Convera's Fine-Grained API Authorization with Amazon Verified Permissions

Fine-Grained API Authorization with Amazon Verified Permissions

Convera, a cross-border payment processor, implemented Amazon Verified Permissions to build a fine-grained authorization model for their API platform, protecting sensitive financial data while maintaining operational efficiency. With Verified Permissions, Convera achieved a 60% reduction in access management tasks and handled thousands of authorization requests per second with submillisecond latency.

Why This Matters

The implementation of fine-grained authorization is crucial for companies like Convera, which process billions of dollars in transactions annually. Traditional access control models often fall short in providing the necessary granularity and scalability, leading to increased security risks and operational inefficiencies. By leveraging Amazon Verified Permissions, Convera was able to address these challenges and improve their overall security posture.

Key Insights

• Convera reduced access management tasks by 60% with Amazon Verified Permissions: This significant reduction in administrative burden allowed Convera to focus on core business priorities.
• Amazon Verified Permissions handled thousands of authorization requests per second with submillisecond latency: This high-performance capability ensured that Convera’s API platform remained responsive and efficient.
• Cedar policy language provided flexibility in defining complex authorization rules: The use of Cedar policies enabled Convera to create customized access control rules that aligned with their specific business requirements.

Working Example

# Example Cedar policy for fine-grained access control
policy = {
    "version": "2012-10-17",
    "statement": [
        {
            "effect": "allow",
            "action": "payment:modify",
            "resource": "arn:aws:payment:123456789012:payment/*",
            "condition": {
                "stringEquals": {
                    "payment:role": "admin"
                }
            }
        }
    ]
}

Practical Applications

• Use Case: Convera used Amazon Verified Permissions to implement fine-grained access control for their customers, internal customer connect applications, and machine-to-machine communication scenarios.
• Pitfall: Failing to implement fine-grained authorization can lead to over-privileged access, increasing the risk of security breaches and data exposure.

References:

• https://aws.amazon.com/blogs/architecture/how-convera-built-fine-grained-api-authorization-with-amazon-verified-permissions/
• https://docs.aws.amazon.com/verified-permissions/latest/userguide/introduction.html
• https://aws.amazon.com/blogs/security/how-to-implement-fine-grained-access-control-using-aws-verified-permissions/