class PolicyEngineMode

Language	Type name
.NET	Amazon.CDK.AWS.BedrockAgentCore.PolicyEngineMode
Go	github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyEngineMode
Java	software.amazon.awscdk.services.bedrockagentcore.PolicyEngineMode
Python	aws_cdk.aws_bedrockagentcore.PolicyEngineMode
TypeScript (source)	aws-cdk-lib » aws_bedrockagentcore » PolicyEngineMode

The enforcement mode for a policy engine associated with a gateway.

Example

// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
  policyEngineName: "my_policy_engine",
  description: "Policy engine for access control",
});

const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  policyEngineConfiguration: {
    policyEngine: policyEngine,
    mode: agentcore.PolicyEngineMode.ENFORCE, // This is the default
  },
});

// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal,
      action,
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow all actions on specific gateway (development)",
  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});

// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal is AgentCore::OAuthUser,
      action == AgentCore::Action::"WeatherTool__get_forecast",
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow specific weather tool access",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});

Properties

Name	Type	Description
value	string	The string value of the policy engine mode.
static ENFORCE	PolicyEngineMode	Enforces decisions by allowing or denying agent operations based on Cedar policies.
static LOG_ONLY	PolicyEngineMode	Evaluates actions and adds traces but does not enforce decisions.

---

value

Type: string

The string value of the policy engine mode.

---

static ENFORCE

Type: PolicyEngineMode

Enforces decisions by allowing or denying agent operations based on Cedar policies.

---

static LOG_ONLY

Type: PolicyEngineMode

Evaluates actions and adds traces but does not enforce decisions.

Use this mode for testing and validation before enabling enforcement.

Methods

Name	Description
static of(value)	A policy engine mode that this version of the CDK does not model.

---

static of(value)

public static of(value: string): PolicyEngineMode

Parameters

• value string — the raw mode value to pass to CloudFormation.

Returns

• PolicyEngineMode

A policy engine mode that this version of the CDK does not model.

Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.