# PolicyDocument

A PolicyDocument is a collection of statements.

Extends: PolicyDocument
Implements: IResolvable

- Source: [`aws-iam/lib/policy-document.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/policy-document.ts#L50)
- Type last changed: v2.263.0 · 31 Jul 2026

## Example

```ts
import * as iam from 'aws-cdk-lib/aws-iam';

const myFileSystemPolicy = new iam.PolicyDocument({
  statements: [new iam.PolicyStatement({
    actions: [
      'elasticfilesystem:ClientWrite',
      'elasticfilesystem:ClientMount',
    ],
    principals: [new iam.AccountRootPrincipal()],
    resources: ['*'],
    conditions: {
      Bool: {
        'elasticfilesystem:AccessedViaMountTarget': 'true',
      },
    },
  })],
});

const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
  vpc: new ec2.Vpc(this, 'VPC'),
  fileSystemPolicy: myFileSystemPolicy,
});
```

## Initializer

```ts
new PolicyDocument(props?: PolicyDocumentProps)
```

## Properties

- `creationStack`: string[] — The creation stack of this resolvable which will be appended to errors thrown during resolution.

  This may return an array with a single informational element indicating how
  to get this property populated, if it was skipped for performance reasons.

- `isEmpty`: boolean — Whether the policy document contains any statements.

- `statementCount`: number — The number of statements already added to this policy.

  Can be used, for example, to generate unique "sid"s within the policy.

## Methods

- `addStatements(...statement: PolicyStatement[]): void` — Adds a statement to the policy document.

  **Parameters**

  - `statement` — the statement to add.

- `fromJson(obj: any): PolicyDocument // chainable` (static) — Creates a new PolicyDocument based on the object provided.

  This will accept an object created from the `.toJSON()` call

  **Parameters**

  - `obj` — the PolicyDocument in object form.

- `resolve(context: IResolveContext): any` — Produce the Token's value at resolution time.

- `toJSON(): any` — JSON-ify the document.

  Used when JSON.stringify() is called

- `toString(): string` — Encode the policy document as a string.

- `validateForAnyPolicy(): string[]` — Validate that all policy statements in the policy document satisfies the requirements for any policy.

  **Returns:** An array of validation error messages, or an empty array if the document is valid.

- `validateForIdentityPolicy(): string[]` — Validate that all policy statements in the policy document satisfies the requirements for an identity-based policy.

  **Returns:** An array of validation error messages, or an empty array if the document is valid.

- `validateForResourcePolicy(options?: ResourcePolicyValidationOptions): string[]` — Validate that all policy statements in the policy document satisfies the requirements for a resource-based policy.

  **Parameters**

  - `options` — Optional validation options.

  **Returns:** An array of validation error messages, or an empty array if the document is valid.

- `validateForTrustPolicy(): string[]` — Validate that all policy statements in the policy document satisfies the requirements for a trust policy (assume role policy).

  Trust policies are a special type of resource-based policy where the resource is implicit (the role itself).

  **Returns:** An array of validation error messages, or an empty array if the document is valid.