# PolicyPrincipal

The principal a policy statement applies to.

- Source: [`aws-bedrockagentcore/lib/policy/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/policy/policy-statement.ts#L427)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts
import { PolicyPrincipal } from 'aws-cdk-lib/aws-bedrockagentcore';

PolicyPrincipal.any(); // principal
PolicyPrincipal.entityType('AgentCore::OAuthUser'); // principal is AgentCore::OAuthUser
PolicyPrincipal.entity('AgentCore::OAuthUser', 'user123'); // principal == AgentCore::OAuthUser::"user123"
PolicyPrincipal.inGroup('AgentCore::OAuthGroup', 'admins'); // principal in AgentCore::OAuthGroup::"admins"
```

## Methods

- `any(): PolicyPrincipal // chainable` (static) — Any principal, whoever the caller is.

- `entity(entityType: string, entityId: string): PolicyPrincipal // chainable` (static) — One specific principal.

  **Parameters**

  - `entityType` — - The entity type, for example 'AgentCore::OAuthUser'.
  - `entityId` — - The entity identifier.

- `entityType(entityType: string): PolicyPrincipal // chainable` (static) — Any principal of the given entity type.

  **Parameters**

  - `entityType` — - The entity type, for example 'AgentCore::OAuthUser'.

- `inGroup(groupType: string, groupId: string): PolicyPrincipal // chainable` (static) — Any principal that is a member of the given group.

  **Parameters**

  - `groupType` — - The group entity type, for example 'AgentCore::OAuthGroup'.
  - `groupId` — - The group identifier.