AWS.VerifiedPermissions reference

GetPolicies

Source: packages/aws/src/VerifiedPermissions/GetPolicies.ts

Runtime binding for bulk policy retrieval — bind it to a PolicyStore inside a function runtime to fetch policy definitions (e.g. for admin / audit surfaces) without granting mutation rights.

GetPolicies: Reading Policies at Runtime

// init
const policies = yield* AWS.VerifiedPermissions.GetPolicies(store);

// runtime
const { results, errors } = yield* policies.batchGetPolicy({
  policyIds: ["9wYixMplbbZQb5fcZHyJhY"],
});

IdentitySource

Source: packages/aws/src/VerifiedPermissions/IdentitySource.ts

An identity source connects a Verified Permissions policy store to an identity provider — an Amazon Cognito user pool or any OpenID Connect (OIDC) IdP — so that IsAuthorizedWithToken and BatchIsAuthorizedWithToken can derive the principal directly from a JWT.

IdentitySource: Connecting an Identity Provider

Cognito User Pool

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.IdentitySource("Users", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  cognito: {
    userPoolArn: userPool.userPoolArn,
  },
});

OpenID Connect Provider

yield* AWS.VerifiedPermissions.IdentitySource("Oidc", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  openIdConnect: {
    issuer: "https://accounts.google.com",
    tokenSelection: {
      identityTokenOnly: { clientIds: ["my-oauth-client-id"] },
    },
  },
});

IdentitySource: Looking up an existing identity source

IdentitySource.lookup references an identity source Alchemy doesn’t manage (created in the console or by another stack), found by policyStoreId and identitySourceId. It is read during plan/deploy and never created, updated or deleted.

const cognito = AWS.VerifiedPermissions.IdentitySource.lookup({ policyStoreId, identitySourceId });

IsAuthorized

Source: packages/aws/src/VerifiedPermissions/IsAuthorized.ts

Runtime binding for Verified Permissions authorization — bind it to a PolicyStore inside a function runtime to get a client that evaluates authorization requests against the store’s Cedar policies.

This is the effectful-function DX for authorization: a Lambda calls isAuthorized(...) and Verified Permissions returns Allow or Deny along with the determining policies.

IsAuthorized: Authorizing Requests

Decide a Request in a Lambda

// init
const authz = yield* AWS.VerifiedPermissions.IsAuthorized(store);

// runtime
const { decision } = yield* authz.isAuthorized({
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});
// decision === "ALLOW" | "DENY"

Decide from a JWT

const { decision } = yield* authz.isAuthorizedWithToken({
  identityToken,
  action: { actionType: "PhotoApp::Action", actionId: "viewPhoto" },
  resource: { entityType: "PhotoApp::Photo", entityId: "vacation.jpg" },
});

Policy

Source: packages/aws/src/VerifiedPermissions/Policy.ts

A static Cedar policy in a Verified Permissions policy store. Static policies contain a complete Cedar statement and are evaluated for every matching authorization request.

Policy: Creating Policies

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.Policy("AllowAlice", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == PhotoApp::User::"alice",
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
  description: "Alice can view any photo",
});

Policy: Template-Linked Policies

const template = yield* AWS.VerifiedPermissions.PolicyTemplate("ViewPhoto", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == ?principal,
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
});

yield* AWS.VerifiedPermissions.Policy("AliceCanView", {
  policyStoreId: store.policyStoreId,
  templateId: template.policyTemplateId,
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
});

PolicyStore

Source: packages/aws/src/VerifiedPermissions/PolicyStore.ts

An Amazon Verified Permissions policy store — the container for Cedar policies, policy templates, and a schema. Authorization requests (IsAuthorized) are evaluated against all policies in a store.

PolicyStore: Creating a Policy Store

Basic Policy Store

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "OFF",
});

Strict Validation with a Schema

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "STRICT",
  description: "Photo app authorization",
});

yield* AWS.VerifiedPermissions.Schema("Schema", {
  policyStoreId: store.policyStoreId,
  cedarJson: JSON.stringify({
    PhotoApp: {
      entityTypes: { User: {}, Photo: {} },
      actions: { viewPhoto: { appliesTo: { principalTypes: ["User"], resourceTypes: ["Photo"] } } },
    },
  }),
});

PolicyStore: Looking up an existing policy store

PolicyStore.lookup references a policy store Alchemy doesn’t manage (created in the console or by another stack), found by policyStoreId. It is read during plan/deploy and never created, updated or deleted.

const existing = AWS.VerifiedPermissions.PolicyStore.lookup({ policyStoreId: "..." });

PolicyStoreAlias

Source: packages/aws/src/VerifiedPermissions/PolicyStoreAlias.ts

A named alias for a Verified Permissions policy store. Aliases let callers reference a policy store by a stable name (e.g. in IsAuthorized requests) so the underlying store can be swapped without reconfiguring clients. Alias names always carry the policy-store-alias/ prefix AWS requires; it is added automatically to generated and user-supplied names.

PolicyStoreAlias: Creating an Alias

Alias with a Generated Name

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

const alias = yield* AWS.VerifiedPermissions.PolicyStoreAlias("Alias", {
  policyStoreId: store.policyStoreId,
});

Named Alias with Hard Delete

yield* AWS.VerifiedPermissions.PolicyStoreAlias("Alias", {
  policyStoreId: store.policyStoreId,
  // created as "policy-store-alias/photo-app-prod"
  aliasName: "photo-app-prod",
  deletionMode: "HardDelete",
});

PolicyStoreAlias: Looking up an existing policy store alias

PolicyStoreAlias.lookup references a policy store alias Alchemy doesn’t manage (created in the console or by another stack), found by aliasName. It is read during plan/deploy and never created, updated or deleted.

const existing = AWS.VerifiedPermissions.PolicyStoreAlias.lookup({ aliasName: "my-policy-store-alias" });

PolicyTemplate

Source: packages/aws/src/VerifiedPermissions/PolicyTemplate.ts

A Cedar policy template in a Verified Permissions policy store. Templates contain ?principal / ?resource placeholders; template-linked policies instantiate the template for a concrete principal and resource, and every linked policy automatically picks up template updates.

PolicyTemplate: Creating Policy Templates

Template with a Principal Placeholder

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

const template = yield* AWS.VerifiedPermissions.PolicyTemplate("ViewPhoto", {
  policyStoreId: store.policyStoreId,
  statement: `permit(
    principal == ?principal,
    action == PhotoApp::Action::"viewPhoto",
    resource
  );`,
  description: "Grant a user access to view photos",
});

Link a Policy to the Template

yield* AWS.VerifiedPermissions.Policy("AliceCanView", {
  policyStoreId: store.policyStoreId,
  templateId: template.policyTemplateId,
  principal: { entityType: "PhotoApp::User", entityId: "alice" },
});

PolicyTemplate: Looking up an existing policy template

PolicyTemplate.lookup references a policy template Alchemy doesn’t manage (created in the console or by another stack), found by policyStoreId and policyTemplateId. It is read during plan/deploy and never created, updated or deleted.

const owner = AWS.VerifiedPermissions.PolicyTemplate.lookup({ policyStoreId, policyTemplateId });

Schema

Source: packages/aws/src/VerifiedPermissions/Schema.ts

The Cedar schema for a Verified Permissions policy store. The schema declares the entity types and actions your policies reference; with validationMode: "STRICT" on the store, policies and templates are validated against it at submission time.

A policy store has at most one schema — PutSchema is an upsert that fully replaces the previous schema.

Schema: Defining a Schema

import * as AWS from "@alchemy.run/aws";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {
  validationMode: "STRICT",
});

yield* AWS.VerifiedPermissions.Schema("Schema", {
  policyStoreId: store.policyStoreId,
  cedarJson: JSON.stringify({
    PhotoApp: {
      entityTypes: {
        User: {},
        Photo: {},
      },
      actions: {
        viewPhoto: {
          appliesTo: {
            principalTypes: ["User"],
            resourceTypes: ["Photo"],
          },
        },
      },
    },
  }),
});