interface PolicyStatementProps

Language	Type name
.NET	Amazon.CDK.AWS.BedrockAgentCore.PolicyStatementProps
Go	github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyStatementProps
Java	software.amazon.awscdk.services.bedrockagentcore.PolicyStatementProps
Python	aws_cdk.aws_bedrockagentcore.PolicyStatementProps
TypeScript (source)	aws-cdk-lib » aws_bedrockagentcore » PolicyStatementProps

Properties for a policy statement.

Example

declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };

Properties

Name	Type	Description
action	PolicyAction	The action the statement applies to.
effect	PolicyEffect	Whether the statement permits or forbids the action.
principal	PolicyPrincipal	The principal the statement applies to.
resource	PolicyResource	The resource the statement applies to.
unless?	PolicyCondition[]	Conditions that must not hold for the statement to apply.
when?	PolicyCondition[]	Conditions that must all hold for the statement to apply.

---

action

Type: PolicyAction

The action the statement applies to.

---

effect

Type: PolicyEffect

Whether the statement permits or forbids the action.

---

principal

Type: PolicyPrincipal

The principal the statement applies to.

---

resource

Type: PolicyResource

The resource the statement applies to.

---

unless?

Type: PolicyCondition[] (optional, default: no exclusions)

Conditions that must not hold for the statement to apply.

---

when?

Type: PolicyCondition[] (optional, default: the statement applies whenever its principal, action and resource match)

Conditions that must all hold for the statement to apply.

Use PolicyCondition.anyOf() for a member that only needs one of several conditions to hold.