What is Attribute-Based Access Control (ABAC)?

Ensure that only users with the necessary attributes can access certain resources or perform specific actions.

What is ABAC?

Attribute-based access control (ABAC) is a flexible and comprehensive approach to access control that grants or denies access based on attributes of the user, the resource, the environment, and the action. Instead of just looking at roles, ABAC considers multiple factors, allowing for more granular and dynamic access control decisions.

ABAC in action with Cerbos



        
      
      
apiVersion: api.cerbos.dev/v1
resourcePolicy:
 version: default
  resource: abacExample
  rules:
    # If the principal's role is ADMIN then all the actions are allowed.
    - actions:
        - "*"
      effect: EFFECT_ALLOW
      roles:
        - ADMIN
    # If the principal's role is USER or MANAGER then creating is allowed.
    - actions:
        - create
      effect: EFFECT_ALLOW
      roles:
        - USER
        - MANAGER

    # If the principal's role is USER they read a resource as
    # long as it is published or owned by the user
    - actions:
        - read
      effect: EFFECT_ALLOW
      roles:
        - USER
      condition:
        match:
          any:
            of:
              - expr: request.resource.attr.isPublished == true
              - expr: request.resource.attr.ownerId == request.principal.id


    # If the principal's role is MANAGER then they can also update
    - actions:
        - update
      effect: EFFECT_ALLOW
      roles:
        - MANAGER

In this policy for a purchase order a user is granted permission to do defined actions based on their role and attributes. Admins can do all actions, users can create, and managers can also update a PO. Users can also read a purchase order if the isPublished attribute is TRUE or the ownerId attribute of the purchase order is equal to their userID.

Try out this pre-built policy in the Cerbos Playground