PolicyStatementProps Struct
Properties for a policy statement.
Example
ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;
// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
policyEngine: policyEngine,
policyName: "unless_suspended",
statement: new agentcore.PolicyStatement({
effect: agentcore.PolicyEffect.PERMIT,
principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
action: agentcore.PolicyAction.any(),
resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
unless: [
agentcore.PolicyCondition.booleanEquals(
agentcore.PolicyAttribute.principal('suspended'), true),
],
}),
description: "Allow all actions unless user is suspended",
validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});
// Generated Cedar:
// permit(
// principal is AgentCore::OAuthUser,
// action,
// resource == AgentCore::Gateway::"arn:..."
// )
// unless {
// principal.suspended == true
// };
Properties
The action the statement applies to.
Whether the statement permits or forbids the action.
principalPolicyPrincipalprincipalPolicyPrincipalprincipalPolicyPrincipalPrincipalPolicyPrincipalPrincipalPolicyPrincipalrequired#The principal the statement applies to.
resourcePolicyResourceresourcePolicyResourceresourcePolicyResourceResourcePolicyResourceResourcePolicyResourcerequired#The resource the statement applies to.
unlessPolicyCondition[]unlesstyping.List[PolicyCondition]unlessList<PolicyCondition>UnlessPolicyCondition[]Unless*[]PolicyCondition= no exclusions#Conditions that must not hold for the statement to apply.
whenPolicyCondition[]whentyping.List[PolicyCondition]whenList<PolicyCondition>WhenPolicyCondition[]When*[]PolicyCondition= the statement applies whenever i…#Conditions that must all hold for the statement to apply.
Use PolicyCondition.anyOf() for a member that only needs one of several conditions to hold.
default
Default: the statement applies whenever its principal, action and resource match