class PolicyValidationMode

Language	Type name
.NET	Amazon.CDK.AWS.BedrockAgentCore.PolicyValidationMode
Go	github.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#PolicyValidationMode
Java	software.amazon.awscdk.services.bedrockagentcore.PolicyValidationMode
Python	aws_cdk.aws_bedrockagentcore.PolicyValidationMode
TypeScript (source)	aws-cdk-lib » aws_bedrockagentcore » PolicyValidationMode

Validation mode for Cedar policy definitions.

Example

declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };

Properties

Name	Type	Description
value	string	The string value of the validation mode.
static FAIL_ON_ANY_FINDINGS	PolicyValidationMode	Fail policy creation if any validation findings are detected.
static IGNORE_ALL_FINDINGS	PolicyValidationMode	Ignore all validation findings and create the policy anyway.

---

value

Type: string

The string value of the validation mode.

---

static FAIL_ON_ANY_FINDINGS

Type: PolicyValidationMode

Fail policy creation if any validation findings are detected.

This is the safer default - catches policy errors early.

---

static IGNORE_ALL_FINDINGS

Type: PolicyValidationMode

Ignore all validation findings and create the policy anyway.

Use with caution - may result in runtime authorization errors.

Methods

Name	Description
static of(value)	A validation mode that this version of the CDK does not model.

---

static of(value)

public static of(value: string): PolicyValidationMode

Parameters

• value string — the raw validation mode value to pass to CloudFormation.

Returns

• PolicyValidationMode

A validation mode that this version of the CDK does not model.

Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.