# PolicyAttribute

An attribute of the request that a condition can compare against.

Cedar exposes three sources of attributes. Which one you want depends on where the
value comes from: the caller, the thing being accessed, or the request environment.

- Source: [`aws-bedrockagentcore/lib/policy/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/policy/policy-statement.ts#L134)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts
import { PolicyAttribute } from 'aws-cdk-lib/aws-bedrockagentcore';

PolicyAttribute.principal('department'); // principal.department
PolicyAttribute.resource('confidential'); // resource.confidential
PolicyAttribute.context('sourceIp'); // context.sourceIp
```

## Methods

- `context(attribute: string): PolicyAttribute // chainable` (static) — An attribute of the request context, meaning the request environment rather than either entity.

  For example `sourceIp`, `environment` or `timestamp`.

  **Parameters**

  - `attribute` — - The attribute name.

- `principal(attribute: string): PolicyAttribute // chainable` (static) — An attribute of the principal, meaning the authenticated user or service making the request.

  For example `username`, `department` or `groups`.

  **Parameters**

  - `attribute` — - The attribute name.

- `resource(attribute: string): PolicyAttribute // chainable` (static) — An attribute of the resource being accessed.

  For example `owner` or
  `classification`.

  **Parameters**

  - `attribute` — - The attribute name.