This article details how Convera implemented a fine-grained API authorization system using Amazon Verified Permissions for their global cross-border payments platform. It highlights the architecture, policy definition using Cedar language, and integration with AWS services like Cognito and API Gateway to enforce attribute-based and role-based access control for both customer-facing and internal applications, as well as service-to-service communication.
Read original on AWS Architecture BlogBuilding a robust, scalable, and auditable authorization system is a significant architectural challenge, especially for platforms handling sensitive data and diverse user roles like Convera's payment system. The core requirement is to ensure users (internal, external, and services) have access only to the precise resources and actions they are explicitly authorized for, adapting to evolving business needs and supporting multi-tenancy. Rather than building a complex in-house solution, Convera opted for Amazon Verified Permissions to offload policy management, real-time evaluation, logging, and auditing.
Amazon Verified Permissions (AVP) serves as a central authorization engine, integrating with other AWS services to provide a comprehensive access control solution. Key reasons for its adoption include direct integration with Amazon Cognito and Amazon API Gateway, the flexibility of the Cedar policy language for complex rules, the ability to evaluate multiple attributes (roles, transaction amounts, locations), and its high-performance characteristics for authorization decisions.
Caching for Performance and Cost Efficiency
Convera implemented a two-level caching system: API Gateway's built-in cache for authorization decisions and application-level caching for Amazon Cognito tokens. This strategy is crucial for achieving sub-millisecond response times, reducing operational costs, and maintaining security controls by minimizing redundant policy evaluations.
The flexibility of AVP and the Cedar policy language allowed Convera to reuse the same architectural pattern for multiple scenarios beyond simple user access. This includes managing complex multi-tenant access control with strict data isolation by dynamically evaluating tenant ownership and contextual attributes. The architecture was also extended to secure service-to-service communications, where client services are registered and use client credentials (instead of user credentials) with dedicated policy stores for their specific permissions.