Package software.amazon.awscdk.services.bedrockagentcore

Class PolicyEngine

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.Resource
software.amazon.awscdk.services.bedrockagentcore.PolicyEngineBase
software.amazon.awscdk.services.bedrockagentcore.PolicyEngine
All Implemented Interfaces:
IPolicyEngineRef, IEnvironmentAware, IResource, IPolicyEngine, IGrantable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-10T17:51:40.357Z") @Stability(Stable) public class PolicyEngine extends PolicyEngineBase
Container that manages Cedar authorization policies associated with gateways.

PolicyEngine enables deterministic authorization control for Bedrock agents, allowing fine-grained access control to tools and actions via Cedar policy language.

Example: 

 IPolicyEngine importedEngine = PolicyEngine.fromPolicyEngineAttributes(this, "ImportedEngine", PolicyEngineAttributes.builder()
         .policyEngineArn("policy-engine/my-engine-id")
         .build());
 IPolicy importedPolicy = Policy.fromPolicyAttributes(this, "ImportedPolicy", PolicyAttributes.builder()
         .policyArn("my-policy-arn")
         .policyEngine(importedEngine)
         .build());
 // Grant permissions to the imported policy
 Role role = Role.Builder.create(this, "PolicyRole")
         .assumedBy(new ServicePrincipal("lambda.amazonaws.com"))
         .build();
 importedPolicy.grantRead(role);

See Also:

  • Field Details

    • PROPERTY_INJECTION_ID

      @Stability(Stable) public static final String PROPERTY_INJECTION_ID
      Uniquely identifies this class.

  • Constructor Details

    • PolicyEngine

      protected PolicyEngine(software.amazon.jsii.JsiiObjectRef objRef)

    • PolicyEngine

      protected PolicyEngine(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • PolicyEngine

      @Stability(Stable) public PolicyEngine(@NotNull software.constructs.Construct scope, @NotNull String id, @Nullable PolicyEngineProps props)
      Parameters:
      scope - This parameter is required.
      id - This parameter is required.
      props -

    • PolicyEngine

      @Stability(Stable) public PolicyEngine(@NotNull software.constructs.Construct scope, @NotNull String id)
      Parameters:
      scope - This parameter is required.
      id - This parameter is required.

  • Method Details

    • fromPolicyEngineAttributes

      @Stability(Stable) @NotNull public static IPolicyEngine fromPolicyEngineAttributes(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull PolicyEngineAttributes attrs)
      Creates a PolicyEngine reference from an existing policy engine's attributes.

      Parameters:
      scope -
      • The construct scope.
      This parameter is required.
      id -
      • Identifier of the construct.
      This parameter is required.
      attrs -
      • Attributes of the existing policy engine.
      This parameter is required.
      Returns:
      An IPolicyEngine reference to the existing policy engine

    • addPolicy

      @Stability(Stable) @NotNull public Policy addPolicy(@NotNull String id, @NotNull AddPolicyOptions options)
      Add a policy to this policy engine. Convenience method that creates a Policy construct with this engine as the parent.

      Automatic Sequential Chaining: By default, policies are automatically chained sequentially to prevent concurrent creation issues with the AWS Bedrock AgentCore service. Each new policy will depend on the previous policy added to this engine.

      This ensures policies are created one at a time, avoiding "Resource stabilization failed" errors that occur with concurrent policy operations.

      Parameters:
      id -
      • Unique identifier for the policy construct.
      This parameter is required.
      options -
      • Options for creating the policy.
      This parameter is required.
      Returns:
      The created Policy construct

    • getGrantPrincipal

      @Stability(Stable) @NotNull public IPrincipal getGrantPrincipal()
      The principal to grant permissions to.
      Specified by:
      getGrantPrincipal in interface IGrantable
      Specified by:
      getGrantPrincipal in class PolicyEngineBase

    • getPolicies

      @Stability(Stable) @NotNull public List<Policy> getPolicies()
      Get the list of policies added to this policy engine.

      Returns an array of Policy constructs that were added using addPolicy(). This allows you to iterate over all policies associated with this engine.

      Returns:
      A copy of the policies array

    • getPolicyEngineArn

      @Stability(Stable) @NotNull public String getPolicyEngineArn()
      The ARN of the policy engine resource.
      Specified by:
      getPolicyEngineArn in interface IPolicyEngine
      Specified by:
      getPolicyEngineArn in class PolicyEngineBase

    • getPolicyEngineId

      @Stability(Stable) @NotNull public String getPolicyEngineId()
      The ID of the policy engine.
      Specified by:
      getPolicyEngineId in interface IPolicyEngine
      Specified by:
      getPolicyEngineId in class PolicyEngineBase

    • getPolicyEngineName

      @Stability(Stable) @NotNull public String getPolicyEngineName()
      The name of the policy engine.

      [disable-awslint:attribute-tag]

      Specified by:
      getPolicyEngineName in interface IPolicyEngine
      Specified by:
      getPolicyEngineName in class PolicyEngineBase

    • getDescription

      @Stability(Stable) @Nullable public String getDescription()
      The description of the policy engine.
      Specified by:
      getDescription in interface IPolicyEngine
      Specified by:
      getDescription in class PolicyEngineBase

    • getKmsKey

      @Stability(Stable) @Nullable public IKey getKmsKey()
      The KMS key used to encrypt the policy engine.
      Specified by:
      getKmsKey in interface IPolicyEngine
      Specified by:
      getKmsKey in class PolicyEngineBase

    • getTags

      @Stability(Stable) @Nullable public Map<String,String> getTags()
      Tags applied to this policy engine resource.

      Default: - No tags applied