GatewayPolicyEngineConfig Struct
Configuration for associating a policy engine with a gateway.
When configured, the policy engine intercepts all agent requests through this gateway and evaluates them against the defined Cedar policies. [disable-awslint:prefer-ref-interface]
Example
ts
// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
policyEngineName: "my_policy_engine",
description: "Policy engine for access control",
});
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
policyEngineConfiguration: {
policyEngine: policyEngine,
mode: agentcore.PolicyEngineMode.ENFORCE, // This is the default
},
});
// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
statement: agentcore.PolicyStatement.fromCedar(`
permit(
principal,
action,
resource == AgentCore::Gateway::"${gateway.gatewayArn}"
);
`),
description: "Allow all actions on specific gateway (development)",
validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});
// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
statement: agentcore.PolicyStatement.fromCedar(`
permit(
principal is AgentCore::OAuthUser,
action == AgentCore::Action::"WeatherTool__get_forecast",
resource == AgentCore::Gateway::"${gateway.gatewayArn}"
);
`),
description: "Allow specific weather tool access",
validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});
Properties
modePolicyEngineModemodePolicyEngineModemodePolicyEngineModeModePolicyEngineModeModePolicyEngineMode= PolicyEngineMode.ENFORCE#The enforcement mode for the policy engine.
notes
ENFORCE: Actively allows or denies requests based on Cedar policy evaluation.LOG_ONLY: Evaluates and logs decisions without enforcing them. Every tool call succeeds regardless of anyforbidpolicy, so this is intended for testing a policy against real traffic and is not recommended for production.
policyEngineIPolicyEnginepolicy_engineIPolicyEnginepolicyEngineIPolicyEnginePolicyEngineIPolicyEnginePolicyEngineIPolicyEnginerequired#The policy engine to associate with this gateway.
[disable-awslint:prefer-ref-interface]