interface AddPolicyOptions

Language	Type name
.NET	Amazon.CDK.AWS.BedrockAgentCore.AddPolicyOptions
Go	github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#AddPolicyOptions
Java	software.amazon.awscdk.services.bedrockagentcore.AddPolicyOptions
Python	aws_cdk.aws_bedrockagentcore.AddPolicyOptions
TypeScript (source)	aws-cdk-lib » aws_bedrockagentcore » AddPolicyOptions

Options for adding a policy via PolicyEngine.addPolicy().

Example

declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.anyOf([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ]),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
  }),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );

Properties

Name	Type	Description
statement	PolicyStatement	The Cedar policy statement for this policy.
description?	string	Optional description for the policy (max 4,096 characters).
policyName?	string	The name of the policy.
validationMode?	PolicyValidationMode	Validation mode for the policy.

---

statement

Type: PolicyStatement

The Cedar policy statement for this policy.

Build a type-safe statement with the PolicyStatement factories, or use PolicyStatement.fromCedar('...') for raw Cedar. Raw Cedar is treated as trusted input: the module does not escape, quote, or validate it.

---

description?

Type: string (optional, default: No description)

Optional description for the policy (max 4,096 characters).

---

policyName?

Type: string (optional, default: Auto-generated unique name)

The name of the policy.

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters

---

validationMode?

Type: PolicyValidationMode (optional, default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS)

Validation mode for the policy.