CfnPolicyStoreProps

class aws_cdk.aws_verifiedpermissions.CfnPolicyStoreProps(*, validation_settings, deletion_protection=None, description=None, schema=None, tags=None)

Bases: object

Properties for defining a CfnPolicyStore.

Parameters:

validation_settings (Union[IResolvable, ValidationSettingsProperty, Dict[str, Any]]) –
Specifies the validation setting for this policy store. Currently, the only valid and required value is Mode . .. epigraph:: We recommend that you turn on STRICT mode only after you define a schema. If a schema doesn’t exist, then STRICT mode causes any policy to fail validation, and Verified Permissions rejects the policy. You can turn off validation by using the UpdatePolicyStore . Then, when you have a schema defined, use UpdatePolicyStore again to turn validation back on.
deletion_protection (Union[IResolvable, DeletionProtectionProperty, Dict[str, Any], None]) – Specifies whether the policy store can be deleted. If enabled, the policy store can’t be deleted. The default state is DISABLED .
description (Optional[str]) – Descriptive text that you can provide to help with identification of the current policy store.
schema (Union[IResolvable, SchemaDefinitionProperty, Dict[str, Any], None]) – Creates or updates the policy schema in a policy store. Cedar can use the schema to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.
tags (Optional[Sequence[Union[CfnTag, Dict[str, Any]]]]) – The list of key-value pairs to associate with the policy store.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_verifiedpermissions as verifiedpermissions

cfn_policy_store_props = verifiedpermissions.CfnPolicyStoreProps(
    validation_settings=verifiedpermissions.CfnPolicyStore.ValidationSettingsProperty(
        mode="mode"
    ),

    # the properties below are optional
    deletion_protection=verifiedpermissions.CfnPolicyStore.DeletionProtectionProperty(
        mode="mode"
    ),
    description="description",
    schema=verifiedpermissions.CfnPolicyStore.SchemaDefinitionProperty(
        cedar_json="cedarJson"
    ),
    tags=[CfnTag(
        key="key",
        value="value"
    )]
)

Attributes

deletion_protection

Specifies whether the policy store can be deleted. If enabled, the policy store can’t be deleted.

The default state is DISABLED .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-deletionprotection

description

Descriptive text that you can provide to help with identification of the current policy store.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-description

schema

Creates or updates the policy schema in a policy store.

Cedar can use the schema to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-schema

tags

The list of key-value pairs to associate with the policy store.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-tags

validation_settings

Specifies the validation setting for this policy store.

Currently, the only valid and required value is Mode . .. epigraph:

We recommend that you turn on ``STRICT`` mode only after you define a schema. If a schema doesn't exist, then ``STRICT`` mode causes any policy to fail validation, and Verified Permissions rejects the policy. You can turn off validation by using the `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ . Then, when you have a schema defined, use `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ again to turn validation back on.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-validationsettings