Cedar, an open source authorization policy language and SDK, has joined the Cloud Native Computing Foundation (CNCF) as a Sandbox project. CNCF provides a neutral home for early stage and developing open source projects. Cedar fulfills the need for a fast, safe, and analyzable authorization policy language in cloud-native environments by allowing developers to define, externalize, and manage access control logic separately from application code.

The Authorization Challenge, Why Cedar?

As cloud native technology matures and enterprise adoption increases, authorization has become increasingly complex. More people and machines are performing more actions in production environments, using powerful software to manipulate dynamically changing resources. To achieve the kind of fine grained authorization required by modern enterprise workflows, services have previously relied on hard-coded logic or custom ad-hoc authorization systems. But hard-coded or ad-hoc authorization systems no longer meet the requirements of modern cloud native deployments.

Cedar’s commitment to technical rigor sets it apart in the authorization space. The language specification has been formally verified using the Lean theorem prover, and its Rust implementation undergoes differential random testing against the formal specification. This mathematical approach provides practical benefits for secure, maintainable authorization systems.

What is Cedar?

Cedar is a purpose-built authorization policy language that enables developers to express fine-grained permissions as policies, effectively decoupling access control from application logic. Cedar’s unique approach combines:

• Expressiveness: Support for common authorization models including Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Relationship-Based Access Control (ReBAC)
• Performance: Fast, scalable real-time evaluation with bounded latency
• Analyzability: Built for automated reasoning, enabling policy optimization and verification
• Safety: Formally verified using theorem provers (Lean) along with rigorous differential testing between the proven spec and the Rust code implementation

Customer Adoption

Cedar has demonstrated production-ready reliability across diverse environments. Current adopters and maintainers include Cloudflare, MongoDB, StrongDM, Cloudinary, and AWS services including Bedrock AgentCore Policy and AWS Systems Manager. The project is also gaining traction in the broader open source community, with integrations into Linux Foundation Janssen Project enterprise identity and access management infrastructure, along with Kubernetes landscape projects such as Kubernetes-Cedar-Authorizer (authored by Lucas Käldström).

As noted by Lucas Käldström (Emeritus @kubernetes SIG & WG co-chair and CNCF Ambassador), “What I appreciate the most about Cedar is the deep knowledge that is encoded into why it works the way it works… the careful balance between expressiveness and analyzability.”

Why CNCF?

AWS architected Cedar from the beginning with the vision of foundation stewardship. The move to CNCF addresses a need in the cloud native landscape by providing a neutral, foundation-backed alternative for authorization that complements existing CNCF projects. The foundation membership opens opportunities for expanded community participation for Cedar.

CNCF also provides Cedar with a vendor-neutral governance model, access to a broader contributor base, enhanced integration opportunities, and community-driven development input.

What’s Next?

The next step is to move Cedar from CNCF Sandbox status to Incubation and then Graduated, reflecting the maturity and production-readiness which Cedar has already demonstrated. For more on the CNCF lifecycle, see here. Cedar’s project governance is evolving, and you can expect to see more Cedar community meetings and presence at conferences, complementing the existing recurring Cedar maintainers meetings. Adoption of Cedar continues to grow, and we are excited to accelerate as part of CNCF.

Get Involved

Cedar’s acceptance into CNCF represents an invitation to the cloud native community to participate in shaping the future of authorization. The project welcomes contributions from developers implementing access control, security professionals interested in policy analysis, and platform engineers building self-service platforms.

Resources:

• Visit cedarpolicy.com to learn more
• Try the interactive policy playground
• Join the community on Slack
• Contribute on GitHub