class PolicyStatement

Language	Type name
.NET	`Amazon.CDK.AWS.BedrockAgentCore.PolicyStatement`
Go	`github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyStatement`
Java	`software.amazon.awscdk.services.bedrockagentcore.PolicyStatement`
Python	`aws_cdk.aws_bedrockagentcore.PolicyStatement`
TypeScript (source)	`aws-cdk-lib` » `aws_bedrockagentcore` » `PolicyStatement`

A Cedar authorization policy statement.

A statement names the principal, action and resource it applies to, and optionally conditions that narrow it further. All three parts are required, so a statement is complete as soon as it is constructed.

Example

import { Policy, PolicyEngine, PolicyStatement } from 'aws-cdk-lib/aws-bedrockagentcore';
declare const engine: PolicyEngine;

// Example 4: raw Cedar, for features the API does not model
new Policy(this, 'CustomPolicy', {
  policyEngine: engine,
  statement: PolicyStatement.fromCedar('permit(principal, action, resource) when { context.custom > 10 };'),
});

Initializer

new PolicyStatement(props: PolicyStatementProps)

Parameters

props PolicyStatementProps

Methods

Name	Description
toCedar()	Generate the Cedar policy statement string.
static fromCedar(cedarStatement)	Create a statement from raw Cedar source.

toCedar()

public toCedar(): string

Returns

string

Generate the Cedar policy statement string.

This is called internally by the Policy construct.

static fromCedar(cedarStatement)

public static fromCedar(cedarStatement: string): PolicyStatement

Parameters

cedarStatement string — - Complete Cedar policy statement.

Returns

PolicyStatement

Create a statement from raw Cedar source.

Use this for Cedar features this API does not model, or to migrate an existing policy.

The source is used exactly as given. This method does not escape, quote, or validate it, so it is treated as trusted input and you own its correctness and its safety. Do not build the string by joining values that come from outside your application: a value containing a double quote can close a string literal early and add policy statements you did not write. Pass such values through PolicyCondition and the principal, action and resource factories instead, which reject that case at synthesis time. Service-side validation does not help, because an injected policy is still valid Cedar.

AWS CDK