AWS CDK Reference

Appearance

v2.275.0

Experimental

@aws-cdk/aws-bedrock-agentcore-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

PolicyProps Struct ​

Properties for creating a Policy resource.

Stability
Experimental
Source
lib/policy/policy.ts

Example ​

ts
declare const policyEngine: agentcore.PolicyEngine;

// Option 1: Using definition property
const advancedPolicy = new agentcore.Policy(this, "AdvancedPolicy", {
  policyEngine: policyEngine,
  definition: 'permit(principal, action, resource) when { context.custom > 10 };',
  description: "Advanced policy with custom Cedar logic",
});

// Option 2: Using fromCedar() with statement property
policyEngine.addPolicy("CustomPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(
    'forbid(principal, action, resource) when { resource.confidential == true };'
  ),
  description: "Custom policy from Cedar string",
});

Properties ​

definitionoptionalstringdefinitionoptionalstrdefinitionoptionalStringDefinitionoptionalstringDefinitionoptional*string#
Cedar policy statement. The authorization policy written in Cedar policy language.

Default: Must provide either definition or statement

notes

Cedar supports permit and forbid rules with conditions. The statement will be wrapped in a PolicyDefinition structure internally.

Pass the raw Cedar statement as a string. For example:

  • "permit(principal, action, resource);"
  • "permit(principal in Group::"Admins", action == Action::"InvokeModel", resource) when { context.environment == "production" };"

You must specify either definition or statement, but not both.

descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#
Optional description for the policy.

Default: No description

Maximum length of 4096.

policyEngineIPolicyEnginepolicy_engineIPolicyEnginepolicyEngineIPolicyEnginePolicyEngineIPolicyEnginePolicyEngineIPolicyEnginerequired#
The policy engine this policy belongs to.

[disable-awslint:prefer-ref-interface]

policyNameoptionalstringpolicy_nameoptionalstrpolicyNameoptionalStringPolicyNameoptionalstringPolicyNameoptional*string#
The name of the policy.

Default: Auto-generated unique name

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Pattern: ^[A-Za-z][A-Za-z0-9_]*$

statementoptionalPolicyStatementstatementoptionalPolicyStatementstatementoptionalPolicyStatementStatementoptionalPolicyStatementStatementoptionalPolicyStatement#
Type-safe Cedar policy statement built using PolicyStatement builder.

Default: Must provide either definition or statement

Use this for a type-safe, form-like API to build Cedar policies without writing raw Cedar syntax. The builder validates at synthesis time.

You must specify either definition or statement, but not both.

validationModeoptionalPolicyValidationModevalidation_modeoptionalPolicyValidationModevalidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationMode#
Validation mode for the policy.

Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS

Controls how Cedar analyzer validation findings are handled.