flexible policy language which can make it easier to use but also may lead to language misuse, mis-evaluation, or performance considerations. OpenFGA provides a declarative language for mapping ReBAC constraints, which can simplify policy writing, but it relies on external attribute lists and can lead to unpredictable performance. The language also features mitigations for threats related to policy extension and replacement.