Verified Permissions: CreatePolicy errors on static policies with a type constraint in the scope

[Plasmadog]

Summary

The LocalStack emulation of Verified Permissions fails in some cases that work correctly in the real AWS service. CreatePolicy fails with InternalError (KeyError: 'entity') for any static policy whose scope uses a type constraint (i.e. the is operator), such as principal is User or resource is Photo. The policies are valid Cedar and work in AWS. The failure doesn't depend on a schema or on validation mode: it happens whether or not a schema has been supplied. Policies with an unconstrained scope, or with == or in entity constraints, are created normally.

Environment

• localstack/localstack:2026.10.3 (authenticated image, LOCALSTACK_AUTH_TOKEN set)
• Started with docker run -e LOCALSTACK_AUTH_TOKEN=... -e SERVICES=verifiedpermissions -p 4566:4566 localstack/localstack:latest
• aws-cli 2.35.23

Reproduction

export AWS_ENDPOINT_URL=http://localhost:4566 AWS_ACCESS_KEY_ID=test \
       AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=us-east-1

ID=$(aws verifiedpermissions create-policy-store \
       --validation-settings mode=OFF \
       --query policyStoreId --output text)

Works: unscoped policy

aws verifiedpermissions create-policy --policy-store-id $ID \
  --definition '{"static":{"statement":"permit(principal, action, resource);"}}'

Fails: principal type constraint

aws verifiedpermissions create-policy --policy-store-id $ID \
  --definition '{"static":{"statement":"permit(principal is User, action, resource);"}}'

Fails: resource type constraint

aws verifiedpermissions create-policy --policy-store-id $ID \
  --definition '{"static":{"statement":"permit(principal, action, resource is Photo);"}}'

Fails: type constraint combined with in

aws verifiedpermissions create-policy --policy-store-id $ID \
  --definition '{"static":{"statement":"permit(principal is User in Group::\"g\", action, resource);"}}'

Expected: each call returns a policyId, as in AWS. These are valid Cedar scope forms.

Actual: the first call succeeds. The other three fail with HTTP 500:

An error occurred (InternalError) when calling the CreatePolicy operation:
exception while calling verifiedpermissions.CreatePolicy: 'entity'

Server log (with DEBUG=1), identical for all three failing calls:

localstack.request.aws : AWS verifiedpermissions.CreatePolicy => 500 (InternalError)
...
  File ".../localstack/pro/core/services/verifiedpermissions/provider.py.enc", line 225, in create_policy
    ... parse_cedar_policy_set(...); get_policy_scope_from_policy_set(F) ...
  File ".../localstack/pro/core/services/verifiedpermissions/provider.py.enc", line 577, in get_policy_scope_from_policy_set
KeyError: 'entity'

Fails: instantiation of a policy template that has a type constraint

CreatePolicyTemplate allows creation of a template that has a type constraint (no error), but CreateTemplate throws the same error as above when attempting to instantiate such a template.

Impact

We create policy stores in LocalStack and load the same static policies that we deploy to AWS. About a dozen of our policies use principal is or resource is, so we can't load them locally. Type constraints using the is operator are standard Cedar and have been supported in AVP since it was upgraded to use Cedar v4.

[bentsku]

Hello @Plasmadog and thanks for your report! We've pushed a fix and it should be available in our dev release, available at localstack/localstack:dev, you can pull it before and give it a try. The fix will then be available in our next November monthly release later.

Could you confirm it now works for you? Thank you!

[Plasmadog]

Yes, that does pass all my tests, thanks.

[bentsku]

Awesome, thanks for confirming!