-
Notifications
You must be signed in to change notification settings - Fork 46
feat: create new cloud page #436
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| export default { | ||
| "picking-a-product": "Picking a Product", | ||
| cloud: "Getting Started with Authzed Cloud", | ||
| }; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| import { Callout } from "nextra/components"; | ||
| import YouTube from "react-youtube"; | ||
|
|
||
| # Getting Started with AuthZed Cloud | ||
|
|
||
| This page provides a guide on how to get up and running with a permission system in AuthZed Cloud. | ||
|
|
||
| If you prefer a guide in video format, watch this: | ||
|
|
||
| <YouTube videoId="O325tG4s66g" className="youtubeContainer" /> | ||
|
|
||
| ## Create a Permissions System on AuthZed Cloud | ||
|
|
||
| Sign in to [AuthZed Cloud](https://app.authzed.cloud) and click on the **+Create** button to create a Permissions System (PS) and fill in the necessary details: | ||
|
|
||
| - The type can be either "Production" or "Development". | ||
| - Give it a name. | ||
| - Choose the underlying datastore. | ||
| - The update channel can be either be `rapid` or `regular` which determines the behavior of automatic updates when new SpiceDB releases are made available: | ||
| - `rapid` gets the latest release immediately. | ||
| - `regular` is one release behind. | ||
| - Add SpiceDB deployments: | ||
| - Give them a name. | ||
| - Choose the region where the deployment will live. | ||
| - Choose the number of vCPUs for your deployment. The recommendation is to start with 2 vCPUs and then monitor the Metrics and change it based on your workload. | ||
| - Choose the number of replicas to deploy SpiceDB with primarily read workloads. The recommendation is 3 but will depend on your latency requirements. | ||
|
|
||
| ## Configuring Access | ||
|
|
||
| Before using the Permissions System, let's configure access to it. | ||
| This functionality enables organizations to apply the principle of least-privilege to services accessing SpiceDB. | ||
| For example, read-only tokens can be created for services that should never need to write to SpiceDB. | ||
| Read more about it [here](https://authzed.com/docs/authzed/concepts/restricted-api-access) | ||
|
|
||
| Let’s start by creating a **Service Account** which is something that represents your unique workload. | ||
| We recommend creating a Service Account for each application that will access the SpiceDB API. | ||
| Add a name such as `blog-app` and a description before hitting Save. | ||
|
|
||
| Now let’s create a **token**. | ||
| Tokens are long-lived credentials for Service Accounts. | ||
| SpiceDB clients must provide a Token in the Authorization header of an API request to perform actions granted to the Service Account. | ||
| Click on the `blog-app` service account you just created and then the Tokens item in the menu. | ||
| Create a token by providing a name and description. | ||
|
|
||
| Let’s now provide a **Role** and attach a **Policy** to that Role. | ||
| A Role defines rules for accessing the SpiceDB API. | ||
| Roles are bound to Service Accounts. | ||
| Click the Roles -> Create Role and provide a name and a description. | ||
| Add the following permissions for this demo: | ||
|
|
||
| ``` | ||
| ReadSchema | ||
| WriteSchema | ||
| DeleteRelationships | ||
| ReadRelationships | ||
| WriteRelationships | ||
| CheckPermission | ||
| ``` | ||
|
|
||
| Finally, let’s create a Policy. | ||
| Policies are what bind Roles to a Service Account. | ||
| Click on Policies -> Create policy. | ||
| Provide a name and a description and pick the Service Account and Role created in the steps above to bind the two. | ||
|
|
||
| You’re now ready to use your Permissions System! | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This gets a user to where they're able to make checks, but it seems like we should get them to where they're writing a schema, writing a relationship, and checking that relationship. Is there something to that effect that we can link to?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤔 the role above enables one to call both of those APIs