I detailed a comparison of OPA and Cedar with verified permissions here: https:/...

AgentOrange1234 · 2024-03-12T23:03:10.000000Z

Seems pretty damning. Why would someone choose Cedar? Is there some upside that isn’t captured here?

sarahcec · 2024-03-13T16:04:44.000000Z

The benefit of Cedar mainly comes down to the language. Cedar was designed to sit in the middle of a runtime call, so it has reliably low latency (see comparison here: https://twitter.com/Sarah_Cecc/status/1766141060370329748) even at high scale. It's way more readable so it's easier to author and debug. And it's validated against formal methods proofs so certain properties of the language (like default deny) are mathematically proven. More about the benefits of Cedar here: https://cedarland.blog/design/why-cedar/content.html

i_play_stax · 2024-03-13T09:07:05.000000Z

https://docs.opal.ac/

Universally, people I've met and worked with (20-30) hate writing rego (OPA).

I'm always skeptical of Styra's analysis; they are literally selling you something.

AuthZed looks interesting and they have good "ride along" videos in YouTube, e.g. replicating GitHub auth.

https://authzed.com/

jasonjayr · 2024-03-12T23:27:05.000000Z

AWS uses it and the policy language is similar, and if you are all in on AWS, then it makes sense to keep it for consistency?

max2 · 2024-03-14T02:53:13.000000Z

There is actually pretty vibrant and diverse Cedar community. Check out their slack.