@aws-cdk/aws-bedrock-agentcore-alpha.PolicyValidationMode

Experimental

@aws-cdk/aws-bedrock-agentcore-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

PolicyValidationMode Class

Validation mode for Cedar policy definitions.

Stability

Experimental

Source

lib/policy/policy-types.ts

Example

declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser')
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn)
    .unless()
      .principalAttribute('suspended').equalTo(true)
      .done(),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };

# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow access unless the user is suspended
policy_with_unless = agentcore.Policy(self, "UnlessPolicy",
    policy_engine=policy_engine,
    policy_name="unless_suspended",
    statement=agentcore.PolicyStatement.permit().for_principal("AgentCore::OAuthUser").on_all_actions().on_resource("AgentCore::Gateway", gateway.gateway_arn).unless().principal_attribute("suspended").equal_to(True).done(),
    description="Allow all actions unless user is suspended",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

PolicyEngine policyEngine;
Gateway gateway;


// Allow access unless the user is suspended
Policy policyWithUnless = Policy.Builder.create(this, "UnlessPolicy")
        .policyEngine(policyEngine)
        .policyName("unless_suspended")
        .statement(PolicyStatement.permit().forPrincipal("AgentCore::OAuthUser").onAllActions().onResource("AgentCore::Gateway", gateway.gatewayArn).unless().principalAttribute("suspended").equalTo(true).done())
        .description("Allow all actions unless user is suspended")
        .validationMode(PolicyValidationMode.FAIL_ON_ANY_FINDINGS)
        .build();

// Install: dotnet add package Amazon.CDK.AWS.Bedrock.Agentcore.Alpha
PolicyEngine policyEngine;
Gateway gateway;


// Allow access unless the user is suspended
var policyWithUnless = new Policy(this, "UnlessPolicy", new PolicyProps {
    PolicyEngine = policyEngine,
    PolicyName = "unless_suspended",
    Statement = PolicyStatement.Permit().ForPrincipal("AgentCore::OAuthUser").OnAllActions().OnResource("AgentCore::Gateway", gateway.GatewayArn).Unless().PrincipalAttribute("suspended").EqualTo(true).Done(),
    Description = "Allow all actions unless user is suspended",
    ValidationMode = PolicyValidationMode.FAIL_ON_ANY_FINDINGS
});

// Install: go get github.com/aws/aws-cdk-go/awsbedrockagentcorealpha/v2
var policyEngine PolicyEngine
var gateway Gateway


// Allow access unless the user is suspended
policyWithUnless := agentcore.NewPolicy(this, jsii.String("UnlessPolicy"), &PolicyProps{
	PolicyEngine: policyEngine,
	PolicyName: jsii.String("unless_suspended"),
	Statement: agentcore.PolicyStatement_Permit().ForPrincipal(jsii.String("AgentCore::OAuthUser")).OnAllActions().OnResource(jsii.String("AgentCore::Gateway"), gateway.GatewayArn).Unless().PrincipalAttribute(jsii.String("suspended")).EqualTo(jsii.Boolean(true)).Done(),
	Description: jsii.String("Allow all actions unless user is suspended"),
	ValidationMode: agentcore.PolicyValidationMode_FAIL_ON_ANY_FINDINGS(),
})

Initializer

new PolicyValidationMode(value: string)

PolicyValidationMode(value: str)

new PolicyValidationMode(String value)

new PolicyValidationMode(string value)

NewPolicyValidationMode(Value *string)

Properties

FAIL_ON_ANY_FINDINGSPolicyValidationModefail_on_any_findingsPolicyValidationModeFAIL_ON_ANY_FINDINGSPolicyValidationModeFAIL_ON_ANY_FINDINGSPolicyValidationModeFAIL_ON_ANY_FINDINGSPolicyValidationModerequiredstatic#

Fail policy creation if any validation findings are detected.

This is the safer default - catches policy errors early.

IGNORE_ALL_FINDINGSPolicyValidationModeignore_all_findingsPolicyValidationModeIGNORE_ALL_FINDINGSPolicyValidationModeIGNORE_ALL_FINDINGSPolicyValidationModeIGNORE_ALL_FINDINGSPolicyValidationModerequiredstatic#

Ignore all validation findings and create the policy anyway.

Use with caution - may result in runtime authorization errors.

valuestringvaluestrvalueStringValuestringValue*stringrequired#

The string value of the validation mode.