Cloud PDP doesn't support ABAC (cloud_pdp_not_supporting_abac)
A decision with the code cloud_pdp_not_supporting_abac means your app sent the permission check to the Cloud PDP, and the environment has attribute-based access control (ABAC) user sets or resource sets. The Cloud PDP doesn't evaluate ABAC policies. This page is for developers who find this code in a decision log and need to move ABAC checks to a container PDP.
What the cloud_pdp_not_supporting_abac reason means
The policy decision point (PDP) writes this code in the ABAC part of the decision log's debug details (debug.abac). The debug details appear when Debug Mode is on.
| Field | Value |
|---|---|
code | cloud_pdp_not_supporting_abac |
reason | The Cloud PDP does not support ABAC policies at the moment, run the PDP container to enforce access with ABAC |
support_link | A link to /errors/cloud_pdp_not_supporting_abac on docs.permit.io |
The PDP reports this code when both conditions are true:
- The check reached the Cloud PDP at
https://cloudpdp.api.permit.io. - The environment has at least one user set or resource set.
The Cloud PDP still evaluates role-based access control (RBAC) and relationship-based access control (ReBAC) rules, so the debug.rbac details of the same decision can show an RBAC result. ABAC rules don't grant anything on the Cloud PDP.
Causes of cloud_pdp_not_supporting_abac
| Cause | How to confirm | Fix |
|---|---|---|
The SDK's pdp option is https://cloudpdp.api.permit.io, and the policy uses ABAC. | The ABAC Rules tab of the Policy screen lists user sets or resource sets. | Send checks to a container PDP. |
| The environment has user sets or resource sets that your app doesn't use. | The user sets or resource sets grant no permissions in the Policy Editor. | Delete the unused user sets and resource sets, or send checks to a container PDP. |
Send checks to a container PDP
- Run the PDP container with your environment API key. See Run the PDP. To start the container from the Permit CLI, use
permit pdp run. - Set the SDK's
pdpoption to the container's address, for examplehttp://localhost:7766. - Deploy the container next to your services for production traffic. See Deploy to production.
For the full list of features that need a container PDP, see Cloud PDP capabilities.
Confirm the fix
- Run the same
permit.check()call again. To send a check to the container from a terminal, usepermit pdp checkwith--pdpurl http://localhost:7766. - Open the Audit Log and select the new decision.
The debug.abac.code is no longer cloud_pdp_not_supporting_abac. If the ABAC check still denies the request, the code names the next cause, for example no_matching_usersets.