Skip to content

/AWS1/IF_BDO=>CREATEPOLICY()

About CreatePolicy

Creates a policy within the AgentCore Policy system. Policies provide real-time, deterministic control over agentic interactions with AgentCore Gateway. Using the Cedar policy language, you can define fine-grained policies that specify which interactions with Gateway tools are permitted based on input parameters and OAuth claims, ensuring agents operate within defined boundaries and business rules. The policy is validated during creation against the Cedar schema generated from the Gateway's tools' input schemas, which defines the available tools, their parameters, and expected data types. This is an asynchronous operation. Use the GetPolicy operation to poll the status field to track completion.

Method Signature

METHODS /AWS1/IF_BDO~CREATEPOLICY
  IMPORTING
    !IV_NAME TYPE /AWS1/BDOPOLICYNAME OPTIONAL
    !IO_DEFINITION TYPE REF TO /AWS1/CL_BDOPOLICYDEFINITION OPTIONAL
    !IV_DESCRIPTION TYPE /AWS1/BDODESCRIPTION OPTIONAL
    !IV_VALIDATIONMODE TYPE /AWS1/BDOPOLICYVALIDATIONMODE OPTIONAL
    !IV_POLICYENGINEID TYPE /AWS1/BDORESOURCEID OPTIONAL
    !IV_CLIENTTOKEN TYPE /AWS1/BDOCLIENTTOKEN OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_bdocreatepolicyrsp
  RAISING
    /AWS1/CX_BDOACCESSDENIEDEX
    /AWS1/CX_BDOCONFLICTEXCEPTION
    /AWS1/CX_BDOINTERNALSERVEREX
    /AWS1/CX_BDORESOURCENOTFOUNDEX
    /AWS1/CX_BDOSERVICEQUOTAEXCDEX
    /AWS1/CX_BDOTHROTTLINGEX
    /AWS1/CX_BDOVALIDATIONEX
    /AWS1/CX_BDOCLIENTEXC
    /AWS1/CX_BDOSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_name TYPE /AWS1/BDOPOLICYNAME /AWS1/BDOPOLICYNAME

The customer-assigned immutable name for the policy. Must be unique within the account. This name is used for policy identification and cannot be changed after creation.

io_definition TYPE REF TO /AWS1/CL_BDOPOLICYDEFINITION /AWS1/CL_BDOPOLICYDEFINITION

The Cedar policy statement that defines the access control rules. This contains the actual policy logic written in Cedar policy language, specifying effect (permit or forbid), principals, actions, resources, and conditions for agent behavior control.

iv_policyengineid TYPE /AWS1/BDORESOURCEID /AWS1/BDORESOURCEID

The identifier of the policy engine which contains this policy. Policy engines group related policies and provide the execution context for policy evaluation.

Optional arguments:

iv_description TYPE /AWS1/BDODESCRIPTION /AWS1/BDODESCRIPTION

A human-readable description of the policy's purpose and functionality (1-4,096 characters). This helps policy administrators understand the policy's intent, business rules, and operational scope. Use this field to document why the policy exists, what business requirement it addresses, and any special considerations for maintenance. Clear descriptions are essential for policy governance, auditing, and troubleshooting.

iv_validationmode TYPE /AWS1/BDOPOLICYVALIDATIONMODE /AWS1/BDOPOLICYVALIDATIONMODE

The validation mode for the policy creation. Determines how Cedar analyzer validation results are handled during policy creation. FAIL_ON_ANY_FINDINGS (default) runs the Cedar analyzer to validate the policy against the Cedar schema and tool context, failing creation if the analyzer detects any validation issues to ensure strict conformance. IGNORE_ALL_FINDINGS runs the Cedar analyzer but allows policy creation even if validation issues are detected, useful for testing or when the policy schema is evolving. Use FAIL_ON_ANY_FINDINGS for production policies to ensure correctness, and IGNORE_ALL_FINDINGS only when you understand and accept the analyzer findings.

iv_clienttoken TYPE /AWS1/BDOCLIENTTOKEN /AWS1/BDOCLIENTTOKEN

A unique, case-sensitive identifier to ensure the idempotency of the request. The AWS SDK automatically generates this token, so you don't need to provide it in most cases. If you retry a request with the same client token, the service returns the same response without creating a duplicate policy.

RETURNING

oo_output TYPE REF TO /aws1/cl_bdocreatepolicyrsp /AWS1/CL_BDOCREATEPOLICYRSP

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->createpolicy(
  io_definition = new /aws1/cl_bdopolicydefinition( new /aws1/cl_bdocedarpolicy( |string| ) )
  iv_clienttoken = |string|
  iv_description = |string|
  iv_name = |string|
  iv_policyengineid = |string|
  iv_validationmode = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_resourceid = lo_result->get_policyid( ).
  lv_policyname = lo_result->get_name( ).
  lv_resourceid = lo_result->get_policyengineid( ).
  lo_policydefinition = lo_result->get_definition( ).
  IF lo_policydefinition IS NOT INITIAL.
    lo_cedarpolicy = lo_policydefinition->get_cedar( ).
    IF lo_cedarpolicy IS NOT INITIAL.
      lv_statement = lo_cedarpolicy->get_statement( ).
    ENDIF.
  ENDIF.
  lv_description = lo_result->get_description( ).
  lv_datetimestamp = lo_result->get_createdat( ).
  lv_datetimestamp = lo_result->get_updatedat( ).
  lv_policyarn = lo_result->get_policyarn( ).
  lv_policystatus = lo_result->get_status( ).
  LOOP AT lo_result->get_statusreasons( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_string = lo_row_1->get_value( ).
    ENDIF.
  ENDLOOP.
ENDIF.