[Verse 1]
Cedar's power has a narrow view
Authorization's all that it can do
No change management or training plans
Just who can access, where they can stand
While other controls need broader scope
Cedar leaves you walking on a rope
[Chorus]
Three weaknesses to keep in mind
Authorization scope confined
AWS dependency you'll find
No obligations it can bind
Cedar's limits by design
Know the gaps before you sign
[Verse 2]
Amazon's ecosystem holds the key
Verified Permissions, AWS dependency
Open source in name but tools are thin
Outside Amazon, you're struggling within
The community's smaller, support runs lean
When you're not living in Amazon's machine
[Chorus]
Three weaknesses to keep in mind
Authorization scope confined
AWS dependency you'll find
No obligations it can bind
Cedar's limits by design
Know the gaps before you sign
[Bridge]
Permit and forbid are all it knows
No require or obligate it shows
Can't express what must be done
Proactive duties, Cedar has none
Compliance frameworks need much more
Than access rules at the front door
[Verse 3]
Documentation lives inside the code
No audit trails from what you wrote
Like Rego hiding in the syntax deep
Policy papers that you'll need to keep
Manual translation, extra work
Where compliance auditors always lurk
[Chorus]
Three weaknesses to keep in mind
Authorization scope confined
AWS dependency you'll find
No obligations it can bind
Cedar's limits by design
Know the gaps before you sign
[Outro]
Cedar's strong but understand the cost
Know the battles that might be lost
Choose your tools with eyes wide open
Keep your management controls unbroken