AWS Verified Permissions

Overview

Amazon Verified Permissions is AWS's managed authorization service for applications you build: you store policies written in the open-source Cedar language in a policy store, and your code calls an API that returns allow or deny. It launched in 2023 as an AWS service. It is a policy decision point (PDP), not an identity provider; per the AWS documentation, it "presumes that the principal has been previously identified and authenticated" by something else, such as Amazon Cognito or any OpenID Connect provider.

What it is good at

Cedar is the main reason to choose it. The language covers RBAC and ABAC in one syntax, uses explicit permit and forbid rules where forbid always wins, and is designed for automated analysis: the service validates policies against a schema and rejects ones that reference unknown attributes or can never match. Policy templates let you write one rule ("this user can edit this document") and instantiate it per resource, which covers most sharing features. Identity sources map Cognito user pool or OIDC tokens to Cedar principals, so IsAuthorizedWithToken can take a JWT directly. Each decision returns the IDs of the policies that determined it, which makes audits and debugging concrete. It integrates with Amazon API Gateway and Express.js, with SDKs, CloudFormation and a CDK construct.

Where it falls short

It is a remote API, so every decision costs a network round trip unless you cache results or embed the Cedar engine yourself. It stores policies, not your data: the caller must load and pass the principal, resource and related entities on each request, and a BatchIsAuthorized call is capped at 30 requests and 100 principals and resources, with either the principal or the resource fixed across the batch. That makes it a poor fit for "list everything this user can see" queries over large graphs, where Zanzibar-style ReBAC stores such as OpenFGA or AuthZed are built for the job. Policy tooling outside AWS (IDEs, testing frameworks, community libraries) is thinner than the Open Policy Agent ecosystem, and the managed service runs only in AWS.

Pricing

Published and usage-based. Since a 12 June 2025 price cut, single requests cost $5 per million. Batch calls cost $0.00015 each for the first 40 million a month, which equals 30 single requests, so batching saves latency rather than money until you pass that tier. Policy management calls are $0.00004 each (pricing page). That transparency is uncommon in authorization, as the Identity Pricing Transparency Index 2026 shows.

Best for, and who should look elsewhere

It suits AWS-hosted applications that authenticate with Cognito or an OIDC IdP and need fine-grained, auditable rules without running a PDP. A team that already has a clean resource model can wire it in within a sprint; modelling the Cedar schema is the real work, not the integration. Look elsewhere if you run multi-cloud or on-prem and want one engine everywhere (Cerbos), or if your model is mainly relationships. The authorization rankings and RBAC vs ABAC vs ReBAC cover the trade-offs.

Bottom line

The most direct path to externalized, policy-based authorization for applications already on AWS, and since mid-2025 one of the cheapest per decision. Choose it for attribute and role rules on AWS; choose a ReBAC store for permission graphs.