[アップデート] Amazon Verified PermissionsのExpress.js統合ライブラリがリリース！ #AWSreInforce

// 従来の埋め込み型認可
app.post('/pets', (req, res) => {
  // 認可ロジックがアプリケーションコードに埋め込まれている
  if (req.user.role === 'employee' || req.user.role === 'admin') {
    // ペットを作成する処理
  } else {
    res.status(403).send('Forbidden');
  }
});

// Cedarポリシーの例
permit (
  principal,
  action in [Action::"POST /pets"], 
  resource
) when {
  principal.jobLevel = "employee"
};

git clone https://github.com/verifiedpermissions/examples.git
cd examples/express-petstore

cd start

./scripts/setup-infrastructure.sh

Admin****
Employee****
Customer****

🚀 Cedar-Cognito Pet Store Infrastructure Setup
==============================================

ℹ️  Checking environment...
✅ Environment check passed.
ℹ️  Checking AWS CLI configuration...
✅ AWS CLI is properly configured.
ℹ️  Creating Cognito User Pool: PetStoreUserPool...
✅ Created User Pool: ap-northeast-1_XXXXXXXXX
✅ Created App Client: XXXXXXXXXXXXXXXXXXXXXXXXXX
ℹ️  Creating user group: administrator...
✅ Created group: administrator
ℹ️  Creating user group: employee...
✅ Created group: employee
ℹ️  Creating user group: customer...
✅ Created group: customer
✅ Cognito User Pool setup completed.
ℹ️  Creating test users...
Enter password for admin@example.com: 
Enter password for employee@example.com: 
Enter password for customer@example.com: 
ℹ️  Creating user: admin@example.com in group administrator...
✅ Created user: admin@example.com with permanent password
✅ Added user admin@example.com to group administrator
ℹ️  Creating user: employee@example.com in group employee...
✅ Created user: employee@example.com with permanent password
✅ Added user employee@example.com to group employee
ℹ️  Creating user: customer@example.com in group customer...
✅ Created user: customer@example.com with permanent password
✅ Added user customer@example.com to group customer
✅ Test users created successfully.
ℹ️  Creating DynamoDB table: Pets...
✅ Created DynamoDB table: Pets
ℹ️  Seeding initial data...
✅ Seeded initial data into DynamoDB table.
ℹ️  Updating configuration files...
⚠️  Frontend environment file not found at ./frontend/.env.development. Creating new file...
✅ Frontend environment file created.
✅ All configuration files updated.

✅ Infrastructure setup completed successfully!

📋 Resource Summary:
  Region: ap-northeast-1
  Cognito User Pool ID: ap-northeast-1_XXXXXXXXX
  Cognito App Client ID: XXXXXXXXXXXXXXXXXXXXXXXXXX
  Cognito User Pool ARN: arn:aws:cognito-idp:ap-northeast-1:XXXXXXXXXXXX:userpool/ap-northeast-1_XXXXXXXXX
  DynamoDB Table: Pets

📝 Test Users:
  Admin: admin@example.com
  Employee: employee@example.com
  Customer: customer@example.com

🚀 Next Steps:
  1. Start the backend: ./run-backend-dev.sh
  2. Start the frontend: ./run-frontend-dev.sh
  3. Access the application at http://localhost:3001

# ターミナル1：バックエンドの起動
./scripts/run-backend-dev.sh

# ターミナル2：フロントエンドの起動
./scripts/run-frontend-dev.sh

cd backend

aws verifiedpermissions create-policy-store --validation-settings "mode=STRICT"

{
    "policyStoreId": "XXXXXXXXXXXXXXXXXX",
    "arn": "arn:aws:verifiedpermissions::XXXXXXXXXXXX:policy-store/XXXXXXXXXXXXXXXXXX",
    "createdDate": "2025-06-05T19:30:37.896119+00:00",
    "lastUpdatedDate": "2025-06-05T19:30:37.896119+00:00"
}

npm i --save @verifiedpermissions/authorization-clients-js
npm i --save @cedar-policy/authorization-for-expressjs

npx @cedar-policy/cedar-authorization generate-schema --api-spec schemas/openapi.json --namespace PetStoreApp --mapping-type SimpleRest

"servers": [
  {
    "url": "http://localhost:3000/api", 
    "description": "API base path"
  }
]

"paths": {
  "/pets": {
    "get": {
      "summary": "List all pets",
      // ...
    }
  },
  "/pets/{id}": {
    "get": {
      "summary": "Get a pet by ID",
      // ...
    }
  }
}

Cedar schema successfully generated. Your schema files are named: v2.cedarschema.json, v4.cedarschema.json.
v2.cedarschema.json is compatible with Cedar 2.x and 3.x
v4.cedarschema.json is compatible with Cedar 4.x and required by the nodejs Cedar plugins.

../scripts/prepare-cedar-schema.sh v2.cedarschema.json v2.cedarschema.forAVP.json

aws verifiedpermissions put-schema \
  --definition file://v2.cedarschema.forAVP.json \
  --policy-store-id <policy-store-id>

{
    "policyStoreId": "XXXXXXXXXXXXXXXXXX",
    "namespaces": [
        "PetStoreApp"
    ],
    "createdDate": "2025-06-18T05:51:16.484394+00:00",
    "lastUpdatedDate": "2025-06-18T05:51:16.484394+00:00"
}

npx @cedar-policy/cedar-authorization generate-policies --schema v2.cedarschema.json

# fix_schema.py
import json

def remove_required_fields(obj):
    if isinstance(obj, dict):
        if 'required' in obj:
            del obj['required']
        for key, value in obj.items():
            remove_required_fields(value)
    elif isinstance(obj, list):
        for item in obj:
            remove_required_fields(item)
    return obj

# v2とv4の両方のスキーマファイルを修正
for filename in ['v2.cedarschema.json', 'v4.cedarschema.json']:
    with open(filename, 'r') as f:
        schema = json.load(f)
    remove_required_fields(schema)
    with open(filename, 'w') as f:
        json.dump(schema, f, indent=2)
    print(f"Fixed {filename}")

python3 fix_schema.py

npx @cedar-policy/cedar-authorization generate-policies --schema v2.cedarschema.json

// Defines permitted administrator user group actions
permit (
    principal in PetStoreApp::UserGroup::"<user-pool-id>|administrator",
    action,
    resource
);

// Defines permitted employee user group actions
permit (
    principal in PetStoreApp::UserGroup::"<user-pool-id>|employee",
    action in
        [PetStoreApp::Action::"GET /pets",
         PetStoreApp::Action::"POST /pets",
         PetStoreApp::Action::"GET /pets/{petId}",
         PetStoreApp::Action::"PUT /pets/{petId}"],
    resource
);

// Defines permitted customer user group actions
permit (
    principal in PetStoreApp::UserGroup::"<user-pool-id>|customer",
    action in
        [PetStoreApp::Action::"GET /pets",
         PetStoreApp::Action::"POST /pets",
         PetStoreApp::Action::"GET /pets/{petId}"],
    resource
);

../scripts/convert_cedar_policies.sh

aws verifiedpermissions create-policy --definition file://policies/json/policy_1.json --policy-store-id <policy-store-id>
aws verifiedpermissions create-policy --definition file://policies/json/policy_2.json --policy-store-id <policy-store-id>
aws verifiedpermissions create-policy --definition file://policies/json/policy_3.json --policy-store-id <policy-store-id>

{
    "cognitoUserPoolConfiguration": {
        "userPoolArn": "<user-pool-arn>",
        "clientIds":["<client-id>"] ,
        "groupConfiguration": {
              "groupEntityType": "PetStoreApp::UserGroup"
        }
    }
}

aws verifiedpermissions create-identity-source \
  --configuration file://identity-source-configuration.txt \
  --policy-store-id <policy-store-id> \
  --principal-entity-type PetStoreApp::User

{
    "createdDate": "2025-06-18T06:06:58.773069+00:00",
    "identitySourceId": "XXXXXXXXXXXXXXXXXX",
    "lastUpdatedDate": "2025-06-18T06:06:58.773069+00:00",
    "policyStoreId": "XXXXXXXXXXXXXXXXXX"
}

const fs = require('fs');
const path = require('path');
const { ExpressAuthorizationMiddleware } = require('@cedar-policy/authorization-for-expressjs');
const { AVPAuthorizationEngine } = require('@verifiedpermissions/authorization-clients-js');

const avpAuthorizationEngine = new AVPAuthorizationEngine({
    policyStoreId: '<policy-store-id>', // ここを実際のpolicyStoreIdに置き換え
    callType: 'identityToken'
});

const expressAuthorization = new ExpressAuthorizationMiddleware({
    schema: {
        type: 'jsonString',
        schema: fs.readFileSync(path.join(__dirname, '../v4.cedarschema.json'), 'utf8'),
    },
    authorizationEngine: avpAuthorizationEngine,
    principalConfiguration: { type: 'identityToken' },
    skippedEndpoints: [],
    logger: {
        debug: (s: any) => console.log(s),
        log: (s: any) => console.log(s),
    }
});

app.use(expressAuthorization.middleware);

# backendディレクトリから移動
cd ..

# ターミナル1：バックエンドの起動
./scripts/run-backend-dev.sh

# ターミナル2：フロントエンドの起動  
./scripts/run-frontend-dev.sh

Authorization result: {"type":"deny"}