Package software.amazon.awscdk.services.bedrockagentcore

Class PolicyEngineMode

java.lang.Object

software.amazon.jsii.JsiiObject

software.amazon.awscdk.services.bedrockagentcore.PolicyEngineMode

All Implemented Interfaces:

software.amazon.jsii.JsiiSerializable

@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)",
           date="2026-09-10T17:51:40.360Z")
@Stability(Stable)
public class PolicyEngineMode
extends software.amazon.jsii.JsiiObject

The enforcement mode for a policy engine associated with a gateway.

Example:

 // Create a Policy engine
 PolicyEngine policyEngine = PolicyEngine.Builder.create(this, "MyPolicyEngine")
         .policyEngineName("my_policy_engine")
         .description("Policy engine for access control")
         .build();
 Gateway gateway = Gateway.Builder.create(this, "MyGateway")
         .gatewayName("my-gateway")
         .policyEngineConfiguration(GatewayPolicyEngineConfig.builder()
                 .policyEngine(policyEngine)
                 .mode(PolicyEngineMode.ENFORCE)
                 .build())
         .build();
 // Add policy to policy engine
 policyEngine.addPolicy("AllowAllActions", AddPolicyOptions.builder()
         .statement(PolicyStatement.fromCedar(String.format("%n    permit(%n      principal,%n      action,%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn())))
         .description("Allow all actions on specific gateway (development)")
         .validationMode(PolicyValidationMode.IGNORE_ALL_FINDINGS)
         .build());
 // you can add multiple policies to the policy engine
 policyEngine.addPolicy("SpecificToolPolicy", AddPolicyOptions.builder()
         .statement(PolicyStatement.fromCedar(String.format("%n    permit(%n      principal is AgentCore::OAuthUser,%n      action == AgentCore::Action::\"WeatherTool__get_forecast\",%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn())))
         .description("Allow specific weather tool access")
         .validationMode(PolicyValidationMode.FAIL_ON_ANY_FINDINGS)
         .build());
 

Nested Class Summary

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Field Summary

Fields

Modifier and Type	Field	Description
static final PolicyEngineMode	ENFORCE	Enforces decisions by allowing or denying agent operations based on Cedar policies.
static final PolicyEngineMode	LOG_ONLY	Evaluates actions and adds traces but does not enforce decisions.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	PolicyEngineMode(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	PolicyEngineMode(software.amazon.jsii.JsiiObjectRef objRef)

Method Summary

Modifier and Type	Method	Description
String	getValue()	The string value of the policy engine mode.
static PolicyEngineMode	of(String value)	A policy engine mode that this version of the CDK does not model.

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

ENFORCE

@Stability(Stable)
public static final PolicyEngineMode ENFORCE

Enforces decisions by allowing or denying agent operations based on Cedar policies.

LOG_ONLY

@Stability(Stable)
public static final PolicyEngineMode LOG_ONLY

Evaluates actions and adds traces but does not enforce decisions.

Use this mode for testing and validation before enabling enforcement.

Constructor Details

PolicyEngineMode

protected PolicyEngineMode(software.amazon.jsii.JsiiObjectRef objRef)

PolicyEngineMode

protected PolicyEngineMode(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

Method Details

of

@Stability(Stable)
@NotNull
public static PolicyEngineMode of(@NotNull
 String value)

A policy engine mode that this version of the CDK does not model.

Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.

Parameters:

value - the raw mode value to pass to CloudFormation. This parameter is required.

getValue

@Stability(Stable)
@NotNull
public String getValue()

The string value of the policy engine mode.