GatewayPolicyEngineConfig

class aws_cdk.aws_bedrockagentcore.GatewayPolicyEngineConfig(*, policy_engine, mode=None)

Bases: object

Configuration for associating a policy engine with a gateway.

When configured, the policy engine intercepts all agent requests through this gateway and evaluates them against the defined Cedar policies. [disable-awslint:prefer-ref-interface]

Parameters:

policy_engine (IPolicyEngine) – The policy engine to associate with this gateway. [disable-awslint:prefer-ref-interface]
mode (Optional[PolicyEngineMode]) – The enforcement mode for the policy engine. - ENFORCE: Actively allows or denies requests based on Cedar policy evaluation. - LOG_ONLY: Evaluates and logs decisions without enforcing them. Every tool call succeeds regardless of any forbid policy, so this is intended for testing a policy against real traffic and is not recommended for production. Default: PolicyEngineMode.ENFORCE

ExampleMetadata:

fixture=default infused

Example:

# Create a Policy engine
policy_engine = agentcore.PolicyEngine(self, "MyPolicyEngine",
    policy_engine_name="my_policy_engine",
    description="Policy engine for access control"
)

gateway = agentcore.Gateway(self, "MyGateway",
    gateway_name="my-gateway",
    policy_engine_configuration=agentcore.GatewayPolicyEngineConfig(
        policy_engine=policy_engine,
        mode=agentcore.PolicyEngineMode.ENFORCE
    )
)

# Add policy to policy engine
policy_engine.add_policy("AllowAllActions",
    statement=agentcore.PolicyStatement.from_cedar(f"""
            permit(
              principal,
              action,
              resource == AgentCore::Gateway::"{gateway.gatewayArn}"
            );
          """),
    description="Allow all actions on specific gateway (development)",
    validation_mode=agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS
)

# you can add multiple policies to the policy engine
policy_engine.add_policy("SpecificToolPolicy",
    statement=agentcore.PolicyStatement.from_cedar(f"""
            permit(
              principal is AgentCore::OAuthUser,
              action == AgentCore::Action::"WeatherTool__get_forecast",
              resource == AgentCore::Gateway::"{gateway.gatewayArn}"
            );
          """),
    description="Allow specific weather tool access",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

mode

The enforcement mode for the policy engine.

ENFORCE: Actively allows or denies requests based on Cedar policy evaluation.
LOG_ONLY: Evaluates and logs decisions without enforcing them. Every tool call succeeds regardless of any forbid policy, so this is intended for testing a policy against real traffic and is not recommended for production.

Default:: PolicyEngineMode.ENFORCE

policy_engine

The policy engine to associate with this gateway.

[disable-awslint:prefer-ref-interface]