PolicyCondition

class aws_cdk.aws_bedrockagentcore.PolicyCondition(*args: Any, **kwargs)

Bases: object

A condition on a policy statement.

A condition compares a request attribute against a value. Conditions are grouped into the when and unless clauses of a statement, where the members of a clause must all hold.

Comparisons are named for the type of value they accept, so each one takes a concrete type rather than a union. Use allOf and anyOf to build a nested boolean expression, which also makes the grouping explicit in the generated Cedar.

Example:

from aws_cdk.aws_bedrockagentcore import PolicyAttribute, PolicyCondition


# principal.department == "Engineering"
PolicyCondition.string_equals(PolicyAttribute.principal("department"), "Engineering")

# (principal.department == "Engineering" || principal.department == "Support")
PolicyCondition.any_of([
    PolicyCondition.string_equals(PolicyAttribute.principal("department"), "Engineering"),
    PolicyCondition.string_equals(PolicyAttribute.principal("department"), "Support")
])

Static Methods

classmethod all_of(conditions)

All of the given conditions must hold.

Renders as a parenthesised && group, so it can be nested inside anyOf without relying on operator precedence.

Parameters:

conditions (Sequence[PolicyCondition]) –

  • The conditions to combine, at least one.

Return type:

PolicyCondition

classmethod any_of(conditions)

At least one of the given conditions must hold.

Renders as a parenthesised || group, so it can be nested inside allOf or combined with the surrounding clause without relying on operator precedence.

Parameters:

conditions (Sequence[PolicyCondition]) –

  • The conditions to combine, at least one.

Return type:

PolicyCondition

classmethod boolean_equals(attribute, value)

The attribute equals a boolean value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (bool) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod ip_in_range(attribute, cidr)

The attribute is an IP address inside the given CIDR range.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute holding an IP address.

  • cidr (str) –

    • The range in CIDR notation, for example ‘192.168.1.0/24’.

Return type:

PolicyCondition

classmethod number_equals(attribute, value)

The attribute equals a number value.

Cedar whole numbers are 64-bit signed integers, so the value must be an integer.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod number_greater_than(attribute, value)

The attribute is greater than a number value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod number_greater_than_or_equals(attribute, value)

The attribute is greater than or equal to a number value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod number_in(attribute, values)

The attribute is one of the given number values.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • values (Sequence[Union[int, float]]) –

    • The allowed values, at least one.

Return type:

PolicyCondition

classmethod number_less_than(attribute, value)

The attribute is less than a number value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod number_less_than_or_equals(attribute, value)

The attribute is less than or equal to a number value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod number_not_equals(attribute, value)

The attribute does not equal a number value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (Union[int, float]) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod set_contains(attribute, value)

The attribute is a set that contains the given value.

Use this when the attribute itself holds a set, for example principal.groups. To test a scalar attribute against a list of allowed values, use stringIn or numberIn instead.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute holding a set.

  • value (str) –

    • The member to look for.

Return type:

PolicyCondition

classmethod string_equals(attribute, value)

The attribute equals a string value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (str) –

    • The value to compare against.

Return type:

PolicyCondition

classmethod string_in(attribute, values)

The attribute is one of the given string values.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • values (Sequence[str]) –

    • The allowed values, at least one.

Return type:

PolicyCondition

classmethod string_not_equals(attribute, value)

The attribute does not equal a string value.

Parameters:

  • attribute (PolicyAttribute) –

    • The attribute to compare.

  • value (str) –

    • The value to compare against.

Return type:

PolicyCondition