enum PolicyEffect

Language	Type name
.NET	Amazon.CDK.AWS.BedrockAgentCore.PolicyEffect
Go	github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyEffect
Java	software.amazon.awscdk.services.bedrockagentcore.PolicyEffect
Python	aws_cdk.aws_bedrockagentcore.PolicyEffect
TypeScript (source)	aws-cdk-lib » aws_bedrockagentcore » PolicyEffect

Effect of a policy statement, whether it permits or forbids the action.

Example

declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };

Members

Name	Description
PERMIT	Permit the action when the statement matches and its conditions hold.
FORBID	Forbid the action when the statement matches and its conditions hold.

---

PERMIT

Permit the action when the statement matches and its conditions hold.

Multiple permit statements can apply, and any matching permit grants access.

---

FORBID

Forbid the action when the statement matches and its conditions hold.

A forbid always takes precedence over any permit.