AWS CDK Reference

Appearance

v2.273.0

PolicyEffect Enum ​

Effect of a policy statement, whether it permits or forbids the action.

Source
aws-bedrockagentcore/lib/policy/policy-statement.ts
Type last changed
v2.269.0 · 10 Sep 2026

Example ​

ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };

Members ​

MemberDescription
PERMITPermit the action when the statement matches and its conditions hold.
FORBIDForbid the action when the statement matches and its conditions hold.

Referenced by ​