AWS CDK Reference

Appearance

v2.275.0

Experimental

@aws-cdk/aws-bedrock-agentcore-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

AddPolicyOptions Struct ​

Options for adding a policy via PolicyEngine.addPolicy().

Stability
Experimental
Source
lib/policy/policy-types.ts

Example ​

ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser::your-client-id')
    .onActions([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ])
    .onResource('AgentCore::Gateway', gateway.gatewayArn),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );

Properties ​

definitionoptionalstringdefinitionoptionalstrdefinitionoptionalStringDefinitionoptionalstringDefinitionoptional*string#
Cedar policy statement (35-153,600 characters).

Default: Must provide either definition or statement

You must specify either definition or statement, but not both.

descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#
Optional description for the policy (max 4,096 characters).

Default: No description

policyNameoptionalstringpolicy_nameoptionalstrpolicyNameoptionalStringPolicyNameoptionalstringPolicyNameoptional*string#
The name of the policy.

Default: Auto-generated unique name

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters

statementoptionalPolicyStatementstatementoptionalPolicyStatementstatementoptionalPolicyStatementStatementoptionalPolicyStatementStatementoptionalPolicyStatement#
Type-safe Cedar policy statement built using PolicyStatement builder.

Default: Must provide either definition or statement

Use this for a type-safe, form-like API to build Cedar policies without writing raw Cedar syntax. The builder validates at synthesis time.

You must specify either definition or statement, but not both.

validationModeoptionalPolicyValidationModevalidation_modeoptionalPolicyValidationModevalidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationMode#
Validation mode for the policy.

Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS