Package software.amazon.awscdk.services.bedrockagentcore

Interface IPolicyEngine.Jsii$Default

All Superinterfaces:
software.constructs.IConstruct, software.constructs.IConstruct.Jsii$Default, software.constructs.IDependable, software.constructs.IDependable.Jsii$Default, IEnvironmentAware, IEnvironmentAware.Jsii$Default, IGrantable, IGrantable.Jsii$Default, IPolicyEngine, IPolicyEngineRef, IPolicyEngineRef.Jsii$Default, IResource, IResource.Jsii$Default, software.amazon.jsii.JsiiSerializable
All Known Implementing Classes:
IPolicyEngine.Jsii$Proxy
Enclosing interface:
IPolicyEngine
@Internal public static interface IPolicyEngine.Jsii$Default extends IPolicyEngine, IResource.Jsii$Default, IPolicyEngineRef.Jsii$Default, IGrantable.Jsii$Default
Internal default implementation for IPolicyEngine.

  • Method Details

    • getPolicyEngineArn

      @Stability(Stable) @NotNull default String getPolicyEngineArn()
      The ARN of the policy engine resource.
      Specified by:
      getPolicyEngineArn in interface IPolicyEngine

    • getPolicyEngineId

      @Stability(Stable) @NotNull default String getPolicyEngineId()
      The ID of the policy engine.
      Specified by:
      getPolicyEngineId in interface IPolicyEngine

    • getPolicyEngineName

      @Stability(Stable) @NotNull default String getPolicyEngineName()
      The name of the policy engine.
      Specified by:
      getPolicyEngineName in interface IPolicyEngine

    • getDescription

      @Stability(Stable) @Nullable default String getDescription()
      The description of the policy engine.
      Specified by:
      getDescription in interface IPolicyEngine

    • getKmsKey

      @Stability(Stable) @Nullable default IKey getKmsKey()
      The KMS key used for encryption.
      Specified by:
      getKmsKey in interface IPolicyEngine

    • grant

      @Stability(Stable) @NotNull default Grant grant(@NotNull IGrantable grantee, @NotNull String... actions)
      Grants IAM actions to the IAM Principal.

      Specified by:
      grant in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant permissions to.
      This parameter is required.
      actions -
      • The actions to grant.
      This parameter is required.

    • grantEvaluate

      @Stability(Stable) @NotNull default Grant grantEvaluate(@NotNull IGrantable grantee)
      Grants permissions to evaluate policies at runtime .

      This is the primary permission needed by Gateway execution roles to evaluate authorization decisions during agent requests. Grant this to roles that need to call AuthorizeAction or PartiallyAuthorizeActions.

      Specified by:
      grantEvaluate in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant evaluation permissions to.
      This parameter is required.

    • grantEvaluateForGateway

      @Stability(Stable) @NotNull default Grant grantEvaluateForGateway(@NotNull IGrantable grantee, @NotNull IGateway gateway)
      Grants the full set of permissions required for a gateway execution role to use this policy engine, correctly scoped to both the policy engine and gateway ARNs.

      Per the AWS docs, AuthorizeAction and PartiallyAuthorizeActions require both the policy engine ARN and the gateway ARN as resources, while GetPolicyEngine only needs the policy engine ARN.

      This follows the same pattern as Lambda's grantInvokeVersion(grantee, version).

      Specified by:
      grantEvaluateForGateway in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal (gateway execution role) to grant permissions to.
      This parameter is required.
      gateway -
      • The gateway that will use this policy engine [disable-awslint:prefer-ref-interface].
      This parameter is required.

    • grantRead

      @Stability(Stable) @NotNull default Grant grantRead(@NotNull IGrantable grantee)
      Grants read permissions on the PolicyEngine.

      This grants runtime read access to policy engine configuration. Use this for monitoring, observability, or read-only administrative roles.

      Specified by:
      grantRead in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant read permissions to.
      This parameter is required.

    • metric

      @Stability(Stable) @NotNull default Metric metric(@NotNull String metricName, @Nullable MetricOptions props)
      Return the given named metric for this policy engine.

      Specified by:
      metric in interface IPolicyEngine
      Parameters:
      metricName - The name of the metric. This parameter is required.
      props - Optional metric configuration.

    • metric

      @Stability(Stable) @NotNull default Metric metric(@NotNull String metricName)
      Return the given named metric for this policy engine.

      Specified by:
      metric in interface IPolicyEngine
      Parameters:
      metricName - The name of the metric. This parameter is required.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull default Metric metricAuthorizationLatency(@Nullable MetricOptions props)
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

      Specified by:
      metricAuthorizationLatency in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull default Metric metricAuthorizationLatency()
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

      Specified by:
      metricAuthorizationLatency in interface IPolicyEngine

    • metricDeniedRequests

      @Stability(Stable) @NotNull default Metric metricDeniedRequests(@Nullable MetricOptions props)
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

      Specified by:
      metricDeniedRequests in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricDeniedRequests

      @Stability(Stable) @NotNull default Metric metricDeniedRequests()
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

      Specified by:
      metricDeniedRequests in interface IPolicyEngine

    • metricErrors

      @Stability(Stable) @NotNull default Metric metricErrors(@Nullable MetricOptions props)
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.

      Specified by:
      metricErrors in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricErrors

      @Stability(Stable) @NotNull default Metric metricErrors()
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.

      Specified by:
      metricErrors in interface IPolicyEngine