Performant, Fine Grained Authorization at scale powered by Amazon DynamoDB

This article discusses how Okta uses Amazon DynamoDB to build a highly scalable and performant Fine Grained Authorization (FGA) service for fine-grained access control at any scale. FGA is a multi-Region SaaS offering based on relationship-based access control (ReBAC) that allows apps to add flexible authorization policies.

Specifically, the article covers:

• An overview of Okta FGA and its requirements for high availability, scalability, multi-Region replication, low latency, and fully managed infrastructure
• The FGA architecture using Application Load Balancers, AWS Fargate, and DynamoDB global tables for active-active multi-Region deployment
• FGA query patterns and the DynamoDB single-table design to optimize for high throughput and low latency queries
• Benchmark results showing FGA's ability to serve over 1 million authorization requests per second with sub-20ms p95 latency
• Lessons learned around connection management, pre-warming tables, and accounting for GSI costs
• Conclusion highlighting DynamoDB's scalability, availability, and ease of use for the FGA use case