# PolicyStatementProps

Properties for a policy statement.

Extends: PolicyStatementProps
Used as props by: PolicyStatement

- Source: [`aws-bedrockagentcore/lib/policy/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/policy/policy-statement.ts#L613)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };
```

## Properties

- `action`: [PolicyAction](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyAction.html) (required) — The action the statement applies to.

- `effect`: [PolicyEffect](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyEffect.html) (required) — Whether the statement permits or forbids the action.

- `principal`: [PolicyPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyPrincipal.html) (required) — The principal the statement applies to.

- `resource`: [PolicyResource](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyResource.html) (required) — The resource the statement applies to.

- `unless`: [PolicyCondition](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyCondition.html)[] = no exclusions — Conditions that must not hold for the statement to apply.

- `when`: [PolicyCondition](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyCondition.html)[] = the statement applies whenever its principal, action and resource match — Conditions that must all hold for the statement to apply.

  Use `PolicyCondition.anyOf()` for a member that only needs one of several
  conditions to hold.

  **Default:** the statement applies whenever its principal, action and resource match