feat(agentcore): add L2 constructs for policy and policy engine by dineshSajwan · Pull Request #37238 · aws/aws-cdk

dineshSajwan · 2026-03-12T17:08:34Z

Issue # (if applicable)

Add L2 constructs for Policy and PolicyEngine with type-safe Cedar policy builder
Closes # 37219 .

Reason for this change

This PR adds support for Amazon Bedrock AgentCore Policy and PolicyEngine constructs to enable fine-grained authorization control for Bedrock agents using Cedar policy language. Previously, there was no CDK construct support for creating and managing AgentCore policies, requiring users to manually configure Cedar authorization rules through the console or API calls.

Description of changes

New Constructs Added:

Policy-engine.ts
L2 construct with base class pattern (PolicyEngineBase)
Support for KMS encryption, tags, and descriptions
Import method: PolicyEngine.fromPolicyEngineAttributes()
Convenience method: addPolicy() for attaching policies
Policy.ts -
L2 construct with base class pattern (PolicyBase)
Two ways to define policies:
Raw Cedar: definition property for advanced users
Type-safe builder: PolicyStatement class for guided policy creation
Validation modes: FAIL_ON_ANY_FINDINGS (default) or IGNORE_ALL_FINDINGS
Import method: Policy.fromPolicyAttributes()
PolicyStatement Builder - Type-safe Cedar policy builder
This is required because cedar policy use cedar language . The user has to be well aware of this language when creating raw cedar policy. This statement builder mimic the AWS console Form capability to create a cedar policy which makes it easy for user who are not well versed with cedar language to create cedar policy.

Describe any new or updated permissions being added

PolicyEngine.grantRead()
Actions Granted: bedrock-agentcore:GetPolicyEngine
Use Case: Read policy engine configuration at runtime for monitoring/audit

PolicyEngine.grantEvaluate()
Actions Granted: bedrock-agentcore:GetPolicyEnginebedrock-agentcore:AuthorizeActionbedrock-agentcore:PartiallyAuthorizeActions
Use Case: Evaluate authorization decisions during agent requests

Policy.grantRead()
Actions Granted: bedrock-agentcore:GetPolicy
Use Case: Read individual policy configuration and Cedar statements

Description of how you validated changes

Unit test, Integration test and with a sample CDK APP deployed the policies.

Checklist

[ Y ] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

github-actions · 2026-03-12T17:11:12Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	96 ran	96 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-03-12T17:11:15Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	96 ran	96 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

alvazjor · 2026-04-01T15:44:23Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/perms.ts

+/**
+ * IAM permissions for PolicyEngine runtime operations (data plane)
+ */
+export namespace PolicyEnginePerms {


I think this file will no longer be required, due to the new way of setting grants: https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#grants
But if still needed, then lets drop namespace and use flat exports instead (like in runtime perms, or tools perms)

Namespace - removed.
Autogenerated grant.json - Checked this, the auto-generated grants pattern (grants.json + spec2cdk) doesn't apply to alpha packages, only stable L1 modules get that pipeline.

alvazjor · 2026-04-01T16:16:01Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-base.ts

+   * @param grantee - The IAM principal to grant permissions to
+   * @param actions - The actions to grant
+   */
+  grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;


We are using a new pattern for grants: https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#grants
They are now autogenerated (could be wrong for alpha modules tho, please double check) and the permission are based on the grants.json that needs to be added. Please review the documentation for this new pattern, and let us know if something cannot be applied (due to alpha module, but I am 99% sure it should work)

alvazjor · 2026-04-01T16:18:02Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-base.ts

+ * Minimal reference interface for Policy resources.
+ * Used for resource identification and ARN construction.
+ */
+export interface IPolicyRef {


These IxxxRef classes are autogenerated, there is no need to implement them, just consume them in the IPolicy one. Check this example: https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-mediapackagev2-alpha/lib/channel.ts#L36
Same applies for all other IxxRef I saw in the PR

Done. IPolicy now extends the auto-generated IPolicyRef and IPolicyEngine extends IPolicyEngineRef, both imported from aws-cdk-lib/aws-bedrockagentcore.

alvazjor · 2026-04-01T16:21:37Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-base.ts

+  /**
+   * The ARN of the policy
+   */
+  readonly policyArn: string;


missing @attribute tag?

Added @Attribute tags on the interface properties and the concrete class properties.

alvazjor · 2026-04-01T16:22:37Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-base.ts

+ * Contains methods and attributes valid for Policies either created with CDK or imported.
+ */
+export abstract class PolicyBase extends Resource implements IPolicy {
+  public abstract readonly policyArn: string;


Missing @attribute tag here too? review all attributes are correctly tagged please

Added @Attribute tags on the interface properties and the concrete class properties. Abstract base class properties intentionally don't carry them since CDK tooling resolves them via the interface and concrete implementation.

alvazjor · 2026-04-01T16:27:37Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-engine-base.ts

+   */
+  public grantEvaluateForGateway(grantee: iam.IGrantable, gateway: IGateway): iam.Grant {
+    const getPolicyEngineGrant = this.grant(grantee, 'bedrock-agentcore:GetPolicyEngine');
+    const gatewayResourceName = Token.isUnresolved(gateway.name) ? '*' : `${gateway.name}-*`;


Can't this use the gateway.gatewayArn directly?

Yes , gateway.name is used intentionally to to avoid a circular dependency between PolicyEngine and Gateway. The gateway needs policyengine and the policyengine needs gateway arn. The gateway.gatewayArnis synthesized as a CloudFormation Fn::GetAtt token that references the Gateway resource, and if PolicyEngine tries to reference that ARN directly, it creates a circular dependency that CloudFormation cannot resolve at deploy time.
By using gateway.name with a wildcard suffix, we can construct the necessary ARN pattern without directly referencing the unresolved gateway ARN, thus avoiding the circular dependency while still granting permissions scoped to the correct gateway.

Added JS doc.

alvazjor · 2026-04-01T16:34:02Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/validation-helpers.ts

+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export function validatePolicyEngineName(name: string, scope?: IConstruct): string[] {


For this file in general, any string that is validated needs to also check if its a unresolved token first

alvazjor · 2026-04-01T16:37:53Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-engine.ts

+  public addPolicy(id: string, options: AddPolicyOptions): any {
+    // Import Policy here to avoid circular dependency
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { Policy } = require('./policy');


Not the correct way to add imports. What is the circular dependency?

Bad check in. I used it to fix a false circular dependency . Now removed the bad import created a policy-types.ts file and the false circular dependency was also removed.

alvazjor · 2026-04-01T16:41:03Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-statement.ts

+ * Effect of the policy statement - whether to permit or forbid the action.
+ * @internal
+ */
+enum PolicyEffect {


I think all this enums here potentially can be extended to support new values. Correct me if I am wrong on this. We need to use enum-like instead, to provide the escape hatch if a new value is added but not yet supported in CDK

These are all @internal enumns and the user will not use these. Also we support multiple ways to create the cedar policy, for example PolicyStatement.fromCedar('any raw cedar string you want'); . The user can always use the fromCedar for raw string to support any value. IMHO , I think this should be fine.

…s-cdk into agentcore-policy

dinsajwa and others added 4 commits March 10, 2026 18:41

feat(agentcore): added agent core policy

7b27d55

feat(agentcore): updated policy and policyengine with statements

e1fc311

Merge branch 'aws:main' into agentcore-policy

23073e5

feat(agentcore): updated policy and policyengine with statements

0ad039a

dineshSajwan temporarily deployed to automation March 12, 2026 17:08 — with GitHub Actions Inactive

aws-cdk-automation requested a review from a team March 12, 2026 17:08

github-actions bot added p2 valued-contributor [Pilot] contributed between 6-12 PRs to the CDK labels Mar 12, 2026

dineshSajwan temporarily deployed to automation March 12, 2026 17:08 — with GitHub Actions Inactive

aws-cdk-automation previously requested changes Mar 12, 2026

View reviewed changes

dineshSajwan temporarily deployed to automation March 12, 2026 17:21 — with GitHub Actions Inactive

dineshSajwan temporarily deployed to automation March 12, 2026 17:22 — with GitHub Actions Inactive

dineshSajwan changed the title ~~Agentcore policy~~ feat(agentcore): Add L2 constructs for Policy and PolicyEngine with type-safe Cedar policy builder Mar 12, 2026

dineshSajwan temporarily deployed to automation March 12, 2026 17:35 — with GitHub Actions Inactive

dineshSajwan changed the title ~~feat(agentcore): Add L2 constructs for Policy and PolicyEngine with type-safe Cedar policy builder~~ feat(agentcore): add L2 constructs for policy and policy engine with type-safe cedar policy builder Mar 12, 2026

dineshSajwan temporarily deployed to automation March 12, 2026 17:36 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Mar 12, 2026

aws-cdk-automation temporarily deployed to automation March 12, 2026 17:41 — with GitHub Actions Inactive

Merge branch 'aws:main' into agentcore-policy

df383ae

dineshSajwan temporarily deployed to automation March 26, 2026 16:12 — with GitHub Actions Inactive

pahud mentioned this pull request Mar 26, 2026

Failed CodeBuild CI - 10 PR(s) pahud/aws-cdk#17

Open

Merge branch 'aws:main' into agentcore-policy

bb4969d

fix(policy): resolved circular dependency

b9e2c75

dineshSajwan temporarily deployed to automation March 30, 2026 23:41 — with GitHub Actions Inactive

Merge branch 'main' into agentcore-policy

2c5d716

dineshSajwan temporarily deployed to automation March 30, 2026 23:41 — with GitHub Actions Inactive

dineshSajwan temporarily deployed to automation March 30, 2026 23:42 — with GitHub Actions Inactive

Merge branch 'main' into agentcore-policy

199199b

dineshSajwan temporarily deployed to automation March 31, 2026 14:35 — with GitHub Actions Inactive

alvazjor requested changes Apr 1, 2026

View reviewed changes

alvazjor self-assigned this Apr 1, 2026

Merge branch 'aws:main' into agentcore-policy

e0dd41c

dineshSajwan temporarily deployed to automation April 7, 2026 14:50 — with GitHub Actions Inactive

dinsajwa and others added 2 commits April 8, 2026 16:24

fix(policy): implemented review comments

5f7b5ee

Merge branch 'aws:main' into agentcore-policy

161ad19

dineshSajwan temporarily deployed to automation April 8, 2026 20:25 — with GitHub Actions Inactive

Merge branch 'agentcore-policy' of https://github.com/dineshSajwan/aw…

6d58e68

…s-cdk into agentcore-policy

dineshSajwan temporarily deployed to automation April 8, 2026 20:25 — with GitHub Actions Inactive

dineshSajwan temporarily deployed to automation April 8, 2026 20:26 — with GitHub Actions Inactive

fix(policy): using agteway name instead of arn

217087c

dineshSajwan temporarily deployed to automation April 8, 2026 21:15 — with GitHub Actions Inactive

Merge branch 'aws:main' into agentcore-policy

6e9de12

dineshSajwan temporarily deployed to automation April 9, 2026 14:28 — with GitHub Actions Inactive

chore(policy): fix gateway and policy unit test

0389484

dineshSajwan temporarily deployed to automation April 9, 2026 15:34 — with GitHub Actions Inactive

dineshSajwan temporarily deployed to automation April 9, 2026 15:35 — with GitHub Actions Inactive

Conversation

dineshSajwan commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dineshSajwan Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dineshSajwan commented Mar 12, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

github-actions bot commented Mar 12, 2026 •

edited

Loading

github-actions bot commented Mar 12, 2026 •

edited

Loading

dineshSajwan Apr 8, 2026 •

edited

Loading