PolicyStatementProps

class aws_cdk.aws_bedrockagentcore.PolicyStatementProps(*, action, effect, principal, resource, unless=None, when=None)

Bases: object

Properties for a policy statement.

Parameters:

action (PolicyAction) – The action the statement applies to.
effect (PolicyEffect) – Whether the statement permits or forbids the action.
principal (PolicyPrincipal) – The principal the statement applies to.
resource (PolicyResource) – The resource the statement applies to.
unless (Optional[Sequence[PolicyCondition]]) – Conditions that must not hold for the statement to apply. Default: - no exclusions
when (Optional[Sequence[PolicyCondition]]) – Conditions that must all hold for the statement to apply. Use PolicyCondition.anyOf() for a member that only needs one of several conditions to hold. Default: - the statement applies whenever its principal, action and resource match

ExampleMetadata:

fixture=default infused

Example:

# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow access unless the user is suspended
policy_with_unless = agentcore.Policy(self, "UnlessPolicy",
    policy_engine=policy_engine,
    policy_name="unless_suspended",
    statement=agentcore.PolicyStatement(
        effect=agentcore.PolicyEffect.PERMIT,
        principal=agentcore.PolicyPrincipal.entity_type("AgentCore::OAuthUser"),
        action=agentcore.PolicyAction.any(),
        resource=agentcore.PolicyResource.instance("AgentCore::Gateway", gateway.gateway_arn),
        unless=[
            agentcore.PolicyCondition.boolean_equals(
                agentcore.PolicyAttribute.principal("suspended"), True)
        ]
    ),
    description="Allow all actions unless user is suspended",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

action: The action the statement applies to.

effect: Whether the statement permits or forbids the action.

principal: The principal the statement applies to.

resource: The resource the statement applies to.

unless

Conditions that must not hold for the statement to apply.

Default:

no exclusions

when

Conditions that must all hold for the statement to apply.

Use PolicyCondition.anyOf() for a member that only needs one of several conditions to hold.

Default:

the statement applies whenever its principal, action and resource match