AddPolicyOptions

class aws_cdk.aws_bedrockagentcore.AddPolicyOptions(*, statement, description=None, policy_name=None, validation_mode=None)

Bases: object

Options for adding a policy via PolicyEngine.addPolicy().

Parameters:

statement (PolicyStatement) – The Cedar policy statement for this policy. Build a type-safe statement with the PolicyStatement factories, or use PolicyStatement.fromCedar('...') for raw Cedar. Raw Cedar is treated as trusted input: the module does not escape, quote, or validate it.
description (Optional[str]) – Optional description for the policy (max 4,096 characters). Default: - No description
policy_name (Optional[str]) – The name of the policy. Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters Default: - Auto-generated unique name
validation_mode (Optional[PolicyValidationMode]) – Validation mode for the policy. Default: PolicyValidationMode.FAIL_ON_ANY_FINDINGS

ExampleMetadata:

fixture=default infused

Example:

# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow specific tool actions on specific gateway
# Action names follow pattern: "ToolName__operation"
policy_engine.add_policy("SpecificToolPolicy",
    statement=agentcore.PolicyStatement(
        effect=agentcore.PolicyEffect.PERMIT,
        principal=agentcore.PolicyPrincipal.entity_type("AgentCore::OAuthUser"),
        action=agentcore.PolicyAction.any_of(["AgentCore::Action::WeatherTool__get_forecast", "AgentCore::Action::WeatherTool__get_current"
        ]),
        resource=agentcore.PolicyResource.instance("AgentCore::Gateway", gateway.gateway_arn)
    ),
    description="Allow specific weather tool operations",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

description

Optional description for the policy (max 4,096 characters).

Default:

No description

policy_name

The name of the policy.

Valid characters: a-z, A-Z, 0-9, _ (underscore) Must start with a letter, 1-48 characters

Default:

Auto-generated unique name

statement

The Cedar policy statement for this policy.

Build a type-safe statement with the PolicyStatement factories, or use PolicyStatement.fromCedar('...') for raw Cedar. Raw Cedar is treated as trusted input: the module does not escape, quote, or validate it.

validation_mode

Validation mode for the policy.

Default:: PolicyValidationMode.FAIL_ON_ANY_FINDINGS