Package software.amazon.awscdk.services.bedrockagentcore

Class PolicyCondition

java.lang.Object
software.amazon.jsii.JsiiObject
software.amazon.awscdk.services.bedrockagentcore.PolicyCondition
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-10T17:51:40.356Z") @Stability(Stable) public class PolicyCondition extends software.amazon.jsii.JsiiObject
A condition on a policy statement.

A condition compares a request attribute against a value. Conditions are grouped into the when and unless clauses of a statement, where the members of a clause must all hold.

Comparisons are named for the type of value they accept, so each one takes a concrete type rather than a union. Use allOf and anyOf to build a nested boolean expression, which also makes the grouping explicit in the generated Cedar.

Example: 

 import software.amazon.awscdk.services.bedrockagentcore.PolicyAttribute;
 import software.amazon.awscdk.services.bedrockagentcore.PolicyCondition;
 // principal.department == "Engineering"
 PolicyCondition.stringEquals(PolicyAttribute.principal("department"), "Engineering");
 // (principal.department == "Engineering" || principal.department == "Support")
 PolicyCondition.anyOf(List.of(PolicyCondition.stringEquals(PolicyAttribute.principal("department"), "Engineering"), PolicyCondition.stringEquals(PolicyAttribute.principal("department"), "Support")));

  • Constructor Details

    • PolicyCondition

      protected PolicyCondition(software.amazon.jsii.JsiiObjectRef objRef)

    • PolicyCondition

      protected PolicyCondition(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

  • Method Details

    • allOf

      @Stability(Stable) @NotNull public static PolicyCondition allOf(@NotNull List<? extends PolicyCondition> conditions)
      All of the given conditions must hold.

      Renders as a parenthesised && group, so it can be nested inside anyOf without relying on operator precedence.

      Parameters:
      conditions -
      • The conditions to combine, at least one.
      This parameter is required.

    • anyOf

      @Stability(Stable) @NotNull public static PolicyCondition anyOf(@NotNull List<? extends PolicyCondition> conditions)
      At least one of the given conditions must hold.

      Renders as a parenthesised || group, so it can be nested inside allOf or combined with the surrounding clause without relying on operator precedence.

      Parameters:
      conditions -
      • The conditions to combine, at least one.
      This parameter is required.

    • booleanEquals

      @Stability(Stable) @NotNull public static PolicyCondition booleanEquals(@NotNull PolicyAttribute attribute, @NotNull Boolean value)
      The attribute equals a boolean value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • ipInRange

      @Stability(Stable) @NotNull public static PolicyCondition ipInRange(@NotNull PolicyAttribute attribute, @NotNull String cidr)
      The attribute is an IP address inside the given CIDR range.

      Parameters:
      attribute -
      • The attribute holding an IP address.
      This parameter is required.
      cidr -
      • The range in CIDR notation, for example '192.168.1.0/24'.
      This parameter is required.

    • numberEquals

      @Stability(Stable) @NotNull public static PolicyCondition numberEquals(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute equals a number value.

      Cedar whole numbers are 64-bit signed integers, so the value must be an integer.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • numberGreaterThan

      @Stability(Stable) @NotNull public static PolicyCondition numberGreaterThan(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute is greater than a number value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • numberGreaterThanOrEquals

      @Stability(Stable) @NotNull public static PolicyCondition numberGreaterThanOrEquals(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute is greater than or equal to a number value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • numberIn

      @Stability(Stable) @NotNull public static PolicyCondition numberIn(@NotNull PolicyAttribute attribute, @NotNull List<? extends Number> values)
      The attribute is one of the given number values.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      values -
      • The allowed values, at least one.
      This parameter is required.

    • numberLessThan

      @Stability(Stable) @NotNull public static PolicyCondition numberLessThan(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute is less than a number value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • numberLessThanOrEquals

      @Stability(Stable) @NotNull public static PolicyCondition numberLessThanOrEquals(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute is less than or equal to a number value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • numberNotEquals

      @Stability(Stable) @NotNull public static PolicyCondition numberNotEquals(@NotNull PolicyAttribute attribute, @NotNull Number value)
      The attribute does not equal a number value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • setContains

      @Stability(Stable) @NotNull public static PolicyCondition setContains(@NotNull PolicyAttribute attribute, @NotNull String value)
      The attribute is a set that contains the given value.

      Use this when the attribute itself holds a set, for example principal.groups. To test a scalar attribute against a list of allowed values, use stringIn or numberIn instead.

      Parameters:
      attribute -
      • The attribute holding a set.
      This parameter is required.
      value -
      • The member to look for.
      This parameter is required.

    • stringEquals

      @Stability(Stable) @NotNull public static PolicyCondition stringEquals(@NotNull PolicyAttribute attribute, @NotNull String value)
      The attribute equals a string value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.

    • stringIn

      @Stability(Stable) @NotNull public static PolicyCondition stringIn(@NotNull PolicyAttribute attribute, @NotNull List<String> values)
      The attribute is one of the given string values.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      values -
      • The allowed values, at least one.
      This parameter is required.

    • stringNotEquals

      @Stability(Stable) @NotNull public static PolicyCondition stringNotEquals(@NotNull PolicyAttribute attribute, @NotNull String value)
      The attribute does not equal a string value.

      Parameters:
      attribute -
      • The attribute to compare.
      This parameter is required.
      value -
      • The value to compare against.
      This parameter is required.