# PolicyStatement Represents a statement in an IAM policy document. - Source: [`aws-iam/lib/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/policy-statement.ts#L59) - Type last changed: v2.263.0 · 31 Jul 2026 ## Example ```ts // Add gateway endpoints when creating the VPC const vpc = new ec2.Vpc(this, 'MyVpc', { gatewayEndpoints: { S3: { service: ec2.GatewayVpcEndpointAwsService.S3, }, }, }); // Alternatively gateway endpoints can be added on the VPC const dynamoDbEndpoint = vpc.addGatewayEndpoint('DynamoDbEndpoint', { service: ec2.GatewayVpcEndpointAwsService.DYNAMODB, }); // This allows to customize the endpoint policy dynamoDbEndpoint.addToPolicy( new iam.PolicyStatement({ // Restrict to listing and describing tables principals: [new iam.AnyPrincipal()], actions: ['dynamodb:DescribeTable', 'dynamodb:ListTables'], resources: ['*'], })); // Add an interface endpoint vpc.addInterfaceEndpoint('EcrDockerEndpoint', { service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER, // Uncomment the following to allow more fine-grained control over // who can access the endpoint via the '.connections' object. // open: false }); ``` ## Initializer ```ts new PolicyStatement(props?: PolicyStatementProps) ``` ## Properties - `actions`: string[] — The Actions added to this statement. - `conditions`: any — The conditions added to this statement. - `effect`: [Effect](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Effect.html) — Whether to allow or deny the actions in this statement Set effect for this statement. - `frozen`: boolean — Whether the PolicyStatement has been frozen. The statement object is frozen when `freeze()` is called. - `hasPrincipal`: boolean — Indicates if this permission has a "Principal" section. - `hasResource`: boolean — Indicates if this permission has at least one resource associated with it. - `notActions`: string[] — The NotActions added to this statement. - `notPrincipals`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html)[] — The NotPrincipals added to this statement. - `notResources`: string[] — The NotResources added to this statement. - `principals`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html)[] — The Principals added to this statement. - `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class. - `resources`: string[] — The Resources added to this statement. - `sid`: string — Statement ID for this statement Set Statement ID for this statement. ## Methods - `addAccountCondition(accountId: string): void` — Add a `StringEquals` condition that limits to a given account from `sts:ExternalId`. This method can only be called once: subsequent calls will overwrite earlier calls. - `addAccountRootPrincipal(): void` — Adds an AWS account root user principal to this policy statement. - `addActions(...actions: string[]): void` — Specify allowed actions into the "Action" section of the policy statement. **Parameters** - `actions` — actions that will be allowed. - `addAllResources(): void` — Adds a ``"*"`` resource to this statement. - `addAnyPrincipal(): void` — Adds all identities in all accounts ("*") to this policy statement. - `addArnPrincipal(arn: string): void` — Specify a principal using the ARN identifier of the principal. You cannot specify IAM groups and instance profiles as principals. **Parameters** - `arn` — ARN identifier of AWS account, IAM user, or IAM role (i.e. arn:aws:iam::123456789012:user/user-name). - `addAwsAccountPrincipal(accountId: string): void` — Specify AWS account ID as the principal entity to the "Principal" section of a policy statement. - `addCanonicalUserPrincipal(canonicalUserId: string): void` — Adds a canonical user ID principal to this policy document. **Parameters** - `canonicalUserId` — unique identifier assigned by AWS for every account. - `addCondition(key: string, value: any): void` — Add a condition to the Policy. If multiple calls are made to add a condition with the same operator and field, only the last one wins. For example: ```ts declare const stmt: iam.PolicyStatement; stmt.addCondition('StringEquals', { 'aws:SomeField': '1' }); stmt.addCondition('StringEquals', { 'aws:SomeField': '2' }); ``` Will end up with the single condition `StringEquals: { 'aws:SomeField': '2' }`. If you meant to add a condition to say that the field can be *either* `1` or `2`, write this: ```ts declare const stmt: iam.PolicyStatement; stmt.addCondition('StringEquals', { 'aws:SomeField': ['1', '2'] }); ``` - `addConditions(conditions: { [key: string]: any }): void` — Add multiple conditions to the Policy. See the `addCondition` function for a caveat on calling this method multiple times. - `addFederatedPrincipal(federated: any, conditions: { [key: string]: any }): void` — Adds a federated identity provider such as Amazon Cognito to this policy statement. **Parameters** - `federated` — federated identity provider (i.e. 'cognito-identity.amazonaws.com'). - `conditions` — The conditions under which the policy is in effect. - `addNotActions(...notActions: string[]): void` — Explicitly allow all actions except the specified list of actions into the "NotAction" section of the policy document. **Parameters** - `notActions` — actions that will be denied. - `addNotPrincipals(...notPrincipals: IPrincipal[]): void` — Specify principals that is not allowed or denied access to the "NotPrincipal" section of a policy statement. **Parameters** - `notPrincipals` — IAM principals that will be denied access. - `addNotResources(...arns: string[]): void` — Specify resources that this policy statement will not apply to in the "NotResource" section of this policy statement. All resources except the specified list will be matched. **Parameters** - `arns` — Amazon Resource Names (ARNs) of the resources that this policy statement does not apply to. - `addPrincipals(...principals: IPrincipal[]): void` — Adds principals to the "Principal" section of a policy statement. **Parameters** - `principals` — IAM principals that will be added. - `addResources(...arns: string[]): void` — Specify resources that this policy statement applies into the "Resource" section of this policy statement. **Parameters** - `arns` — Amazon Resource Names (ARNs) of the resources that this policy statement applies to. - `addServicePrincipal(service: string, opts?: ServicePrincipalOpts): void` — Adds a service principal to this policy statement. **Parameters** - `service` — the service name for which a service principal is requested (e.g: `s3.amazonaws.com`). - `opts` — options for adding the service principal (such as specifying a principal in a different region). - `addSourceAccountCondition(accountId: string): void` — Add an `StringEquals` condition that limits to a given account from `aws:SourceAccount`. This method can only be called once: subsequent calls will overwrite earlier calls. - `addSourceArnCondition(arn: string): void` — Add an `ArnEquals` condition that limits to a given resource arn from `aws:SourceArn`. This method can only be called once: subsequent calls will overwrite earlier calls. - `copy(overrides?: PolicyStatementProps): PolicyStatement // chainable` — Create a new `PolicyStatement` with the same exact properties as this one, except for the overrides. - `freeze(): PolicyStatement // chainable` — Make the PolicyStatement immutable. After calling this, any of the `addXxx()` methods will throw an exception. Libraries that lazily generate statement bodies can override this method to fill the actual PolicyStatement fields. Be aware that this method may be called multiple times. - `fromJson(obj: any): PolicyStatement // chainable` (static) — Creates a new PolicyStatement based on the object provided. This will accept an object created from the `.toJSON()` call **Parameters** - `obj` — the PolicyStatement in object form. - `toJSON(): any` — JSON-ify the statement. Used when JSON.stringify() is called - `toStatementJson(): any` — JSON-ify the policy statement. Used when JSON.stringify() is called - `toString(): string` — String representation of this policy statement. - `validateForAnyPolicy(): string[]` — Validate that the policy statement satisfies base requirements for a policy. **Returns:** An array of validation error messages, or an empty array if the statement is valid. - `validateForIdentityPolicy(): string[]` — Validate that the policy statement satisfies all requirements for an identity-based policy. **Returns:** An array of validation error messages, or an empty array if the statement is valid. - `validateForResourcePolicy(options?: ResourcePolicyValidationOptions): string[]` — Validate that the policy statement satisfies all requirements for a resource-based policy. **Parameters** - `options` — Optional validation options. **Returns:** An array of validation error messages, or an empty array if the statement is valid. - `validateForTrustPolicy(): string[]` — Validate that the policy statement satisfies all requirements for a trust policy (assume role policy). Trust policies are a special type of resource-based policy where the resource is implicit (the role itself). **Returns:** An array of validation error messages, or an empty array if the statement is valid.