# Verified Permissions

Source: /aws/services/verifiedpermissions/

## Introduction

Amazon Verified Permissions is a scalable service for managing fine-grained permissions and authorization in custom applications.  
It helps secure applications by moving authorization logic outside the app and managing policies in one place, using the [Cedar policy language](https://docs.cedarpolicy.com/) to define access rules.  
It checks if a principal can take an action on a resource in a specific context in your application.

LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito and support for custom OIDC identity providers. LocalStack uses the Cedar engine to evaluate permissions, ensuring authorization testing closely matches AWS Verified Permissions behavior.
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Verified Permissions' integration with LocalStack.

## Getting started

This guide is designed for users new to Verified Permissions and assumes basic knowledge of the AWS CLI and our [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws) command.

Start your LocalStack container using your preferred method.
We will demonstrate how to create a Verified Permissions Policy Store, add a policy to it, and authorize a request with the AWS CLI.

### Create a Policy Store

To create a Verified Permissions Policy Store, use the [`CreatePolicyStore`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicyStore.html) API.
Run the following command to create a Policy Store with Schema validation settings set to `OFF`:

```bash
lstk aws verifiedpermissions create-policy-store \
  --validation-settings mode=OFF \
  --description "A local Policy Store"
```

```bash title="Output"
{
    "policyStoreId": "q5PCScu9qo4aswMVc0owNN",
    "arn": "arn:aws:verifiedpermissions::000000000000:policy-store/q5PCScu9qo4aswMVc0owNN",
    "createdDate": "2025-04-22T19:24:11.175557Z",
    "lastUpdatedDate": "2025-04-22T19:24:11.175557Z"
}
```

You can list all the Verified Permissions policy stores using the [`ListPolicyStores`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicyStores.html) API.
Run the following command to list all the Verified Permissions policy stores:

```bash
lstk aws verifiedpermissions list-policy-stores
```

### Create a Policy

To create a Verified Permissions Policy, use the [`CreatePolicy`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicy.html) API.

Create a JSON file named `static_policy.json` with the following content:

```json showLineNumbers
{
    "static": {
        "description":  "Grant the User alice access to view the trip Album",
        "statement": "permit(principal == User::\"alice\", action == Action::\"view\", resource == Album::\"trip\");"
    }
}
```

You can then run this command to create the policy:

```bash
lstk aws verifiedpermissions create-policy \
    --definition file://static_policy.json \
    --policy-store-id q5PCScu9qo4aswMVc0owNN
```

Replace the policy store ID with the ID of the policy store you created previously.

You should see the following output:

```bash title="Output"
{
    "policyStoreId": "q5PCScu9qo4aswMVc0owNN",
    "policyId": "MfsIseJDeZsr5WUm3tB4FX",
    "policyType": "STATIC",
    "principal": {
        "entityType": "User",
        "entityId": "alice"
    },
    "resource": {
        "entityType": "Album",
        "entityId": "trip"
    },
    "actions": [
        {
            "actionType": "Action",
            "actionId": "view"
        }
    ],
    "createdDate": "2025-04-22T19:25:25.161652Z",
    "lastUpdatedDate": "2025-04-22T19:25:25.161652Z",
    "effect": "Permit"
}
```

### Authorize a request

We can now make use of the Policy Store and the Policy to start authorizing requests.
To authorize a request using Verified Permissions, use the [`IsAuthorized`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html) API.

```bash title="Output"
lstk aws verifiedpermissions is-authorized \
  --policy-store-id q5PCScu9qo4aswMVc0owNN \
  --principal entityType=User,entityId=alice \
  --action actionType=Action,actionId=view \
  --resource entityType=Album,entityId=trip
```

You should get the following output, indicating that your request was allowed:

```bash title="Output"
{
    "decision": "ALLOW",
    "determiningPolicies": [
        {
            "policyId": "MfsIseJDeZsr5WUm3tB4FX"
        }
    ],
    "errors": []
}
```

## Identity Sources

LocalStack supports both Cognito User Pools and custom OIDC (OpenID Connect) identity providers as identity sources for Verified Permissions.

When you create an identity source with an [`OpenIdConnectConfiguration`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html), LocalStack:
- Fetches the OIDC discovery document and JWKS (JSON Web Key Set) from the configured issuer
- Validates JWT signatures against the issuer's public keys
- Enforces token expiration (`exp` claim)
- Extracts principal information and group memberships from token claims

Once the identity source is configured, you can evaluate authorization requests using tokens from that provider with [`IsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) and [`BatchIsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html).

:::note
For local development scenarios where the OIDC issuer may not be reachable or uses a self-signed certificate, you can disable JWT signature verification by setting the `VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION=1` environment variable. See the [Configuration reference](/aws/customization/configuration-options/#verified-permissions) for details.
:::

## Current limitations

- No Schema validation when creating a new schema using `PutSchema`, and no Policy validation using said schema when creating policies and template policies.

## API Coverage


### verifiedpermissions API coverage

Source service: `verifiedpermissions`. 34 of 34 tracked operations are implemented.

Service documentation: /aws/services/verifiedpermissions/
License availability: available starting with the Ultimate plan. See /aws/licensing/ for current plan details.

| Operation | Status |
| --- | --- |
| BatchGetPolicy | Implemented |
| BatchIsAuthorized | Implemented |
| BatchIsAuthorizedWithToken | Implemented |
| CreateIdentitySource | Implemented |
| CreatePolicy | Implemented |
| CreatePolicyStore | Implemented |
| CreatePolicyStoreAlias | Implemented |
| CreatePolicyTemplate | Implemented |
| DeleteIdentitySource | Implemented |
| DeletePolicy | Implemented |
| DeletePolicyStore | Implemented |
| DeletePolicyStoreAlias | Implemented |
| DeletePolicyTemplate | Implemented |
| GetIdentitySource | Implemented |
| GetPolicy | Implemented |
| GetPolicyStore | Implemented |
| GetPolicyStoreAlias | Implemented |
| GetPolicyTemplate | Implemented |
| GetSchema | Implemented |
| IsAuthorized | Implemented |
| IsAuthorizedWithToken | Implemented |
| ListIdentitySources | Implemented |
| ListPolicies | Implemented |
| ListPolicyStoreAliases | Implemented |
| ListPolicyStores | Implemented |
| ListPolicyTemplates | Implemented |
| ListTagsForResource | Implemented |
| PutSchema | Implemented |
| TagResource | Implemented |
| UntagResource | Implemented |
| UpdateIdentitySource | Implemented |
| UpdatePolicy | Implemented |
| UpdatePolicyStore | Implemented |
| UpdatePolicyTemplate | Implemented |