PolicyProps

class aws_cdk.aws_bedrockagentcore.PolicyProps(*, policy_engine, statement, description=None, policy_name=None, validation_mode=None)

Bases: object

Properties for creating a Policy resource.

Parameters:

  • policy_engine (IPolicyEngine) – The policy engine this policy belongs to. [disable-awslint:prefer-ref-interface]

  • statement (PolicyStatement) – The Cedar policy statement for this policy. Build a type-safe statement with the PolicyStatement factories, which validate at synthesis time and reject values that cannot be represented safely in Cedar. For raw Cedar (features this API does not model, or migrating an existing policy), use PolicyStatement.fromCedar('...'). That string is used exactly as given: the module does not escape, quote, or validate it, so it is treated as trusted input and you own its correctness and safety. Do not assemble it from values that come from outside your application, such as a request body or a database record.

  • description (Optional[str]) – Optional description for the policy. Maximum length of 4096. Default: - No description

  • policy_name (Optional[str]) – The name of the policy. Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Pattern: ^[A-Za-z][A-Za-z0-9_]*$ Default: - Auto-generated unique name

  • validation_mode (Optional[PolicyValidationMode]) – Validation mode for the policy. Controls how Cedar analyzer validation findings are handled. Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS

ExampleMetadata:

fixture=default infused

Example:

# policy_engine: agentcore.PolicyEngine


advanced_policy = agentcore.Policy(self, "AdvancedPolicy",
    policy_engine=policy_engine,
    statement=agentcore.PolicyStatement.from_cedar("permit(principal, action, resource) when { context.custom > 10 };"),
    description="Advanced policy with custom Cedar logic"
)

policy_engine.add_policy("CustomPolicy",
    statement=agentcore.PolicyStatement.from_cedar("forbid(principal, action, resource) when { resource.confidential == true };"),
    description="Custom policy from Cedar string"
)

Attributes

description

Optional description for the policy.

Maximum length of 4096.

Default:

  • No description

policy_engine

The policy engine this policy belongs to.

[disable-awslint:prefer-ref-interface]

policy_name

The name of the policy.

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Pattern: ^[A-Za-z][A-Za-z0-9_]*$

Default:

  • Auto-generated unique name

statement

The Cedar policy statement for this policy.

Build a type-safe statement with the PolicyStatement factories, which validate at synthesis time and reject values that cannot be represented safely in Cedar.

For raw Cedar (features this API does not model, or migrating an existing policy), use PolicyStatement.fromCedar('...'). That string is used exactly as given: the module does not escape, quote, or validate it, so it is treated as trusted input and you own its correctness and safety. Do not assemble it from values that come from outside your application, such as a request body or a database record.

validation_mode

Validation mode for the policy.

Controls how Cedar analyzer validation findings are handled.

Default:

PolicyValidationMode.FAIL_ON_ANY_FINDINGS