PolicyValidationMode

class aws_cdk.aws_bedrockagentcore.PolicyValidationMode(*args: Any, **kwargs)

Bases: object

Validation mode for Cedar policy definitions.

ExampleMetadata:: fixture=default infused

Example:

# policy_engine: agentcore.PolicyEngine
# gateway: agentcore.Gateway


# Allow access unless the user is suspended
policy_with_unless = agentcore.Policy(self, "UnlessPolicy",
    policy_engine=policy_engine,
    policy_name="unless_suspended",
    statement=agentcore.PolicyStatement(
        effect=agentcore.PolicyEffect.PERMIT,
        principal=agentcore.PolicyPrincipal.entity_type("AgentCore::OAuthUser"),
        action=agentcore.PolicyAction.any(),
        resource=agentcore.PolicyResource.instance("AgentCore::Gateway", gateway.gateway_arn),
        unless=[
            agentcore.PolicyCondition.boolean_equals(
                agentcore.PolicyAttribute.principal("suspended"), True)
        ]
    ),
    description="Allow all actions unless user is suspended",
    validation_mode=agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS
)

Attributes

FAIL_ON_ANY_FINDINGS = <aws_cdk.aws_bedrockagentcore.PolicyValidationMode object>

IGNORE_ALL_FINDINGS = <aws_cdk.aws_bedrockagentcore.PolicyValidationMode object>

value: The string value of the validation mode.

Static Methods

classmethod of(value)

A validation mode that this version of the CDK does not model.

Prefer the static members above. Use this when the service has added a mode that the CDK has no member for yet: the CloudFormation registry schemas that validate the synthesized template ship with aws-cdk-lib and refresh on release, while the members above are added by hand, so a released CDK can accept a mode before it models one.

Parameters:: value (str) – the raw validation mode value to pass to CloudFormation.
Return type:: PolicyValidationMode