2.269.0

class PolicyCondition

LanguageType name
.NETAmazon.CDK.AWS.BedrockAgentCore.PolicyCondition
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyCondition
Javasoftware.amazon.awscdk.services.bedrockagentcore.PolicyCondition
Pythonaws_cdk.aws_bedrockagentcore.PolicyCondition
TypeScript (source)aws-cdk-lib » aws_bedrockagentcore » PolicyCondition

A condition on a policy statement.

A condition compares a request attribute against a value. Conditions are grouped into the when and unless clauses of a statement, where the members of a clause must all hold.

Comparisons are named for the type of value they accept, so each one takes a concrete type rather than a union. Use allOf and anyOf to build a nested boolean expression, which also makes the grouping explicit in the generated Cedar.

Example

import { PolicyAttribute, PolicyCondition } from 'aws-cdk-lib/aws-bedrockagentcore';

// principal.department == "Engineering"
PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Engineering');

// (principal.department == "Engineering" || principal.department == "Support")
PolicyCondition.anyOf([
  PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Engineering'),
  PolicyCondition.stringEquals(PolicyAttribute.principal('department'), 'Support'),
]);

Methods

NameDescription
static allOf(conditions)All of the given conditions must hold.
static anyOf(conditions)At least one of the given conditions must hold.
static booleanEquals(attribute, value)The attribute equals a boolean value.
static ipInRange(attribute, cidr)The attribute is an IP address inside the given CIDR range.
static numberEquals(attribute, value)The attribute equals a number value.
static numberGreaterThan(attribute, value)The attribute is greater than a number value.
static numberGreaterThanOrEquals(attribute, value)The attribute is greater than or equal to a number value.
static numberIn(attribute, values)The attribute is one of the given number values.
static numberLessThan(attribute, value)The attribute is less than a number value.
static numberLessThanOrEquals(attribute, value)The attribute is less than or equal to a number value.
static numberNotEquals(attribute, value)The attribute does not equal a number value.
static setContains(attribute, value)The attribute is a set that contains the given value.
static stringEquals(attribute, value)The attribute equals a string value.
static stringIn(attribute, values)The attribute is one of the given string values.
static stringNotEquals(attribute, value)The attribute does not equal a string value.

static allOf(conditions)

public static allOf(conditions: PolicyCondition[]): PolicyCondition

Parameters

  • conditions PolicyCondition[] — - The conditions to combine, at least one.

Returns

All of the given conditions must hold.

Renders as a parenthesised && group, so it can be nested inside anyOf without relying on operator precedence.

static anyOf(conditions)

public static anyOf(conditions: PolicyCondition[]): PolicyCondition

Parameters

  • conditions PolicyCondition[] — - The conditions to combine, at least one.

Returns

At least one of the given conditions must hold.

Renders as a parenthesised || group, so it can be nested inside allOf or combined with the surrounding clause without relying on operator precedence.

static booleanEquals(attribute, value)

public static booleanEquals(attribute: PolicyAttribute, value: boolean): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value boolean — - The value to compare against.

Returns

The attribute equals a boolean value.

static ipInRange(attribute, cidr)

public static ipInRange(attribute: PolicyAttribute, cidr: string): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute holding an IP address.
  • cidr string — - The range in CIDR notation, for example '192.168.1.0/24'.

Returns

The attribute is an IP address inside the given CIDR range.

static numberEquals(attribute, value)

public static numberEquals(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute equals a number value.

Cedar whole numbers are 64-bit signed integers, so the value must be an integer.

static numberGreaterThan(attribute, value)

public static numberGreaterThan(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute is greater than a number value.

static numberGreaterThanOrEquals(attribute, value)

public static numberGreaterThanOrEquals(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute is greater than or equal to a number value.

static numberIn(attribute, values)

public static numberIn(attribute: PolicyAttribute, values: number[]): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • values number[] — - The allowed values, at least one.

Returns

The attribute is one of the given number values.

static numberLessThan(attribute, value)

public static numberLessThan(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute is less than a number value.

static numberLessThanOrEquals(attribute, value)

public static numberLessThanOrEquals(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute is less than or equal to a number value.

static numberNotEquals(attribute, value)

public static numberNotEquals(attribute: PolicyAttribute, value: number): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value number — - The value to compare against.

Returns

The attribute does not equal a number value.

static setContains(attribute, value)

public static setContains(attribute: PolicyAttribute, value: string): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute holding a set.
  • value string — - The member to look for.

Returns

The attribute is a set that contains the given value.

Use this when the attribute itself holds a set, for example principal.groups. To test a scalar attribute against a list of allowed values, use stringIn or numberIn instead.

static stringEquals(attribute, value)

public static stringEquals(attribute: PolicyAttribute, value: string): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value string — - The value to compare against.

Returns

The attribute equals a string value.

static stringIn(attribute, values)

public static stringIn(attribute: PolicyAttribute, values: string[]): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • values string[] — - The allowed values, at least one.

Returns

The attribute is one of the given string values.

static stringNotEquals(attribute, value)

public static stringNotEquals(attribute: PolicyAttribute, value: string): PolicyCondition

Parameters

  • attribute PolicyAttribute — - The attribute to compare.
  • value string — - The value to compare against.

Returns

The attribute does not equal a string value.

← PreviousNext →