PolicyEngineMode Class
The enforcement mode for a policy engine associated with a gateway.
Example
ts
// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
policyEngineName: "my_policy_engine",
description: "Policy engine for access control",
});
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
policyEngineConfiguration: {
policyEngine: policyEngine,
mode: agentcore.PolicyEngineMode.ENFORCE, // This is the default
},
});
// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
statement: agentcore.PolicyStatement.fromCedar(`
permit(
principal,
action,
resource == AgentCore::Gateway::"${gateway.gatewayArn}"
);
`),
description: "Allow all actions on specific gateway (development)",
validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});
// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
statement: agentcore.PolicyStatement.fromCedar(`
permit(
principal is AgentCore::OAuthUser,
action == AgentCore::Action::"WeatherTool__get_forecast",
resource == AgentCore::Gateway::"${gateway.gatewayArn}"
);
`),
description: "Allow specific weather tool access",
validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});
Properties
ENFORCEPolicyEngineModeenforcePolicyEngineModeENFORCEPolicyEngineModeENFORCEPolicyEngineModeENFORCEPolicyEngineModerequiredstatic#Enforces decisions by allowing or denying agent operations based on Cedar policies.
LOG_ONLYPolicyEngineModelog_onlyPolicyEngineModeLOG_ONLYPolicyEngineModeLOG_ONLYPolicyEngineModeLOG_ONLYPolicyEngineModerequiredstatic#Evaluates actions and adds traces but does not enforce decisions.
Use this mode for testing and validation before enabling enforcement.
The string value of the policy engine mode.
Methods
of(value: string): PolicyEngineMode // chainable@staticmethod def of(value: str) -> PolicyEngineModepublic static PolicyEngineMode of(String value)public static PolicyEngineMode Of(string value)func Of(Value *string) PolicyEngineModestatic#A policy engine mode that this version of the CDK does not model.
notes · 1 parameter
Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.
Parameters
valuevaluevaluevalueValue— the raw mode value to pass to CloudFormation.