create_policy_engine¶
Operation¶
async
¶
create_policy_engine(input: CreatePolicyEngineInput, plugins: list[Plugin] | None = None) -> CreatePolicyEngineOutput
Creates a new policy engine within the AgentCore Policy system. A policy
engine is a collection of policies that evaluates and authorizes agent
tool calls. When associated with Gateways (each Gateway can be
associated with at most one policy engine, but multiple Gateways can be
associated with the same engine), the policy engine intercepts all agent
requests and determines whether to allow or deny each action based on
the defined policies. This is an asynchronous operation. Use the
GetPolicyEngine
operation to poll the status field to track completion.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
input
|
CreatePolicyEngineInput
|
An instance of |
required |
plugins
|
list[Plugin] | None
|
A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations. |
None
|
Returns:
| Type | Description |
|---|---|
CreatePolicyEngineOutput
|
An instance of |
Input¶
dataclass
¶
Dataclass for CreatePolicyEngineInput structure.
Attributes¶
class-attribute
instance-attribute
¶
client_token: str | None = None
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request with the same client token, the service returns the same response without creating a duplicate policy engine.
class-attribute
instance-attribute
¶
description: str | None = field(repr=False, default=None)
A human-readable description of the policy engine's purpose and scope (1-4,096 characters). This helps administrators understand the policy engine's role in the overall governance strategy. Document which Gateway this engine will be associated with, what types of tools or workflows it governs, and the team or service responsible for maintaining it. Clear descriptions are essential when managing multiple policy engines across different services or environments.
class-attribute
instance-attribute
¶
encryption_key_arn: str | None = None
The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.
class-attribute
instance-attribute
¶
name: str | None = None
The customer-assigned immutable name for the policy engine. This name identifies the policy engine and cannot be changed after creation.
class-attribute
instance-attribute
¶
tags: dict[str, str] | None = None
A map of tag keys and values to assign to an AgentCore Policy. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.
Output¶
dataclass
¶
Dataclass for CreatePolicyEngineOutput structure.
Attributes¶
instance-attribute
¶
created_at: datetime
The timestamp when the policy engine was created. This is automatically set by the service and used for auditing and lifecycle management.
class-attribute
instance-attribute
¶
description: str | None = field(repr=False, default=None)
A human-readable description of the policy engine's purpose.
class-attribute
instance-attribute
¶
encryption_key_arn: str | None = None
The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.
instance-attribute
¶
name: str
The customer-assigned name of the created policy engine. This matches the name provided in the request and serves as the human-readable identifier.
instance-attribute
¶
policy_engine_arn: str
The Amazon Resource Name (ARN) of the created policy engine. This globally unique identifier can be used for cross-service references and IAM policy statements.
instance-attribute
¶
policy_engine_id: str
The unique identifier for the created policy engine. This system-generated identifier consists of the user name plus a 10-character generated suffix and is used for all subsequent policy engine operations.
instance-attribute
¶
status: PolicyEngineStatus
The current status of the policy engine. A status of ACTIVE indicates
the policy engine is ready for use.
instance-attribute
¶
status_reasons: list[str]
Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine creation process.
instance-attribute
¶
updated_at: datetime
The timestamp when the policy engine was last updated. For newly created
policy engines, this matches the createdAt timestamp.