PolicyStatement

class aws_cdk.aws_bedrockagentcore.PolicyStatement(*, action, effect, principal, resource, unless=None, when=None)

Bases: object

A Cedar authorization policy statement.

A statement names the principal, action and resource it applies to, and optionally conditions that narrow it further. All three parts are required, so a statement is complete as soon as it is constructed.

Example:

from aws_cdk.aws_bedrockagentcore import Policy, PolicyEngine, PolicyStatement
# engine: PolicyEngine


# Example 4: raw Cedar, for features the API does not model
Policy(self, "CustomPolicy",
    policy_engine=engine,
    statement=PolicyStatement.from_cedar("permit(principal, action, resource) when { context.custom > 10 };")
)
Parameters:

  • action (PolicyAction) – The action the statement applies to.

  • effect (PolicyEffect) – Whether the statement permits or forbids the action.

  • principal (PolicyPrincipal) – The principal the statement applies to.

  • resource (PolicyResource) – The resource the statement applies to.

  • unless (Optional[Sequence[PolicyCondition]]) – Conditions that must not hold for the statement to apply. Default: - no exclusions

  • when (Optional[Sequence[PolicyCondition]]) – Conditions that must all hold for the statement to apply. Use PolicyCondition.anyOf() for a member that only needs one of several conditions to hold. Default: - the statement applies whenever its principal, action and resource match

Methods

to_cedar()

Generate the Cedar policy statement string.

This is called internally by the Policy construct.

Return type:

str

Returns:

Valid Cedar policy statement

Static Methods

classmethod from_cedar(cedar_statement)

Create a statement from raw Cedar source.

Use this for Cedar features this API does not model, or to migrate an existing policy.

The source is used exactly as given. This method does not escape, quote, or validate it, so it is treated as trusted input and you own its correctness and its safety. Do not build the string by joining values that come from outside your application: a value containing a double quote can close a string literal early and add policy statements you did not write. Pass such values through PolicyCondition and the principal, action and resource factories instead, which reject that case at synthesis time. Service-side validation does not help, because an injected policy is still valid Cedar.

Parameters:

cedar_statement (str) –

  • Complete Cedar policy statement.

Return type:

PolicyStatement