PolicyEngineMode

class aws_cdk.aws_bedrockagentcore.PolicyEngineMode(*args: Any, **kwargs)

Bases: object

The enforcement mode for a policy engine associated with a gateway.

ExampleMetadata:

fixture=default infused

Example:

# Create a Policy engine
policy_engine = agentcore.PolicyEngine(self, "MyPolicyEngine",
    policy_engine_name="my_policy_engine",
    description="Policy engine for access control"
)

gateway = agentcore.Gateway(self, "MyGateway",
    gateway_name="my-gateway",
    policy_engine_configuration=agentcore.GatewayPolicyEngineConfig(
        policy_engine=policy_engine,
        mode=agentcore.PolicyEngineMode.ENFORCE
    )
)

# Add policy to policy engine
policy_engine.add_policy("AllowAllActions",
    statement=agentcore.PolicyStatement.from_cedar(f"""
            permit(
              principal,
              action,
              resource == AgentCore::Gateway::"{gateway.gatewayArn}"
            );
          """),
    description="Allow all actions on specific gateway (development)",
    validation_mode=agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS
)

# you can add multiple policies to the policy engine
policy_engine.add_policy("SpecificToolPolicy",
    statement=agentcore.PolicyStatement.from_cedar(f"""
            permit(
              principal is AgentCore::OAuthUser,
              action == AgentCore::Action::"WeatherTool__get_forecast",
              resource == AgentCore::Gateway::"{gateway.gatewayArn}"
            );
          """),
    description="Allow specific weather tool access",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

ENFORCE = <aws_cdk.aws_bedrockagentcore.PolicyEngineMode object>

LOG_ONLY = <aws_cdk.aws_bedrockagentcore.PolicyEngineMode object>

value

The string value of the policy engine mode.

Static Methods

classmethod of(value)

A policy engine mode that this version of the CDK does not model.

Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.

Parameters:

value (str) – the raw mode value to pass to CloudFormation.

Return type:

PolicyEngineMode