PolicyEffect

class aws_cdk.aws_bedrockagentcore.PolicyEffect(*values)

Bases: Enum

Effect of a policy statement, whether it permits or forbids the action.

ExampleMetadata:

fixture=default infused

Example:

# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow access unless the user is suspended
policy_with_unless = agentcore.Policy(self, "UnlessPolicy",
    policy_engine=policy_engine,
    policy_name="unless_suspended",
    statement=agentcore.PolicyStatement(
        effect=agentcore.PolicyEffect.PERMIT,
        principal=agentcore.PolicyPrincipal.entity_type("AgentCore::OAuthUser"),
        action=agentcore.PolicyAction.any(),
        resource=agentcore.PolicyResource.instance("AgentCore::Gateway", gateway.gateway_arn),
        unless=[
            agentcore.PolicyCondition.boolean_equals(
                agentcore.PolicyAttribute.principal("suspended"), True)
        ]
    ),
    description="Allow all actions unless user is suspended",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

FORBID

Forbid the action when the statement matches and its conditions hold.

A forbid always takes precedence over any permit.

PERMIT

Permit the action when the statement matches and its conditions hold.

Multiple permit statements can apply, and any matching permit grants access.