# GatewayPolicyEngineConfig

Configuration for associating a policy engine with a gateway.

When configured, the policy engine intercepts all agent requests through this
gateway and evaluates them against the defined Cedar policies.
[disable-awslint:prefer-ref-interface]

- Source: [`aws-bedrockagentcore/lib/gateway/gateway.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/gateway.ts#L275)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts

// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
  policyEngineName: "my_policy_engine",
  description: "Policy engine for access control",
});

const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  policyEngineConfiguration: {
    policyEngine: policyEngine,
    mode: agentcore.PolicyEngineMode.ENFORCE, // This is the default
  },
});

// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal,
      action,
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow all actions on specific gateway (development)",
  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});

// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal is AgentCore::OAuthUser,
      action == AgentCore::Action::"WeatherTool__get_forecast",
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow specific weather tool access",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});
```

## Properties

- `mode`: [PolicyEngineMode](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyEngineMode.html) = PolicyEngineMode.ENFORCE — The enforcement mode for the policy engine.

  - `ENFORCE`: Actively allows or denies requests based on Cedar policy evaluation.
  - `LOG_ONLY`: Evaluates and logs decisions without enforcing them. Every tool call
    succeeds regardless of any `forbid` policy, so this is intended for testing a policy
    against real traffic and is not recommended for production.

- `policyEngine`: [IPolicyEngine](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.IPolicyEngine.html) (required) — The policy engine to associate with this gateway.

  [disable-awslint:prefer-ref-interface]