Semantic-based Automated Reasoning for AWS Access Policies using SMT
Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Open Policy Agent github.com
🆓 An open-source general-purpose decision engine to create and enforce ABAC policies.
-
Topaz github.com
💸 An open-source project which combines the policy-as-code and decision logging of OPA with a Zanzibar-modeled directory.
-
Cerbos github.com
💸 An authorization endpoint to write context-aware access control policies.
-
Biscuit clever-cloud.com
Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like…
-
Identity and Access Management (IAM) aws.amazon.com
-
IAM is hard. It's really hard. web.archive.org
“Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to $80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.
IAM › Authorization > Policy models: “Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.”