5 ms·
Can you let me know how would you for example query all accessible resources for a user using Google's Zanzibar?
by eliocs 9mo ago
Can you let me know how would you for example query all accessible resources for a user using Google's Zanzibar?
- phrotoma 9mo agoRelated: if anyone has a method of achieving this query against GCP resources I'd be keen to learn that as well.
- jschorr 9mo agoWe actually have users that synchronize their resources from various sources (AWS, Kubernetes, etc) into SpiceDB, explicitly so they can perform these kinds of queries! One of the major benefits of a centralized authorization system is allowing for permissions queries across resources and subjects from multiple different services/sources (of course, with the need to synchronize the data in) Happy to expand on how some users do so, if you're curious.
- jschorr 9mo agoIn SpiceDB, this is known as the LookupResources [1] API, which returns all resources (of a particular type) that a particular subject (user in this case) has a particular permission on. We have a guide on doing ACL-aware filtering and listing [2] with this API and describing other approaches for larger Enterprise scales Disclaimer: I'm the co-founder and CTO of AuthZed, we develop SpiceDB, and I wrote our most recent implementation of LookupResources [1]: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupResources https://buf.build/authzed/api/docs/main:authzed.api.v1#authz... [2]: https://authzed.com/docs/spicedb/modeling/protecting-a-list-endpoint https://authzed.com/docs/spicedb/modeling/protecting-a-list-...