update_policy¶
Operation¶
async
¶
update_policy(input: UpdatePolicyInput, plugins: list[Plugin] | None = None) -> UpdatePolicyOutput
Updates an existing policy within the AgentCore Policy system. This
operation allows modification of the policy description and definition
while maintaining the policy's identity. The updated policy is
validated against the Cedar schema before being applied. This is an
asynchronous operation. Use the GetPolicy operation to poll the
status field to track completion.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
input
|
UpdatePolicyInput
|
An instance of |
required |
plugins
|
list[Plugin] | None
|
A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations. |
None
|
Returns:
| Type | Description |
|---|---|
UpdatePolicyOutput
|
An instance of |
Input¶
dataclass
¶
Dataclass for UpdatePolicyInput structure.
Attributes¶
class-attribute
instance-attribute
¶
definition: PolicyDefinition | None = None
The new Cedar policy statement that defines the access control rules. This replaces the existing policy definition with new logic while maintaining the policy's identity.
class-attribute
instance-attribute
¶
description: UpdatedDescription | None = None
The new human-readable description for the policy. This optional field allows updating the policy's documentation while keeping the same policy logic.
class-attribute
instance-attribute
¶
enforcement_mode: EnforcementMode | None = None
The enforcement mode for the policy. Run this policy in LOG_ONLY mode
to collect data on how it affects your application. Once you are
satisfied with the data gathered, switch the policy to ACTIVE. If you
omit this field, the policy's existing enforcement mode is unchanged.
class-attribute
instance-attribute
¶
policy_engine_id: str | None = None
The identifier of the policy engine that manages the policy to be updated. This ensures the policy is updated within the correct policy engine context.
class-attribute
instance-attribute
¶
policy_id: str | None = None
The unique identifier of the policy to be updated. This must be a valid policy ID that exists within the specified policy engine.
class-attribute
instance-attribute
¶
validation_mode: PolicyValidationMode = PolicyValidationMode('FAIL_ON_ANY_FINDINGS')
The validation mode for the policy update. Determines how Cedar analyzer validation results are handled during policy updates. FAIL_ON_ANY_FINDINGS runs the Cedar analyzer and fails the update if validation issues are detected, ensuring the policy conforms to the Cedar schema and tool context. IGNORE_ALL_FINDINGS runs the Cedar analyzer but allows updates despite validation warnings. Use FAIL_ON_ANY_FINDINGS to ensure policy correctness during updates, especially when modifying policy logic or conditions.
Output¶
dataclass
¶
Dataclass for UpdatePolicyOutput structure.
Attributes¶
class-attribute
instance-attribute
¶
description: str | None = field(repr=False, default=None)
The updated description of the policy.
class-attribute
instance-attribute
¶
enforcement_mode: EnforcementMode = EnforcementMode('ACTIVE')
The current enforcement mode of the updated policy.
instance-attribute
¶
policy_engine_id: str
The identifier of the policy engine managing the updated policy.
instance-attribute
¶
status_reasons: list[str]
Additional information about the update status.
instance-attribute
¶
updated_at: datetime
The timestamp when the policy was last updated.