Hey new time user to Cerbos and having some trouble getting Cerbos Community #help

Hey, new-time user to Cerbos and having some troub...

Andrew Bettke

05/13/2025, 4:55 PM

Hey, new-time user to Cerbos and having some trouble getting some policy definitions in place. Could use some help on where I'm going wrong. I'm going to drop the details of what I'm trying to do and the troubles I'm seeing in the thread

Andrew Bettke

05/13/2025, 4:59 PM

I'm trying to institute a very simple

superadmin

role policy that defines that anyone who is a super admin should have global access to the system (ie, any resource + action combo is allowed if you have this role). This is how I've modeled the super admin role policy

Copy code

{
  "apiVersion": "api.cerbos.dev/v1",
  "rolePolicy": {
    "role": "superadmin",
    "rules": [
      {
        "resource": "*",
        "allowActions": [
          "*"
        ]
      }
    ]
  }
}

Then when trying to make a check request (see below) and passing in the role as

superadmin

the result always comes back as

EFFECT_DENY

. What would be the proper way to model this kind of situation?

Copy code

{
  "principal": {
    "id": "7700ebbc-05a2-4f64-acd7-e20f25aff527",
    "scope": "fcdc562c-546c-4cca-8fee-e557a642dc9d",
    },
    "roles": [
      "superadmin"
    ]
  },
  "resources": [
    {
      "actions": [
        "get"
      ],
      "resource": {
        "kind": "myresource",
        "id": "resourceId"
      }
    }
  ],
  "includeMeta": true
}

Sam Lock (Cerbos)

05/14/2025, 2:29 PM

So this is a little confusing (and I don't blame you for asking this question!), but, role policies only "narrow" permissions that are already defined in your system. The shortest path to getting the above issuing ALLOWS is by defining a resource policy that looks something like this:

Copy code

---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"
  resource: salary_record
  rules:
    - actions:
        - create
        - delete
      effect: EFFECT_ALLOW
      roles: ["admin"]

Then you'd need to add

parentRoles

to the role policy like this:

Copy code

---
apiVersion: "api.cerbos.dev/v1"
rolePolicy:
  role: superadmin
  parentRoles:
    - admin
  rules:
    - resource: "*"
      allowActions:
        - "*"

Andrew Bettke

05/14/2025, 2:51 PM

Ahh I see, I was able to get this working with a resource policy, but then in effect realized that the role policy here became redundant for me since I already know the 'superadmin' role at runtime (this is already determined in the IDP). Intead then, I'll just focus on resource polices and have separate rules for 'superadmins' vs. non superadmins

👍 1

Andrew Bettke

05/14/2025, 2:52 PM

thanks for the feedback!

🙌 1

Open in Slack

Previous Next