Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. AWS
  4. API Docs
  5. bedrock
  6. AgentcorePolicy
Viewing docs for AWS v7.34.0
published on Tuesday, Jun 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.bedrock.AgentcorePolicy

aws logo
Viewing docs for AWS v7.34.0
published on Tuesday, Jun 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS Bedrock AgentCore Policy. A Policy attaches Cedar authorization rules to a Policy Engine, which evaluates them at runtime to control agent access to resources.

    Example Usage

    Cedar Policy

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcorePolicy("example", {
    name: "example_policy",
    policyEngineId: exampleAwsBedrockagentcorePolicyEngine.policyEngineId,
    description: "Allow read access to example resources",
    definition: {
        cedar: {
            statement: "permit(principal, action == Action::\\\"Read\\\", resource);\n",
        },
    },
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcorePolicy("example",
    name="example_policy",
    policy_engine_id=example_aws_bedrockagentcore_policy_engine["policyEngineId"],
    description="Allow read access to example resources",
    definition={
        "cedar": {
            "statement": "permit(principal, action == Action::\\\"Read\\\", resource);\n",
        },
    })

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcorePolicy(ctx, "example", &bedrock.AgentcorePolicyArgs{
			Name:           pulumi.String("example_policy"),
			PolicyEngineId: pulumi.Any(exampleAwsBedrockagentcorePolicyEngine.PolicyEngineId),
			Description:    pulumi.String("Allow read access to example resources"),
			Definition: &bedrock.AgentcorePolicyDefinitionArgs{
				Cedar: &bedrock.AgentcorePolicyDefinitionCedarArgs{
					Statement: pulumi.String("permit(principal, action == Action::\\\"Read\\\", resource);\n"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcorePolicy("example", new()
    {
        Name = "example_policy",
        PolicyEngineId = exampleAwsBedrockagentcorePolicyEngine.PolicyEngineId,
        Description = "Allow read access to example resources",
        Definition = new Aws.Bedrock.Inputs.AgentcorePolicyDefinitionArgs
        {
            Cedar = new Aws.Bedrock.Inputs.AgentcorePolicyDefinitionCedarArgs
            {
                Statement = @"permit(principal, action == Action::\""Read\"", resource);
",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcorePolicy;
import com.pulumi.aws.bedrock.AgentcorePolicyArgs;
import com.pulumi.aws.bedrock.inputs.AgentcorePolicyDefinitionArgs;
import com.pulumi.aws.bedrock.inputs.AgentcorePolicyDefinitionCedarArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcorePolicy("example", AgentcorePolicyArgs.builder()
            .name("example_policy")
            .policyEngineId(exampleAwsBedrockagentcorePolicyEngine.policyEngineId())
            .description("Allow read access to example resources")
            .definition(AgentcorePolicyDefinitionArgs.builder()
                .cedar(AgentcorePolicyDefinitionCedarArgs.builder()
                    .statement("""
permit(principal, action == Action::\"Read\", resource);
                    """)
                    .build())
                .build())
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcorePolicy
    properties:
      name: example_policy
      policyEngineId: ${exampleAwsBedrockagentcorePolicyEngine.policyEngineId}
      description: Allow read access to example resources
      definition:
        cedar:
          statement: |
            permit(principal, action == Action::\"Read\", resource);

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcorepolicy" "example" {
  name             = "example_policy"
  policy_engine_id = exampleAwsBedrockagentcorePolicyEngine.policyEngineId
  description      = "Allow read access to example resources"
  definition = {
    cedar = {
      statement = "permit(principal, action == Action::\\\"Read\\\", resource);\n"
    }
  }
}

    Create AgentcorePolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AgentcorePolicy(name: string, args: AgentcorePolicyArgs, opts?: CustomResourceOptions);
    @overload
def AgentcorePolicy(resource_name: str,
                    args: AgentcorePolicyArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def AgentcorePolicy(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    definition: Optional[AgentcorePolicyDefinitionArgs] = None,
                    policy_engine_id: Optional[str] = None,
                    description: Optional[str] = None,
                    name: Optional[str] = None,
                    region: Optional[str] = None,
                    timeouts: Optional[AgentcorePolicyTimeoutsArgs] = None,
                    validation_mode: Optional[str] = None)
    func NewAgentcorePolicy(ctx *Context, name string, args AgentcorePolicyArgs, opts ...ResourceOption) (*AgentcorePolicy, error)
    public AgentcorePolicy(string name, AgentcorePolicyArgs args, CustomResourceOptions? opts = null)
    public AgentcorePolicy(String name, AgentcorePolicyArgs args)
public AgentcorePolicy(String name, AgentcorePolicyArgs args, CustomResourceOptions options)

    type: aws:bedrock:AgentcorePolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_bedrock_agentcorepolicy" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AgentcorePolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AgentcorePolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AgentcorePolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AgentcorePolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AgentcorePolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var agentcorePolicyResource = new Aws.Bedrock.AgentcorePolicy("agentcorePolicyResource", new()
{
    Definition = new Aws.Bedrock.Inputs.AgentcorePolicyDefinitionArgs
    {
        Cedar = new Aws.Bedrock.Inputs.AgentcorePolicyDefinitionCedarArgs
        {
            Statement = "string",
        },
    },
    PolicyEngineId = "string",
    Description = "string",
    Name = "string",
    Region = "string",
    Timeouts = new Aws.Bedrock.Inputs.AgentcorePolicyTimeoutsArgs
    {
        Create = "string",
        Delete = "string",
        Update = "string",
    },
    ValidationMode = "string",
});

    example, err := bedrock.NewAgentcorePolicy(ctx, "agentcorePolicyResource", &bedrock.AgentcorePolicyArgs{
	Definition: &bedrock.AgentcorePolicyDefinitionArgs{
		Cedar: &bedrock.AgentcorePolicyDefinitionCedarArgs{
			Statement: pulumi.String("string"),
		},
	},
	PolicyEngineId: pulumi.String("string"),
	Description:    pulumi.String("string"),
	Name:           pulumi.String("string"),
	Region:         pulumi.String("string"),
	Timeouts: &bedrock.AgentcorePolicyTimeoutsArgs{
		Create: pulumi.String("string"),
		Delete: pulumi.String("string"),
		Update: pulumi.String("string"),
	},
	ValidationMode: pulumi.String("string"),
})

    resource "aws_bedrock_agentcorepolicy" "agentcorePolicyResource" {
  definition = {
    cedar = {
      statement = "string"
    }
  }
  policy_engine_id = "string"
  description      = "string"
  name             = "string"
  region           = "string"
  timeouts = {
    create = "string"
    delete = "string"
    update = "string"
  }
  validation_mode = "string"
}

    var agentcorePolicyResource = new AgentcorePolicy("agentcorePolicyResource", AgentcorePolicyArgs.builder()
    .definition(AgentcorePolicyDefinitionArgs.builder()
        .cedar(AgentcorePolicyDefinitionCedarArgs.builder()
            .statement("string")
            .build())
        .build())
    .policyEngineId("string")
    .description("string")
    .name("string")
    .region("string")
    .timeouts(AgentcorePolicyTimeoutsArgs.builder()
        .create("string")
        .delete("string")
        .update("string")
        .build())
    .validationMode("string")
    .build());

    agentcore_policy_resource = aws.bedrock.AgentcorePolicy("agentcorePolicyResource",
    definition={
        "cedar": {
            "statement": "string",
        },
    },
    policy_engine_id="string",
    description="string",
    name="string",
    region="string",
    timeouts={
        "create": "string",
        "delete": "string",
        "update": "string",
    },
    validation_mode="string")

    const agentcorePolicyResource = new aws.bedrock.AgentcorePolicy("agentcorePolicyResource", {
    definition: {
        cedar: {
            statement: "string",
        },
    },
    policyEngineId: "string",
    description: "string",
    name: "string",
    region: "string",
    timeouts: {
        create: "string",
        "delete": "string",
        update: "string",
    },
    validationMode: "string",
});

    type: aws:bedrock:AgentcorePolicy
properties:
    definition:
        cedar:
            statement: string
    description: string
    name: string
    policyEngineId: string
    region: string
    timeouts:
        create: string
        delete: string
        update: string
    validationMode: string

    AgentcorePolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AgentcorePolicy resource accepts the following input properties:

    Definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    PolicyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    Description string
    Description of the policy.
    Name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Timeouts AgentcorePolicyTimeouts
    ValidationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    Definition AgentcorePolicyDefinitionArgs
    Policy definition. See definition Block for details.
    PolicyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    Description string
    Description of the policy.
    Name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Timeouts AgentcorePolicyTimeoutsArgs
    ValidationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition object
    Policy definition. See definition Block for details.
    policy_engine_id string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    description string
    Description of the policy.
    name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts object
    validation_mode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    policyEngineId String

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    description String
    Description of the policy.
    name String
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeouts
    validationMode String
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    policyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    description string
    Description of the policy.
    name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeouts
    validationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinitionArgs
    Policy definition. See definition Block for details.
    policy_engine_id str

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    description str
    Description of the policy.
    name str
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeoutsArgs
    validation_mode str
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition Property Map
    Policy definition. See definition Block for details.
    policyEngineId String

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    description String
    Description of the policy.
    name String
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts Property Map
    validationMode String
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AgentcorePolicy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyArn string
    ARN of the Policy.
    PolicyId string
    Identifier of the Policy.
    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyArn string
    ARN of the Policy.
    PolicyId string
    Identifier of the Policy.
    id string
    The provider-assigned unique ID for this managed resource.
    policy_arn string
    ARN of the Policy.
    policy_id string
    Identifier of the Policy.
    id String
    The provider-assigned unique ID for this managed resource.
    policyArn String
    ARN of the Policy.
    policyId String
    Identifier of the Policy.
    id string
    The provider-assigned unique ID for this managed resource.
    policyArn string
    ARN of the Policy.
    policyId string
    Identifier of the Policy.
    id str
    The provider-assigned unique ID for this managed resource.
    policy_arn str
    ARN of the Policy.
    policy_id str
    Identifier of the Policy.
    id String
    The provider-assigned unique ID for this managed resource.
    policyArn String
    ARN of the Policy.
    policyId String
    Identifier of the Policy.

    Look up Existing AgentcorePolicy Resource

    Get an existing AgentcorePolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AgentcorePolicyState, opts?: CustomResourceOptions): AgentcorePolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        definition: Optional[AgentcorePolicyDefinitionArgs] = None,
        description: Optional[str] = None,
        name: Optional[str] = None,
        policy_arn: Optional[str] = None,
        policy_engine_id: Optional[str] = None,
        policy_id: Optional[str] = None,
        region: Optional[str] = None,
        timeouts: Optional[AgentcorePolicyTimeoutsArgs] = None,
        validation_mode: Optional[str] = None) -> AgentcorePolicy
    func GetAgentcorePolicy(ctx *Context, name string, id IDInput, state *AgentcorePolicyState, opts ...ResourceOption) (*AgentcorePolicy, error)
    public static AgentcorePolicy Get(string name, Input<string> id, AgentcorePolicyState? state, CustomResourceOptions? opts = null)
    public static AgentcorePolicy get(String name, Output<String> id, AgentcorePolicyState state, CustomResourceOptions options)
    resources:  _:    type: aws:bedrock:AgentcorePolicy    get:      id: ${id}
    import {
  to = aws_bedrock_agentcorepolicy.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    Description string
    Description of the policy.
    Name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    PolicyArn string
    ARN of the Policy.
    PolicyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    PolicyId string
    Identifier of the Policy.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Timeouts AgentcorePolicyTimeouts
    ValidationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    Definition AgentcorePolicyDefinitionArgs
    Policy definition. See definition Block for details.
    Description string
    Description of the policy.
    Name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    PolicyArn string
    ARN of the Policy.
    PolicyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    PolicyId string
    Identifier of the Policy.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Timeouts AgentcorePolicyTimeoutsArgs
    ValidationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition object
    Policy definition. See definition Block for details.
    description string
    Description of the policy.
    name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    policy_arn string
    ARN of the Policy.
    policy_engine_id string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    policy_id string
    Identifier of the Policy.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts object
    validation_mode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    description String
    Description of the policy.
    name String
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    policyArn String
    ARN of the Policy.
    policyEngineId String

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    policyId String
    Identifier of the Policy.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeouts
    validationMode String
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinition
    Policy definition. See definition Block for details.
    description string
    Description of the policy.
    name string
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    policyArn string
    ARN of the Policy.
    policyEngineId string

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    policyId string
    Identifier of the Policy.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeouts
    validationMode string
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition AgentcorePolicyDefinitionArgs
    Policy definition. See definition Block for details.
    description str
    Description of the policy.
    name str
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    policy_arn str
    ARN of the Policy.
    policy_engine_id str

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    policy_id str
    Identifier of the Policy.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts AgentcorePolicyTimeoutsArgs
    validation_mode str
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.
    definition Property Map
    Policy definition. See definition Block for details.
    description String
    Description of the policy.
    name String
    Name of the policy. Must be 1-48 characters and match the pattern ^[A-Za-z][A-Za-z0-9_]*$. Changing this forces a new resource to be created.
    policyArn String
    ARN of the Policy.
    policyEngineId String

    Identifier of the Policy Engine that owns this policy. Changing this forces a new resource to be created.

    The following arguments are optional:

    policyId String
    Identifier of the Policy.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    timeouts Property Map
    validationMode String
    Controls whether validation findings cause policy creation or update to fail. Valid values: FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS. Defaults to FAIL_ON_ANY_FINDINGS.

    Supporting Types

    AgentcorePolicyDefinition, AgentcorePolicyDefinitionArgs

    Cedar AgentcorePolicyDefinitionCedar
    Inline Cedar policy. See cedar Block for details.
    Cedar AgentcorePolicyDefinitionCedar
    Inline Cedar policy. See cedar Block for details.
    cedar object
    Inline Cedar policy. See cedar Block for details.
    cedar AgentcorePolicyDefinitionCedar
    Inline Cedar policy. See cedar Block for details.
    cedar AgentcorePolicyDefinitionCedar
    Inline Cedar policy. See cedar Block for details.
    cedar AgentcorePolicyDefinitionCedar
    Inline Cedar policy. See cedar Block for details.
    cedar Property Map
    Inline Cedar policy. See cedar Block for details.

    AgentcorePolicyDefinitionCedar, AgentcorePolicyDefinitionCedarArgs

    Statement string
    Cedar policy statement.
    Statement string
    Cedar policy statement.
    statement string
    Cedar policy statement.
    statement String
    Cedar policy statement.
    statement string
    Cedar policy statement.
    statement str
    Cedar policy statement.
    statement String
    Cedar policy statement.

    AgentcorePolicyTimeouts, AgentcorePolicyTimeoutsArgs

    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

    Import

    Identity Schema

    Required

    • policyEngineId (String) ID of the policy engine.
    • policyId (String) ID of the policy.

    Optional

    • accountId (String) AWS Account where this resource is managed.
    • region (String) Region where this resource is managed.

    Using pulumi import, import Bedrock AgentCore Policies using the policyEngineId and policyId separated by a comma. For example:

    $ pulumi import aws:bedrock/agentcorePolicy:AgentcorePolicy example PolicyEngine_i2fo6-dyqwrzl954,policy_ar2c3-o_rospxr2j

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    Viewing docs for AWS v7.34.0
    published on Tuesday, Jun 16, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial