Package software.amazon.awscdk.services.bedrockagentcore

Interface IPolicyEngine

All Superinterfaces:
software.constructs.IConstruct, software.constructs.IDependable, IEnvironmentAware, IGrantable, IPolicyEngineRef, IResource, software.amazon.jsii.JsiiSerializable
All Known Subinterfaces:
IPolicyEngine.Jsii$Default
All Known Implementing Classes:
IPolicyEngine.Jsii$Proxy, PolicyEngine, PolicyEngineBase
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-10T17:51:40.287Z") @Stability(Stable) public interface IPolicyEngine extends software.amazon.jsii.JsiiSerializable, IResource, IPolicyEngineRef, IGrantable
Contains all properties and methods for both created and imported policy engines.

  • Method Details

    • getPolicyEngineArn

      @Stability(Stable) @NotNull String getPolicyEngineArn()
      The ARN of the policy engine resource.

    • getPolicyEngineId

      @Stability(Stable) @NotNull String getPolicyEngineId()
      The ID of the policy engine.

    • getPolicyEngineName

      @Stability(Stable) @NotNull String getPolicyEngineName()
      The name of the policy engine.

    • getDescription

      @Stability(Stable) @Nullable default String getDescription()
      The description of the policy engine.

    • getKmsKey

      @Stability(Stable) @Nullable default IKey getKmsKey()
      The KMS key used for encryption.

    • grant

      @Stability(Stable) @NotNull Grant grant(@NotNull IGrantable grantee, @NotNull String... actions)
      Grants IAM actions to the IAM Principal.

      Parameters:
      grantee -
      • The IAM principal to grant permissions to.
      This parameter is required.
      actions -
      • The actions to grant.
      This parameter is required.

    • grantEvaluate

      @Stability(Stable) @NotNull Grant grantEvaluate(@NotNull IGrantable grantee)
      Grants permissions to evaluate policies at runtime .

      This is the primary permission needed by Gateway execution roles to evaluate authorization decisions during agent requests. Grant this to roles that need to call AuthorizeAction or PartiallyAuthorizeActions.

      Parameters:
      grantee -
      • The IAM principal to grant evaluation permissions to.
      This parameter is required.

    • grantEvaluateForGateway

      @Stability(Stable) @NotNull Grant grantEvaluateForGateway(@NotNull IGrantable grantee, @NotNull IGateway gateway)
      Grants the full set of permissions required for a gateway execution role to use this policy engine, correctly scoped to both the policy engine and gateway ARNs.

      Per the AWS docs, AuthorizeAction and PartiallyAuthorizeActions require both the policy engine ARN and the gateway ARN as resources, while GetPolicyEngine only needs the policy engine ARN.

      This follows the same pattern as Lambda's grantInvokeVersion(grantee, version).

      Parameters:
      grantee -
      • The IAM principal (gateway execution role) to grant permissions to.
      This parameter is required.
      gateway -
      • The gateway that will use this policy engine [disable-awslint:prefer-ref-interface].
      This parameter is required.

    • grantRead

      @Stability(Stable) @NotNull Grant grantRead(@NotNull IGrantable grantee)
      Grants read permissions on the PolicyEngine.

      This grants runtime read access to policy engine configuration. Use this for monitoring, observability, or read-only administrative roles.

      Parameters:
      grantee -
      • The IAM principal to grant read permissions to.
      This parameter is required.

    • metric

      @Stability(Stable) @NotNull Metric metric(@NotNull String metricName, @Nullable MetricOptions props)
      Return the given named metric for this policy engine.

      Parameters:
      metricName - The name of the metric. This parameter is required.
      props - Optional metric configuration.

    • metric

      @Stability(Stable) @NotNull Metric metric(@NotNull String metricName)
      Return the given named metric for this policy engine.

      Parameters:
      metricName - The name of the metric. This parameter is required.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull Metric metricAuthorizationLatency(@Nullable MetricOptions props)
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

      Parameters:
      props - Optional metric configuration.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull Metric metricAuthorizationLatency()
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

    • metricDeniedRequests

      @Stability(Stable) @NotNull Metric metricDeniedRequests(@Nullable MetricOptions props)
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

      Parameters:
      props - Optional metric configuration.

    • metricDeniedRequests

      @Stability(Stable) @NotNull Metric metricDeniedRequests()
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

    • metricErrors

      @Stability(Stable) @NotNull Metric metricErrors(@Nullable MetricOptions props)
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.

      Parameters:
      props - Optional metric configuration.

    • metricErrors

      @Stability(Stable) @NotNull Metric metricErrors()
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.