Cedar policy

Attachment	Type URL (`@type`)	Per-route override	Build feature
HTTP filter chain (`http_filters`)	`type.googleapis.com/arion.extensions.filters.http.cedar.cedar_policy.v3.CedarPolicy`	`disabled` only	None

What it does

The Cedar filter is an Arion extension that evaluates every request against a Cedar policy set embedded in the configuration. Each request becomes an authorization query — principal, action, resource, context — and a deny answers 403 before the router runs. It gives you expression-level authorization (claim comparisons, path conditions) where header-matching RBAC is not enough.

Request mapping

Principal — <principal_entity_type>::"<sub>" from the JWT claims that JWT authentication attached earlier in the chain; without claims it is <principal_entity_type>::"anonymous".
Action — Action::"<HTTP method>", for example Action::"GET".
Resource — <resource_entity_type>::"<path>", for example HttpPath::"/health".
Context — a record with http (method, path, and query when present) and, when authenticated, jwt holding the token's claims (sub, iss, aud, exp, iat, nbf, jti and any extra claims).

Minimal configuration

From arion-runtime-cedar.yaml; the fragment is an entry in http_filters, before the router:

- name: cedar
  typed_config:
    "@type": type.googleapis.com/arion.extensions.filters.http.cedar.cedar_policy.v3.CedarPolicy
    schema: |
      entity User;
      entity HttpPath;
      action "GET" appliesTo {
        principal: [User],
        resource:  [HttpPath],
        context: { http: { method: String, path: String, query?: String } }
      };
    policies: |
      permit (
        principal == User::"anonymous",
        action    == Action::"GET",
        resource  == HttpPath::"/health"
      );

Fields

Field	Type	Required	Default	Description
`policies`	string	Yes	—	Cedar policy text. Anything not permitted is implicitly denied.
`schema`	string	Yes	—	Cedar schema declaring entity types, actions and the context shape.
`entities`	string	No	empty	Entity data as Cedar JSON, for policies over entity attributes or hierarchies.
`enforcement_mode`	enum	No	`ENFORCE`	`ENFORCE` denies with `403`; `LOG_ONLY` logs the denial and continues.
`failure_mode`	enum	No	`FAIL_CLOSED`	On an evaluation error, `FAIL_CLOSED` answers `403`; `FAIL_OPEN` continues.
`principal_entity_type`	string	No	`User`	Entity type used for the principal.
`resource_entity_type`	string	No	`HttpPath`	Entity type used for the resource.
`validate_schema_per_request`	bool	No	`false`	Validate the built request against the schema on every evaluation.

Ordering and interactions

Place Cedar after JWT authentication so the jwt context and the sub-based principal exist; before it, every caller is anonymous. Denials short-circuit the chain, and enforcement_mode: LOG_ONLY is the safe way to stage a new policy set against live traffic before enforcing it. Per route the filter supports only the generic FilterConfig override with disabled: true.

What it does

Request mapping

Minimal configuration

Fields

Ordering and interactions

Reference and guides