@aws-cdk/aws-bedrock-agentcore-alpha.PolicyStatement

Experimental

@aws-cdk/aws-bedrock-agentcore-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

PolicyStatement Class

Type-safe builder for creating Cedar authorization policy statements.

This builder provides a fluent API for constructing Cedar policies without requiring knowledge of Cedar syntax. It supports:

• Permit and forbid effects
• Principal, action, and resource specifications
• Conditional logic (when/unless clauses)
• Raw Cedar for advanced cases

The builder generates valid Cedar policy statements that can be used with the Policy construct.

Stability

Experimental

Source

lib/policy/policy-statement.ts

Example

import { Policy, PolicyEngine, PolicyStatement } from '@aws-cdk/aws-bedrock-agentcore-alpha';
declare const engine: PolicyEngine;

// Example 4: Raw Cedar policy
// For advanced Cedar features not supported by the builder
new Policy(this, 'CustomPolicy', {
  policyEngine: engine,
  definition: 'permit(principal, action, resource) when { context.custom > 10 };',
});

// Or using fromCedar():
new Policy(this, 'ImportedPolicy', {
  policyEngine: engine,
  statement: PolicyStatement.fromCedar(
    'forbid(principal, action, resource) when { resource.confidential == true };'
  ),
});

Methods

forAllPrincipals(): PolicyStatement // chainabledef for_all_principals(self, ) -> PolicyStatementpublic PolicyStatement forAllPrincipals()public PolicyStatement ForAllPrincipals()func ForAllPrincipals() PolicyStatement#

Apply to all principals (any user, service, or entity).

Generates: principal in Cedar

forbid(): PolicyStatement // chainable@staticmethod def forbid() -> PolicyStatementpublic static PolicyStatement forbid()public static PolicyStatement Forbid()func Forbid() PolicyStatementstatic#

Create a forbid statement - denies the action if conditions are met.

Forbid statements deny access when their conditions evaluate to true. Forbid always takes precedence over permit (explicit deny).

forPrincipal(entityType: string, entityId?: string): PolicyStatement // chainabledef for_principal(self, entity_type: str, entity_id: typing.Optional[str] = None) -> PolicyStatementpublic PolicyStatement forPrincipal(String entityType, String entityId)public PolicyStatement ForPrincipal(string entityType, string? entityId = null)func ForPrincipal(EntityType *string, EntityId *string) PolicyStatement#

Apply to a specific principal entity.

Generates: principal == EntityType::"entityId" in Cedar

2 parameters

Parameters

• entityTypeentity_typeentityTypeentityTypeEntityType — - The entity type (e.g., 'AgentCore::OAuthUser').
• entityIdentity_identityIdentityIdEntityId — - Optional specific entity ID.

forPrincipalInGroup(groupType: string, groupId: string): PolicyStatement // chainabledef for_principal_in_group(self, group_type: str, group_id: str) -> PolicyStatementpublic PolicyStatement forPrincipalInGroup(String groupType, String groupId)public PolicyStatement ForPrincipalInGroup(string groupType, string groupId)func ForPrincipalInGroup(GroupType *string, GroupId *string) PolicyStatement#

Apply to principals that are members of a specific group.

Generates: principal in Group::"groupId" in Cedar

2 parameters

Parameters

• groupTypegroup_typegroupTypegroupTypeGroupType — - The group entity type (e.g., 'Group').
• groupIdgroup_idgroupIdgroupIdGroupId — - The group identifier (e.g., 'Admins', 'Engineers').

fromCedar(cedarStatement: string): PolicyStatement // chainable@staticmethod def from_cedar(cedar_statement: str) -> PolicyStatementpublic static PolicyStatement fromCedar(String cedarStatement)public static PolicyStatement FromCedar(string cedarStatement)func FromCedar(CedarStatement *string) PolicyStatementstatic#

Create from raw Cedar policy statement string.

Use this for advanced Cedar features not supported by the builder, or when migrating existing Cedar policies.

Validation is deferred to the Policy construct's validationMode setting.

1 parameter

Parameters

• cedarStatementcedar_statementcedarStatementcedarStatementCedarStatement — - Complete Cedar policy statement including effect, principal, action, resource, and conditions.

onAction(action: string): PolicyStatement // chainabledef on_action(self, action: str) -> PolicyStatementpublic PolicyStatement onAction(String action)public PolicyStatement OnAction(string action)func OnAction(Action *string) PolicyStatement#

Apply to a single specific action.

Generates: action == Action::"name" in Cedar

1 parameter

Parameters

• actionactionactionactionAction — - Action name (e.g., 'AgentCore::Action::InsuranceAPI__get_policy').

onActions(actions: string[]): PolicyStatement // chainabledef on_actions(self, actions: typing.List[str]) -> PolicyStatementpublic PolicyStatement onActions(List<String> actions)public PolicyStatement OnActions(string[] actions)func OnActions(Actions *[]*string) PolicyStatement#

Apply to specific action(s).

Generates: action == Action::"name" or action in [Action::"name1", Action::"name2"] in Cedar

1 parameter

Parameters

• actionsactionsactionsactionsActions — - Array of action names (e.g., ['AgentCore::Action::InsuranceAPI__get_policy']).

onAllActions(): PolicyStatement // chainabledef on_all_actions(self, ) -> PolicyStatementpublic PolicyStatement onAllActions()public PolicyStatement OnAllActions()func OnAllActions() PolicyStatement#

Apply to all actions (any operation).

Generates: action in Cedar

onAllResources(entityType?: string): PolicyStatement // chainabledef on_all_resources(self, entity_type: typing.Optional[str] = None) -> PolicyStatementpublic PolicyStatement onAllResources(String entityType)public PolicyStatement OnAllResources(string? entityType = null)func OnAllResources(EntityType *string) PolicyStatement#

Apply to all resources of a specific type.

notes · 1 parameter · example

AWS Requirement: AWS Bedrock AgentCore Policy service does not allow wildcard resources (resource). This method provides type-constrained resources which are required for policy validation to succeed.

Generates: resource is EntityType in Cedar

Parameters

• entityTypeentity_typeentityTypeentityTypeEntityType — - The entity type (default: 'AgentCore::Gateway').

import { PolicyStatement } from '@aws-cdk/aws-bedrock-agentcore-alpha';

// Constrain to Gateway resources (default)
PolicyStatement.permit()
  .forAllPrincipals()
  .onAllActions()
  .onAllResources()  // → "resource is AgentCore::Gateway"

// Constrain to Runtime resources
PolicyStatement.permit()
  .forAllPrincipals()
  .onAllActions()
  .onAllResources('AgentCore::Runtime')  // → "resource is AgentCore::Runtime"

onResource(entityType: string, entityArn: string): PolicyStatement // chainabledef on_resource(self, entity_type: str, entity_arn: str) -> PolicyStatementpublic PolicyStatement onResource(String entityType, String entityArn)public PolicyStatement OnResource(string entityType, string entityArn)func OnResource(EntityType *string, EntityArn *string) PolicyStatement#

Apply to a specific resource instance.

AWS Requirement: When using specific actions (e.g., action == Action::"Delete"), you must constrain the resource to a specific instance, not just a type.

Generates: resource == EntityType::"arn" in Cedar

2 parameters · example

Parameters

• entityTypeentity_typeentityTypeentityTypeEntityType — - The entity type (e.g., 'AgentCore::Gateway').
• entityArnentity_arnentityArnentityArnEntityArn — - The resource ARN or identifier.

import { PolicyStatement } from '@aws-cdk/aws-bedrock-agentcore-alpha';
declare const gatewayArn: string;

PolicyStatement.forbid()
  .forAllPrincipals()
  .onAction('AgentCore::Action::Delete')
  .onResource('AgentCore::Gateway', gatewayArn)  // Must be specific resource

onResourceType(entityType: string): PolicyStatement // chainabledef on_resource_type(self, entity_type: str) -> PolicyStatementpublic PolicyStatement onResourceType(String entityType)public PolicyStatement OnResourceType(string entityType)func OnResourceType(EntityType *string) PolicyStatement#

Apply to all resources of a specific type (explicit method).

AWS Requirement: Resource type constraints are required by AWS Bedrock AgentCore when using wildcard principals or actions.

Generates: resource is EntityType in Cedar

1 parameter · example

Parameters

• entityTypeentity_typeentityTypeentityTypeEntityType — - The entity type (e.g., 'AgentCore::Gateway', 'AgentCore::Runtime').

import { PolicyStatement } from '@aws-cdk/aws-bedrock-agentcore-alpha';

PolicyStatement.permit()
  .forAllPrincipals()
  .onAllActions()
  .onResourceType('AgentCore::Gateway')  // → "resource is AgentCore::Gateway"

permit(): PolicyStatement // chainable@staticmethod def permit() -> PolicyStatementpublic static PolicyStatement permit()public static PolicyStatement Permit()func Permit() PolicyStatementstatic#

Create a permit statement - allows the action if conditions are met.

Permit statements grant access when their conditions evaluate to true. Multiple permit statements can apply; any matching permit allows access.

toCedar(): stringdef to_cedar(self, ) -> strpublic String toCedar()public string ToCedar()func ToCedar() *string#

Generate the Cedar policy statement string.

Converts the builder state into valid Cedar policy syntax. This is called internally by the Policy construct.

returns

Returns: Valid Cedar policy statement

unless(): ConditionalPolicyStatementdef unless(self, ) -> ConditionalPolicyStatementpublic ConditionalPolicyStatement unless()public ConditionalPolicyStatement Unless()func Unless() ConditionalPolicyStatement#

Add unless conditions - policy applies only if these conditions are false.

notes

Unless conditions define negative requirements (exclusions). The policy applies when these conditions are NOT met.

Returns a ConditionBuilder that you can chain condition methods on. Call done() when finished to return to the PolicyStatement.

when(): ConditionalPolicyStatementdef when(self, ) -> ConditionalPolicyStatementpublic ConditionalPolicyStatement when()public ConditionalPolicyStatement When()func When() ConditionalPolicyStatement#

Add when conditions - policy applies only if these conditions are true.

notes

When conditions define positive requirements that must be met. Multiple conditions can be combined with AND/OR operators.

Returns a ConditionBuilder that you can chain condition methods on. Call done() when finished to return to the PolicyStatement.