feat(bedrockagentcore): graduate Policy submodule to stable - #38687
Draft
alvazjor wants to merge 4 commits into
Draft
feat(bedrockagentcore): graduate Policy submodule to stable#38687alvazjor wants to merge 4 commits into
alvazjor wants to merge 4 commits into
Conversation
github-actions
Bot
added
effort/medium
aws-cdk-automation
added
the
pr/needs-further-review
Graduate the AgentCore Policy submodule (PolicyEngine, Policy, PolicyStatement) from @aws-cdk/aws-bedrock-agentcore-alpha into the stable aws-cdk-lib/aws-bedrockagentcore module. Policy was excluded from the original graduation (#37876) due to a CFN NotStabilized issue on AWS::BedrockAgentCore::Policy, now resolved. Reuses the preserved graduation migration and restores the Gateway policy-engine association that was stripped when Policy was pulled: - lib/policy: PolicyEngine, Policy, PolicyStatement and supporting base/types/perms/validation-helpers, exported from the module index. - lib/gateway/gateway.ts: re-add PolicyEngineMode, GatewayPolicyEngineConfig and Gateway.policyEngineConfiguration, wiring it into the L1 CfnGateway and granting the gateway role evaluate permissions on the engine. - tests: policy unit tests and gateway policy-engine association tests. - integ: policy and policy-auto-generated-name integ tests with snapshots. - README: restore the Policy Engine section, the Gateway policyEngineConfiguration row, and the table-of-contents entries. The only user-facing breaking change carried by this submodule is the metric() signature (the positional dimensions parameter was removed, consistent with the rest of the graduation). No Policy construct or property was renamed. Closes #37219
alvazjor
force-pushed
the
feat/agentcore-graduate-policy
branch
from
August 28, 2026 16:07
41d591b to
6d735c5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #37219.
Reason for this change
The AgentCore Policy submodule (
PolicyEngine,Policy,PolicyStatement) is only available in the alpha module@aws-cdk/aws-bedrock-agentcore-alpha. This graduates it to the stableaws-cdk-lib/aws-bedrockagentcoremodule so it can be used without depending on an alpha package.Description of changes
PolicyEngine,Policy,PolicyStatement, and their supporting base classes, types, and permission helpers) intoaws-cdk-lib/aws-bedrockagentcoreand export it from the module entry point.Gateway.policyEngineConfiguration, theGatewayPolicyEngineConfiginterface, and thePolicyEngineModeenum-like class, wired into the underlying Gateway resource. The gateway role is automatically granted evaluate permissions on the associated policy engine.grantPrincipalofPolicyEngineandPolicywithaws:SourceArnandaws:SourceAccountconditions for cross-service confused deputy prevention.Describe any new or updated permissions being added
grantEvaluateForGatewaygrantsbedrock-agentcore:GetPolicyEngine(scoped to the policy engine ARN) andbedrock-agentcore:AuthorizeAction/bedrock-agentcore:PartiallyAuthorizeActions(scoped to the policy engine and gateway ARNs).grantEvaluateandgrantReadonPolicyEngine, andgrantReadonPolicy, grant the corresponding data-plane read/evaluate actions scoped to the specific resource ARN.grantPrincipalforPolicyEngineandPolicyis scoped withaws:SourceArnandaws:SourceAccountconditions.Description of how you validated changes
PolicyEngineandPolicyconstructs, including tests asserting the confused deputy conditions render in the synthesized template.PolicyEngineandPolicyresources; the integration tests deploy successfully.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license