AWS CDK Reference

Appearance

v2.276.0

PolicyEngineProps Struct ​

Properties for creating a PolicyEngine resource.

Source
aws-bedrockagentcore/lib/policy/policy-engine.ts
Type last changed
v2.269.0 · 10 Sep 2026

Example ​

ts
const policyEngine = new agentcore.PolicyEngine(this, "MyEngine", {
  policyEngineName: "my_engine",
});

const lambdaRole = new iam.Role(this, "LambdaRole", {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
});

// Grant read permissions
policyEngine.grantRead(lambdaRole);

// Grant evaluation permissions
policyEngine.grantEvaluate(lambdaRole);
python
policy_engine = agentcore.PolicyEngine(self, "MyEngine",
    policy_engine_name="my_engine"
)

lambda_role = iam.Role(self, "LambdaRole",
    assumed_by=iam.ServicePrincipal("lambda.amazonaws.com")
)

# Grant read permissions
policy_engine.grant_read(lambda_role)

# Grant evaluation permissions
policy_engine.grant_evaluate(lambda_role)
java
PolicyEngine policyEngine = PolicyEngine.Builder.create(this, "MyEngine")
        .policyEngineName("my_engine")
        .build();

Role lambdaRole = Role.Builder.create(this, "LambdaRole")
        .assumedBy(new ServicePrincipal("lambda.amazonaws.com"))
        .build();

// Grant read permissions
policyEngine.grantRead(lambdaRole);

// Grant evaluation permissions
policyEngine.grantEvaluate(lambdaRole);
csharp
// Install: dotnet add package Amazon.CDK.Lib
var policyEngine = new PolicyEngine(this, "MyEngine", new PolicyEngineProps {
    PolicyEngineName = "my_engine"
});

var lambdaRole = new Role(this, "LambdaRole", new RoleProps {
    AssumedBy = new ServicePrincipal("lambda.amazonaws.com")
});

// Grant read permissions
policyEngine.GrantRead(lambdaRole);

// Grant evaluation permissions
policyEngine.GrantEvaluate(lambdaRole);
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
policyEngine := agentcore.NewPolicyEngine(this, jsii.String("MyEngine"), &PolicyEngineProps{
	PolicyEngineName: jsii.String("my_engine"),
})

lambdaRole := iam.NewRole(this, jsii.String("LambdaRole"), &RoleProps{
	AssumedBy: iam.NewServicePrincipal(jsii.String("lambda.amazonaws.com")),
})

// Grant read permissions
policyEngine.GrantRead(lambdaRole)

// Grant evaluation permissions
policyEngine.GrantEvaluate(lambdaRole)

Properties ​

descriptionoptionalstringdescriptionoptionalstrdescriptionoptionalStringDescriptionoptionalstringDescriptionoptional*string#
Optional description for the policy engine.

Default: No description

Maximum 4,096 characters.

kmsKeyoptionalIKeykms_keyoptionalIKeykmsKeyoptionalIKeyKmsKeyoptionalIKeyKmsKeyoptionalIKey#
Custom KMS key for encryption.

Default: AWS owned key

[disable-awslint:prefer-ref-interface]

policyEngineNameoptionalstringpolicy_engine_nameoptionalstrpolicyEngineNameoptionalStringPolicyEngineNameoptionalstringPolicyEngineNameoptional*string#
The name of the policy engine.

Default: Auto-generated unique name

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Pattern: ^[A-Za-z][A-Za-z0-9_]*$

tagsoptional{ [key: string]: string }tagsoptionaltyping.Mapping[str, str]tagsoptionalMap<String, String>TagsoptionalIDictionary<string, string>Tagsoptional*map[string]*string#
Tags for the policy engine.

Default: No tags

Maximum 50 tags.