# PolicyStatementProps

Interface for creating a policy statement.

Extends: PolicyStatementProps
Used as props by: PolicyStatement

- Source: [`aws-iam/lib/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/policy-statement.ts#L772)

## Example

```ts
    // Add gateway endpoints when creating the VPC
    const vpc = new ec2.Vpc(this, 'MyVpc', {
      gatewayEndpoints: {
        S3: {
          service: ec2.GatewayVpcEndpointAwsService.S3,
        },
      },
    });

    // Alternatively gateway endpoints can be added on the VPC
    const dynamoDbEndpoint = vpc.addGatewayEndpoint('DynamoDbEndpoint', {
      service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
    });

    // This allows to customize the endpoint policy
    dynamoDbEndpoint.addToPolicy(
      new iam.PolicyStatement({ // Restrict to listing and describing tables
        principals: [new iam.AnyPrincipal()],
        actions: ['dynamodb:DescribeTable', 'dynamodb:ListTables'],
        resources: ['*'],
      }));

    // Add an interface endpoint
    vpc.addInterfaceEndpoint('EcrDockerEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,

      // Uncomment the following to allow more fine-grained control over
      // who can access the endpoint via the '.connections' object.
      // open: false
    });
```

## Properties

- `actions`: string[] — List of actions to add to the statement.

  **Default:** no actions

- `conditions`: { [key: string]: any } — Conditions to add to the statement.

  **Default:** no condition

- `effect`: [Effect](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Effect.html) = Effect.ALLOW — Whether to allow or deny the actions in this statement.

- `notActions`: string[] — List of not actions to add to the statement.

  **Default:** no not-actions

- `notPrincipals`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html)[] — List of not principals to add to the statement.

  **Default:** no not principals

- `notResources`: string[] — NotResource ARNs to add to the statement.

  **Default:** no not-resources

- `principals`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html)[] — List of principals to add to the statement.

  **Default:** no principals

- `resources`: string[] — Resource ARNs to add to the statement.

  **Default:** no resources

- `sid`: string — The Sid (statement ID) is an optional identifier that you provide for the policy statement.

  **Default:** no sid

  You can assign a Sid value to each statement in a
  statement array. In services that let you specify an ID element, such as
  SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In
  IAM, the Sid value must be unique within a JSON policy. In IAM identity
  policies, the Sid value must contain only alphanumeric characters.