AWS CDK Reference

Appearance

v2.276.0

AddPolicyOptions Struct ​

Options for adding a policy via PolicyEngine.addPolicy().

Source
aws-bedrockagentcore/lib/policy/policy-types.ts
Type last changed
v2.269.0 · 10 Sep 2026

Example ​

ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.anyOf([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ]),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
  }),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );
python
# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow specific tool actions on specific gateway
# Action names follow pattern: "ToolName__operation"
policy_engine.add_policy("SpecificToolPolicy",
    statement=agentcore.PolicyStatement(
        effect=agentcore.PolicyEffect.PERMIT,
        principal=agentcore.PolicyPrincipal.entity_type("AgentCore::OAuthUser"),
        action=agentcore.PolicyAction.any_of(["AgentCore::Action::WeatherTool__get_forecast", "AgentCore::Action::WeatherTool__get_current"
        ]),
        resource=agentcore.PolicyResource.instance("AgentCore::Gateway", gateway.gateway_arn)
    ),
    description="Allow specific weather tool operations",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)
java
PolicyEngine policyEngine;
Gateway gateway;


// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", AddPolicyOptions.builder()
        .statement(PolicyStatement.Builder.create()
                .effect(PolicyEffect.PERMIT)
                .principal(PolicyPrincipal.entityType("AgentCore::OAuthUser"))
                .action(PolicyAction.anyOf(List.of("AgentCore::Action::WeatherTool__get_forecast", "AgentCore::Action::WeatherTool__get_current")))
                .resource(PolicyResource.instance("AgentCore::Gateway", gateway.getGatewayArn()))
                .build())
        .description("Allow specific weather tool operations")
        .validationMode(PolicyValidationMode.FAIL_ON_ANY_FINDINGS)
        .build());
csharp
// Install: dotnet add package Amazon.CDK.Lib
PolicyEngine policyEngine;
Gateway gateway;


// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.AddPolicy("SpecificToolPolicy", new AddPolicyOptions {
    Statement = new PolicyStatement(new PolicyStatementProps {
        Effect = PolicyEffect.PERMIT,
        Principal = PolicyPrincipal.EntityType("AgentCore::OAuthUser"),
        Action = PolicyAction.AnyOf(new [] { "AgentCore::Action::WeatherTool__get_forecast", "AgentCore::Action::WeatherTool__get_current" }),
        Resource = PolicyResource.Instance("AgentCore::Gateway", gateway.GatewayArn)
    }),
    Description = "Allow specific weather tool operations",
    ValidationMode = PolicyValidationMode.FAIL_ON_ANY_FINDINGS
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var policyEngine PolicyEngine
var gateway Gateway


// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.AddPolicy(jsii.String("SpecificToolPolicy"), &AddPolicyOptions{
	Statement: agentcore.NewPolicyStatement(&PolicyStatementProps{
		Effect: agentcore.PolicyEffect_PERMIT,
		Principal: agentcore.PolicyPrincipal_EntityType(jsii.String("AgentCore::OAuthUser")),
		Action: agentcore.PolicyAction_AnyOf([]*string{
			jsii.String("AgentCore::Action::WeatherTool__get_forecast"),
			jsii.String("AgentCore::Action::WeatherTool__get_current"),
		}),
		Resource: agentcore.PolicyResource_Instance(jsii.String("AgentCore::Gateway"), gateway.GatewayArn),
	}),
	Description: jsii.String("Allow specific weather tool operations"),
	ValidationMode: agentcore.PolicyValidationMode_FAIL_ON_ANY_FINDINGS(),
})

Properties ​

descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#
Optional description for the policy (max 4,096 characters).

Default: No description

policyNameoptionalstringpolicy_nameoptionalstrpolicyNameoptionalStringPolicyNameoptionalstringPolicyNameoptional*string#
The name of the policy.

Default: Auto-generated unique name

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters

statementPolicyStatementstatementPolicyStatementstatementPolicyStatementStatementPolicyStatementStatementPolicyStatementrequired#
The Cedar policy statement for this policy.

Build a type-safe statement with the PolicyStatement factories, or use PolicyStatement.fromCedar('...') for raw Cedar. Raw Cedar is treated as trusted input: the module does not escape, quote, or validate it.

validationModeoptionalPolicyValidationModevalidation_modeoptionalPolicyValidationModevalidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationModeValidationModeoptionalPolicyValidationMode#
Validation mode for the policy.

Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS