AddPolicyOptions Struct
Options for adding a policy via PolicyEngine.addPolicy().
Example
ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;
// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
statement: new agentcore.PolicyStatement({
effect: agentcore.PolicyEffect.PERMIT,
principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
action: agentcore.PolicyAction.anyOf([
'AgentCore::Action::WeatherTool__get_forecast',
'AgentCore::Action::WeatherTool__get_current',
]),
resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
}),
description: "Allow specific weather tool operations",
validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});
// Generated Cedar:
// permit(
// principal is AgentCore::OAuthUser,
// action in [
// AgentCore::Action::"WeatherTool__get_forecast",
// AgentCore::Action::"WeatherTool__get_current"
// ],
// resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );
Properties
descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#Optional description for the policy (max 4,096 characters).
Default: No description
policyNameoptionalstringpolicy_nameoptionalstrpolicyNameoptionalStringPolicyNameoptionalstringPolicyNameoptional*string#The name of the policy.
Default: Auto-generated unique name
Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters
statementPolicyStatementstatementPolicyStatementstatementPolicyStatementStatementPolicyStatementStatementPolicyStatementrequired#The Cedar policy statement for this policy.
Build a type-safe statement with the PolicyStatement factories, or use PolicyStatement.fromCedar('...') for raw Cedar. Raw Cedar is treated as trusted input: the module does not escape, quote, or validate it.
validationModeoptionalPolicyValidationModevalidation_modeoptionalPolicyValidationModevalidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationMode#Validation mode for the policy.
Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS