Package software.amazon.awscdk.services.bedrockagentcore

Interface GatewayPolicyEngineConfig

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

GatewayPolicyEngineConfig.Jsii$Proxy

@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)",
           date="2026-09-10T17:51:40.246Z")
@Stability(Stable)
public interface GatewayPolicyEngineConfig
extends software.amazon.jsii.JsiiSerializable

Configuration for associating a policy engine with a gateway.

When configured, the policy engine intercepts all agent requests through this gateway and evaluates them against the defined Cedar policies. [disable-awslint:prefer-ref-interface]

Example:

 // Create a Policy engine
 PolicyEngine policyEngine = PolicyEngine.Builder.create(this, "MyPolicyEngine")
         .policyEngineName("my_policy_engine")
         .description("Policy engine for access control")
         .build();
 Gateway gateway = Gateway.Builder.create(this, "MyGateway")
         .gatewayName("my-gateway")
         .policyEngineConfiguration(GatewayPolicyEngineConfig.builder()
                 .policyEngine(policyEngine)
                 .mode(PolicyEngineMode.ENFORCE)
                 .build())
         .build();
 // Add policy to policy engine
 policyEngine.addPolicy("AllowAllActions", AddPolicyOptions.builder()
         .statement(PolicyStatement.fromCedar(String.format("%n    permit(%n      principal,%n      action,%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn())))
         .description("Allow all actions on specific gateway (development)")
         .validationMode(PolicyValidationMode.IGNORE_ALL_FINDINGS)
         .build());
 // you can add multiple policies to the policy engine
 policyEngine.addPolicy("SpecificToolPolicy", AddPolicyOptions.builder()
         .statement(PolicyStatement.fromCedar(String.format("%n    permit(%n      principal is AgentCore::OAuthUser,%n      action == AgentCore::Action::\"WeatherTool__get_forecast\",%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn())))
         .description("Allow specific weather tool access")
         .validationMode(PolicyValidationMode.FAIL_ON_ANY_FINDINGS)
         .build());
 

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	GatewayPolicyEngineConfig.Builder	A builder for GatewayPolicyEngineConfig
static final class	GatewayPolicyEngineConfig.Jsii$Proxy	An implementation for GatewayPolicyEngineConfig

Method Summary

Modifier and Type	Method	Description
static GatewayPolicyEngineConfig.Builder	builder()
default PolicyEngineMode	getMode()	The enforcement mode for the policy engine.
IPolicyEngine	getPolicyEngine()	The policy engine to associate with this gateway.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getPolicyEngine

@Stability(Stable)
@NotNull
IPolicyEngine getPolicyEngine()

The policy engine to associate with this gateway.

[disable-awslint:prefer-ref-interface]

getMode

@Stability(Stable)
@Nullable
default PolicyEngineMode getMode()

The enforcement mode for the policy engine.

• ENFORCE: Actively allows or denies requests based on Cedar policy evaluation.
• LOG_ONLY: Evaluates and logs decisions without enforcing them. Every tool call succeeds regardless of any forbid policy, so this is intended for testing a policy against real traffic and is not recommended for production.

Default: PolicyEngineMode.ENFORCE

builder

@Stability(Stable)
static GatewayPolicyEngineConfig.Builder builder()

Returns:

a GatewayPolicyEngineConfig.Builder of GatewayPolicyEngineConfig