Package software.amazon.awscdk.services.bedrockagentcore

Class PolicyEngineBase

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.Resource
software.amazon.awscdk.services.bedrockagentcore.PolicyEngineBase
All Implemented Interfaces:
IPolicyEngineRef, IEnvironmentAware, IResource, IPolicyEngine, IGrantable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
Direct Known Subclasses:
PolicyEngine
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-10T17:51:40.358Z") @Stability(Stable) public abstract class PolicyEngineBase extends Resource implements IPolicyEngine
Abstract base class for a PolicyEngine.

Contains methods and attributes valid for PolicyEngines either created with CDK or imported.

  • Constructor Details

    • PolicyEngineBase

      protected PolicyEngineBase(software.amazon.jsii.JsiiObjectRef objRef)

    • PolicyEngineBase

      protected PolicyEngineBase(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • PolicyEngineBase

      @Stability(Stable) protected PolicyEngineBase(@NotNull software.constructs.Construct scope, @NotNull String id, @Nullable ResourceProps props)
      Parameters:
      scope - This parameter is required.
      id - This parameter is required.
      props -

    • PolicyEngineBase

      @Stability(Stable) protected PolicyEngineBase(@NotNull software.constructs.Construct scope, @NotNull String id)
      Parameters:
      scope - This parameter is required.
      id - This parameter is required.

  • Method Details

    • grant

      @Stability(Stable) @NotNull public Grant grant(@NotNull IGrantable grantee, @NotNull String... actions)
      Grants IAM actions to the IAM Principal.

      [disable-awslint:no-grants]

      Specified by:
      grant in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant permissions to.
      This parameter is required.
      actions -
      • The actions to grant.
      This parameter is required.
      Returns:
      An IAM Grant object representing the granted permissions

    • grantEvaluate

      @Stability(Stable) @NotNull public Grant grantEvaluate(@NotNull IGrantable grantee)
      Grants permissions to evaluate policies at runtime (data plane operations).

      This is the primary permission needed by Gateway execution roles to evaluate authorization decisions during agent requests. Grant this to roles that need to call AuthorizeAction or PartiallyAuthorizeActions at runtime.

      [disable-awslint:no-grants]

      Specified by:
      grantEvaluate in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant evaluation permissions to.
      This parameter is required.
      Returns:
      An IAM Grant object representing the granted permissions

    • grantEvaluateForGateway

      @Stability(Stable) @NotNull public Grant grantEvaluateForGateway(@NotNull IGrantable grantee, @NotNull IGateway gateway)
      Grants the full set of permissions required for a gateway execution role to use this policy engine, correctly scoped to both the policy engine and gateway ARNs.

      Per the AWS docs:

      • GetPolicyEngine → policy engine ARN only
      • AuthorizeAction + PartiallyAuthorizeActions → policy engine ARN and gateway ARN

      [disable-awslint:no-grants]

      Specified by:
      grantEvaluateForGateway in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal (gateway execution role) to grant permissions to.
      This parameter is required.
      gateway -
      • The gateway that will use this policy engine [disable-awslint:prefer-ref-interface].
      This parameter is required.
      Returns:
      A combined IAM Grant representing all granted permissions

    • grantRead

      @Stability(Stable) @NotNull public Grant grantRead(@NotNull IGrantable grantee)
      Grants read permissions on the PolicyEngine (data plane).

      This grants runtime read access to policy engine configuration. Use this for monitoring, observability, or read-only administrative roles that need to inspect policy engine settings at runtime.

      [disable-awslint:no-grants]

      Specified by:
      grantRead in interface IPolicyEngine
      Parameters:
      grantee -
      • The IAM principal to grant read permissions to.
      This parameter is required.
      Returns:
      An IAM Grant object representing the granted permissions

    • metric

      @Stability(Stable) @NotNull public Metric metric(@NotNull String metricName, @Nullable MetricOptions props)
      Return the given named metric for this policy engine.

      By default, the metric will be calculated as a sum over a period of 5 minutes. You can customize this by using the statistic and period properties.

      Specified by:
      metric in interface IPolicyEngine
      Parameters:
      metricName - The name of the metric. This parameter is required.
      props - Optional metric configuration.

    • metric

      @Stability(Stable) @NotNull public Metric metric(@NotNull String metricName)
      Return the given named metric for this policy engine.

      By default, the metric will be calculated as a sum over a period of 5 minutes. You can customize this by using the statistic and period properties.

      Specified by:
      metric in interface IPolicyEngine
      Parameters:
      metricName - The name of the metric. This parameter is required.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull public Metric metricAuthorizationLatency(@Nullable MetricOptions props)
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

      Specified by:
      metricAuthorizationLatency in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricAuthorizationLatency

      @Stability(Stable) @NotNull public Metric metricAuthorizationLatency()
      Return a metric measuring the authorization latency for this policy engine.

      This metric represents the time taken to evaluate authorization policies.

      Specified by:
      metricAuthorizationLatency in interface IPolicyEngine

    • metricAuthorizations

      @Stability(Stable) @NotNull public Metric metricAuthorizations(@Nullable MetricOptions props)
      Return a metric containing the total number of authorizations for this policy engine.

      This metric tracks all authorization requests processed by the policy engine.

      Parameters:
      props - Optional metric configuration.

    • metricAuthorizations

      @Stability(Stable) @NotNull public Metric metricAuthorizations()
      Return a metric containing the total number of authorizations for this policy engine.

      This metric tracks all authorization requests processed by the policy engine.

    • metricDeniedRequests

      @Stability(Stable) @NotNull public Metric metricDeniedRequests(@Nullable MetricOptions props)
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

      Specified by:
      metricDeniedRequests in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricDeniedRequests

      @Stability(Stable) @NotNull public Metric metricDeniedRequests()
      Return a metric containing the number of denied authorization requests for this policy engine.

      This metric tracks authorization requests that were explicitly denied by policies.

      Specified by:
      metricDeniedRequests in interface IPolicyEngine

    • metricErrors

      @Stability(Stable) @NotNull public Metric metricErrors(@Nullable MetricOptions props)
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.

      Specified by:
      metricErrors in interface IPolicyEngine
      Parameters:
      props - Optional metric configuration.

    • metricErrors

      @Stability(Stable) @NotNull public Metric metricErrors()
      Return a metric containing the number of errors during authorization for this policy engine.

      This metric tracks errors encountered during policy evaluation.

      Specified by:
      metricErrors in interface IPolicyEngine

    • getGrantPrincipal

      @Stability(Stable) @NotNull public abstract IPrincipal getGrantPrincipal()
      The principal to grant permissions to.
      Specified by:
      getGrantPrincipal in interface IGrantable

    • getPolicyEngineArn

      @Stability(Stable) @NotNull public abstract String getPolicyEngineArn()
      The ARN of the policy engine resource.
      Specified by:
      getPolicyEngineArn in interface IPolicyEngine

    • getPolicyEngineId

      @Stability(Stable) @NotNull public abstract String getPolicyEngineId()
      The ID of the policy engine.
      Specified by:
      getPolicyEngineId in interface IPolicyEngine

    • getPolicyEngineName

      @Stability(Stable) @NotNull public abstract String getPolicyEngineName()
      The name of the policy engine.
      Specified by:
      getPolicyEngineName in interface IPolicyEngine

    • getPolicyEngineRef

      @Stability(Stable) @NotNull public PolicyEngineReference getPolicyEngineRef()
      A reference to this PolicyEngine resource.
      Specified by:
      getPolicyEngineRef in interface IPolicyEngineRef

    • getDescription

      @Stability(Stable) @Nullable public abstract String getDescription()
      The description of the policy engine.
      Specified by:
      getDescription in interface IPolicyEngine

    • getKmsKey

      @Stability(Stable) @Nullable public abstract IKey getKmsKey()
      The KMS key used for encryption.
      Specified by:
      getKmsKey in interface IPolicyEngine