2.269.0

interface PolicyProps

LanguageType name
.NETAmazon.CDK.AWS.BedrockAgentCore.PolicyProps
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyProps
Javasoftware.amazon.awscdk.services.bedrockagentcore.PolicyProps
Pythonaws_cdk.aws_bedrockagentcore.PolicyProps
TypeScript (source)aws-cdk-lib » aws_bedrockagentcore » PolicyProps

Properties for creating a Policy resource.

Example

declare const policyEngine: agentcore.PolicyEngine;

const advancedPolicy = new agentcore.Policy(this, "AdvancedPolicy", {
  policyEngine: policyEngine,
  statement: agentcore.PolicyStatement.fromCedar(
    'permit(principal, action, resource) when { context.custom > 10 };'
  ),
  description: "Advanced policy with custom Cedar logic",
});

policyEngine.addPolicy("CustomPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(
    'forbid(principal, action, resource) when { resource.confidential == true };'
  ),
  description: "Custom policy from Cedar string",
});

Properties

NameTypeDescription
policyEngineIPolicyEngineThe policy engine this policy belongs to.
statementPolicyStatementThe Cedar policy statement for this policy.
description?stringOptional description for the policy.
policyName?stringThe name of the policy.
validationMode?PolicyValidationModeValidation mode for the policy.

policyEngine

Type: IPolicyEngine

The policy engine this policy belongs to.

[disable-awslint:prefer-ref-interface]

statement

Type: PolicyStatement

The Cedar policy statement for this policy.

Build a type-safe statement with the PolicyStatement factories, which validate at synthesis time and reject values that cannot be represented safely in Cedar.

For raw Cedar (features this API does not model, or migrating an existing policy), use PolicyStatement.fromCedar('...'). That string is used exactly as given: the module does not escape, quote, or validate it, so it is treated as trusted input and you own its correctness and safety. Do not assemble it from values that come from outside your application, such as a request body or a database record.

description?

Type: string (optional, default: No description)

Optional description for the policy.

Maximum length of 4096.

policyName?

Type: string (optional, default: Auto-generated unique name)

The name of the policy.

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Pattern: ^[A-Za-z][A-Za-z0-9_]*$

validationMode?

Type: PolicyValidationMode (optional, default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS)

Validation mode for the policy.

Controls how Cedar analyzer validation findings are handled.

← PreviousNext →