All Services

Security & IAM

Amazon Verified Permissions

Amazon Verified Permissions is a managed fine-grained application-authorization service that evaluates Cedar policies over principals, actions, resources, and context in an application policy store.

Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon Verified Permissions.

Amazon Verified Permissions pricing and cost programs

Pricing model: Authorization request and policy usage

On-Demand
Available
Reserved Instances or reserved capacity
Not applicable
Savings Plans
Not applicable
Spot
Not applicable

Billing dimensions: Authorization requests · Policy-management requests · Batch requests

Programs and modes: IsAuthorized · BatchIsAuthorized · Policy store operations

Authorization and policy-management requests use separate metering.

Free Tier: Service-specific — verify current offers

Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.

Official AWS pricing

Official AWS sources reviewed 2026-07-21.

Why implement Amazon Verified Permissions?

  • Separates application authorization rules from business code so policies can be reviewed, tested, and changed consistently.
  • Uses the Cedar policy language and automated reasoning to support role-, attribute-, relationship-, and context-aware access decisions.
  • Provides managed policy stores, templates, schema validation, token-aware APIs, and batch authorization operations without operating a policy engine.

How to implement Amazon Verified Permissions

  1. Map every protected application operation to a clear principal, action, resource, context, ownership boundary, and default-deny behavior before writing policies.
  2. Create a separate policy store per application or intentional isolation boundary, define a production schema, turn validation on for test and production, and use templates for repeatable delegated policies.
  3. Authenticate users separately, construct complete entity data or supported tokens, call authorization at every enforcement point, fail closed on errors, and test cross-tenant, confused-deputy, stale-membership, and privilege-escalation cases.

Amazon Verified Permissions best practices

  • Keep authentication and authorization distinct, make the application enforce every decision, and never let client-supplied identity, group, ownership, or context claims bypass validation.
  • Use a schema for production, leave validation enabled, prefer default deny and least privilege, isolate tenants where required, and review Cedar 4 compatibility and policy-store changes.
  • Test policies as code with allow and deny matrices, log request identifiers and decisions without sensitive context, monitor latency and failures, and deploy policy changes with rollback.

Amazon Verified Permissions use cases and server impact

  • Multi-tenant SaaS authorization
  • Fine-grained API permissions
  • Centralized role, attribute, and relationship policies

Replaces a self-hosted policy-decision service, while authentication, entity truth, enforcement points, policy design, tests, caching safety, and availability behavior remain customer responsibilities.

Official implementation resources

Commonly paired AWS services