@aws-cdk/aws-bedrock-agentcore-alpha 2.250.0-alpha.0 → 2.252.0-alpha.0

package/lib/policy/policy-types.d.ts

@@ -0,0 +1,66 @@
+import type { PolicyStatement } from './policy-statement';
+/**
+ * Validation mode for Cedar policy definitions.
+ *
+ */
+export declare class PolicyValidationMode {
+    /**
+     * Fail policy creation if any validation findings are detected.
+     * This is the safer default - catches policy errors early.
+     */
+    static readonly FAIL_ON_ANY_FINDINGS: PolicyValidationMode;
+    /**
+     * Ignore all validation findings and create the policy anyway.
+     * Use with caution - may result in runtime authorization errors.
+     */
+    static readonly IGNORE_ALL_FINDINGS: PolicyValidationMode;
+    /**
+     * The string value of the validation mode.
+     */
+    readonly value: string;
+    constructor(value: string);
+}
+/**
+ * Options for adding a policy via PolicyEngine.addPolicy()
+ */
+export interface AddPolicyOptions {
+    /**
+     * Cedar policy statement (35-153,600 characters).
+     *
+     * You must specify either `definition` or `statement`, but not both.
+     *
+     * @default - Must provide either definition or statement
+     */
+    readonly definition?: string;
+    /**
+     * Type-safe Cedar policy statement built using PolicyStatement builder.
+     *
+     * Use this for a type-safe, form-like API to build Cedar policies without
+     * writing raw Cedar syntax. The builder validates at synthesis time.
+     *
+     * You must specify either `definition` or `statement`, but not both.
+     *
+     * @default - Must provide either definition or statement
+     */
+    readonly statement?: PolicyStatement;
+    /**
+     * The name of the policy.
+     * Valid characters: a-z, A-Z, 0-9, _ (underscore)
+     * Must start with a letter, 1-48 characters
+     *
+     * @default - Auto-generated unique name
+     */
+    readonly policyName?: string;
+    /**
+     * Optional description for the policy (max 4,096 characters).
+     *
+     * @default - No description
+     */
+    readonly description?: string;
+    /**
+     * Validation mode for the policy.
+     *
+     * @default PolicyValidationMode.FAIL_ON_ANY_FINDINGS
+     */
+    readonly validationMode?: PolicyValidationMode;
+}

package/lib/policy/policy-types.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyValidationMode = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+/**
+ * Validation mode for Cedar policy definitions.
+ *
+ */
+class PolicyValidationMode {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.PolicyValidationMode", version: "2.252.0-alpha.0" };
+    /**
+     * Fail policy creation if any validation findings are detected.
+     * This is the safer default - catches policy errors early.
+     */
+    static FAIL_ON_ANY_FINDINGS = new PolicyValidationMode('FAIL_ON_ANY_FINDINGS');
+    /**
+     * Ignore all validation findings and create the policy anyway.
+     * Use with caution - may result in runtime authorization errors.
+     */
+    static IGNORE_ALL_FINDINGS = new PolicyValidationMode('IGNORE_ALL_FINDINGS');
+    /**
+     * The string value of the validation mode.
+     */
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+}
+exports.PolicyValidationMode = PolicyValidationMode;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LXR5cGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicG9saWN5LXR5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7QUFFQTs7O0dBR0c7QUFDSCxNQUFhLG9CQUFvQjs7SUFDL0I7OztPQUdHO0lBQ0ksTUFBTSxDQUFVLG9CQUFvQixHQUFHLElBQUksb0JBQW9CLENBQUMsc0JBQXNCLENBQUMsQ0FBQztJQUUvRjs7O09BR0c7SUFDSSxNQUFNLENBQVUsbUJBQW1CLEdBQUcsSUFBSSxvQkFBb0IsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBRTdGOztPQUVHO0lBQ2EsS0FBSyxDQUFTO0lBRTlCLFlBQW1CLEtBQWE7UUFDOUIsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7S0FDcEI7O0FBcEJILG9EQXFCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgUG9saWN5U3RhdGVtZW50IH0gZnJvbSAnLi9wb2xpY3ktc3RhdGVtZW50JztcblxuLyoqXG4gKiBWYWxpZGF0aW9uIG1vZGUgZm9yIENlZGFyIHBvbGljeSBkZWZpbml0aW9ucy5cbiAqXG4gKi9cbmV4cG9ydCBjbGFzcyBQb2xpY3lWYWxpZGF0aW9uTW9kZSB7XG4gIC8qKlxuICAgKiBGYWlsIHBvbGljeSBjcmVhdGlvbiBpZiBhbnkgdmFsaWRhdGlvbiBmaW5kaW5ncyBhcmUgZGV0ZWN0ZWQuXG4gICAqIFRoaXMgaXMgdGhlIHNhZmVyIGRlZmF1bHQgLSBjYXRjaGVzIHBvbGljeSBlcnJvcnMgZWFybHkuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJlYWRvbmx5IEZBSUxfT05fQU5ZX0ZJTkRJTkdTID0gbmV3IFBvbGljeVZhbGlkYXRpb25Nb2RlKCdGQUlMX09OX0FOWV9GSU5ESU5HUycpO1xuXG4gIC8qKlxuICAgKiBJZ25vcmUgYWxsIHZhbGlkYXRpb24gZmluZGluZ3MgYW5kIGNyZWF0ZSB0aGUgcG9saWN5IGFueXdheS5cbiAgICogVXNlIHdpdGggY2F1dGlvbiAtIG1heSByZXN1bHQgaW4gcnVudGltZSBhdXRob3JpemF0aW9uIGVycm9ycy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgSUdOT1JFX0FMTF9GSU5ESU5HUyA9IG5ldyBQb2xpY3lWYWxpZGF0aW9uTW9kZSgnSUdOT1JFX0FMTF9GSU5ESU5HUycpO1xuXG4gIC8qKlxuICAgKiBUaGUgc3RyaW5nIHZhbHVlIG9mIHRoZSB2YWxpZGF0aW9uIG1vZGUuXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgdmFsdWU6IHN0cmluZztcblxuICBwdWJsaWMgY29uc3RydWN0b3IodmFsdWU6IHN0cmluZykge1xuICAgIHRoaXMudmFsdWUgPSB2YWx1ZTtcbiAgfVxufVxuXG4vKipcbiAqIE9wdGlvbnMgZm9yIGFkZGluZyBhIHBvbGljeSB2aWEgUG9saWN5RW5naW5lLmFkZFBvbGljeSgpXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQWRkUG9saWN5T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBDZWRhciBwb2xpY3kgc3RhdGVtZW50ICgzNS0xNTMsNjAwIGNoYXJhY3RlcnMpLlxuICAgKlxuICAgKiBZb3UgbXVzdCBzcGVjaWZ5IGVpdGhlciBgZGVmaW5pdGlvbmAgb3IgYHN0YXRlbWVudGAsIGJ1dCBub3QgYm90aC5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBNdXN0IHByb3ZpZGUgZWl0aGVyIGRlZmluaXRpb24gb3Igc3RhdGVtZW50XG4gICAqL1xuICByZWFkb25seSBkZWZpbml0aW9uPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUeXBlLXNhZmUgQ2VkYXIgcG9saWN5IHN0YXRlbWVudCBidWlsdCB1c2luZyBQb2xpY3lTdGF0ZW1lbnQgYnVpbGRlci5cbiAgICpcbiAgICogVXNlIHRoaXMgZm9yIGEgdHlwZS1zYWZlLCBmb3JtLWxpa2UgQVBJIHRvIGJ1aWxkIENlZGFyIHBvbGljaWVzIHdpdGhvdXRcbiAgICogd3JpdGluZyByYXcgQ2VkYXIgc3ludGF4LiBUaGUgYnVpbGRlciB2YWxpZGF0ZXMgYXQgc3ludGhlc2lzIHRpbWUuXG4gICAqXG4gICAqIFlvdSBtdXN0IHNwZWNpZnkgZWl0aGVyIGBkZWZpbml0aW9uYCBvciBgc3RhdGVtZW50YCwgYnV0IG5vdCBib3RoLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIE11c3QgcHJvdmlkZSBlaXRoZXIgZGVmaW5pdGlvbiBvciBzdGF0ZW1lbnRcbiAgICovXG4gIHJlYWRvbmx5IHN0YXRlbWVudD86IFBvbGljeVN0YXRlbWVudDtcblxuICAvKipcbiAgICogVGhlIG5hbWUgb2YgdGhlIHBvbGljeS5cbiAgICogVmFsaWQgY2hhcmFjdGVyczogYS16LCBBLVosIDAtOSwgXyAodW5kZXJzY29yZSlcbiAgICogTXVzdCBzdGFydCB3aXRoIGEgbGV0dGVyLCAxLTQ4IGNoYXJhY3RlcnNcbiAgICpcbiAgICogQGRlZmF1bHQgLSBBdXRvLWdlbmVyYXRlZCB1bmlxdWUgbmFtZVxuICAgKi9cbiAgcmVhZG9ubHkgcG9saWN5TmFtZT86IHN0cmluZztcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGVzY3JpcHRpb24gZm9yIHRoZSBwb2xpY3kgKG1heCA0LDA5NiBjaGFyYWN0ZXJzKS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBObyBkZXNjcmlwdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgZGVzY3JpcHRpb24/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRpb24gbW9kZSBmb3IgdGhlIHBvbGljeS5cbiAgICpcbiAgICogQGRlZmF1bHQgUG9saWN5VmFsaWRhdGlvbk1vZGUuRkFJTF9PTl9BTllfRklORElOR1NcbiAgICovXG4gIHJlYWRvbmx5IHZhbGlkYXRpb25Nb2RlPzogUG9saWN5VmFsaWRhdGlvbk1vZGU7XG59XG4iXX0=

package/lib/policy/policy.d.ts

@@ -0,0 +1,127 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import type { Construct } from 'constructs';
+import type { IPolicy, PolicyAttributes } from './policy-base';
+import { PolicyBase } from './policy-base';
+import type { IPolicyEngine } from './policy-engine-base';
+import type { PolicyStatement } from './policy-statement';
+import { PolicyValidationMode } from './policy-types';
+/**
+ * Properties for creating a Policy resource
+ */
+export interface PolicyProps {
+    /**
+     * The name of the policy.
+     * Valid characters: a-z, A-Z, 0-9, _ (underscore)
+     * Must start with a letter, 1-48 characters
+     * Pattern: ^[A-Za-z][A-Za-z0-9_]*$
+     *
+     * @default - Auto-generated unique name
+     */
+    readonly policyName?: string;
+    /**
+     * The policy engine this policy belongs to.
+     * [disable-awslint:prefer-ref-interface]
+     */
+    readonly policyEngine: IPolicyEngine;
+    /**
+     * Cedar policy statement.
+     * The authorization policy written in Cedar policy language.
+     *
+     * Cedar supports permit and forbid rules with conditions.
+     * The statement will be wrapped in a PolicyDefinition structure internally.
+     *
+     * Pass the raw Cedar statement as a string. For example:
+     * - "permit(principal, action, resource);"
+     * - "permit(principal in Group::\"Admins\", action == Action::\"InvokeModel\", resource) when { context.environment == \"production\" };"
+     *
+     * You must specify either `definition` or `statement`, but not both.
+     *
+     * @default - Must provide either definition or statement
+     */
+    readonly definition?: string;
+    /**
+     * Type-safe Cedar policy statement built using PolicyStatement builder.
+     *
+     * Use this for a type-safe, form-like API to build Cedar policies without
+     * writing raw Cedar syntax. The builder validates at synthesis time.
+     *
+     * You must specify either `definition` or `statement`, but not both.
+     *
+     * @default - Must provide either definition or statement
+     */
+    readonly statement?: PolicyStatement;
+    /**
+     * Optional description for the policy.
+     * Maximum length of 4096.
+     * @default - No description
+     */
+    readonly description?: string;
+    /**
+     * Validation mode for the policy.
+     * Controls how Cedar analyzer validation findings are handled.
+     *
+     * @default PolicyValidationMode.FAIL_ON_ANY_FINDINGS
+     */
+    readonly validationMode?: PolicyValidationMode;
+}
+/**
+ * Individual Cedar policy defining what agents can access.
+ * Policies use Cedar language to specify precise access control rules
+ * that are evaluated deterministically by the PolicyEngine.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html
+ * @resource AWS::BedrockAgentCore::Policy
+ */
+export declare class Policy extends PolicyBase {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Creates a Policy reference from an existing policy's attributes.
+     *
+     * @param scope - The construct scope
+     * @param id - Identifier of the construct
+     * @param attrs - Attributes of the existing policy
+     * @returns An IPolicy reference to the existing policy
+     */
+    static fromPolicyAttributes(scope: Construct, id: string, attrs: PolicyAttributes): IPolicy;
+    /**
+     * The ARN of the policy resource.
+     * @attribute
+     */
+    readonly policyArn: string;
+    /**
+     * The name of the policy.
+     *
+     * [disable-awslint:attribute-tag]
+     */
+    readonly policyName: string;
+    /**
+     * The ID of the policy.
+     * @attribute
+     */
+    readonly policyId: string;
+    /**
+     * The policy engine this policy belongs to.
+     *
+     * [disable-awslint:attribute-tag]
+     */
+    readonly policyEngine: IPolicyEngine;
+    /**
+     * The Cedar policy definition.
+     */
+    readonly definition: string;
+    /**
+     * The description of the policy.
+     */
+    readonly description?: string;
+    /**
+     * The validation mode for the policy.
+     */
+    readonly validationMode?: PolicyValidationMode;
+    /**
+     * The principal to grant permissions to.
+     */
+    readonly grantPrincipal: iam.IPrincipal;
+    private readonly __resource;
+    constructor(scope: Construct, id: string, props: PolicyProps);
+}

package/lib/policy/policy.js

@@ -0,0 +1,225 @@
+"use strict";
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Policy = void 0;
+const jsiiDeprecationWarnings = require("../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_bedrockagentcore_1 = require("aws-cdk-lib/aws-bedrockagentcore");
+const iam = require("aws-cdk-lib/aws-iam");
+const errors_1 = require("aws-cdk-lib/core/lib/errors");
+const helpers_internal_1 = require("aws-cdk-lib/core/lib/helpers-internal");
+const metadata_resource_1 = require("aws-cdk-lib/core/lib/metadata-resource");
+const prop_injectable_1 = require("aws-cdk-lib/core/lib/prop-injectable");
+const policy_base_1 = require("./policy-base");
+const policy_types_1 = require("./policy-types");
+const validation_helpers_1 = require("./validation-helpers");
+/**
+ * Individual Cedar policy defining what agents can access.
+ * Policies use Cedar language to specify precise access control rules
+ * that are evaluated deterministically by the PolicyEngine.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html
+ * @resource AWS::BedrockAgentCore::Policy
+ */
+let Policy = (() => {
+    let _classDecorators = [prop_injectable_1.propertyInjectable];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = policy_base_1.PolicyBase;
+    var Policy = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Policy = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Policy", version: "2.252.0-alpha.0" };
+        /** Uniquely identifies this class. */
+        static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.Policy';
+        /**
+         * Creates a Policy reference from an existing policy's attributes.
+         *
+         * @param scope - The construct scope
+         * @param id - Identifier of the construct
+         * @param attrs - Attributes of the existing policy
+         * @returns An IPolicy reference to the existing policy
+         */
+        static fromPolicyAttributes(scope, id, attrs) {
+            try {
+                jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_PolicyAttributes(attrs);
+            }
+            catch (error) {
+                if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                    Error.captureStackTrace(error, this.fromPolicyAttributes);
+                }
+                throw error;
+            }
+            class Import extends policy_base_1.PolicyBase {
+                policyArn = attrs.policyArn;
+                policyId = aws_cdk_lib_1.Arn.split(attrs.policyArn, aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME).resourceName;
+                policyName = this.policyId;
+                description = undefined;
+                validationMode = undefined;
+                policyEngine = attrs.policyEngine;
+                grantPrincipal = new iam.UnknownPrincipal({ resource: this });
+            }
+            return new Import(scope, id);
+        }
+        // ------------------------------------------------------
+        // Attributes
+        // ------------------------------------------------------
+        /**
+         * The ARN of the policy resource.
+         * @attribute
+         */
+        policyArn;
+        /**
+         * The name of the policy.
+         *
+         * [disable-awslint:attribute-tag]
+         */
+        policyName;
+        /**
+         * The ID of the policy.
+         * @attribute
+         */
+        policyId;
+        /**
+         * The policy engine this policy belongs to.
+         *
+         * [disable-awslint:attribute-tag]
+         */
+        policyEngine;
+        /**
+         * The Cedar policy definition.
+         */
+        definition;
+        /**
+         * The description of the policy.
+         */
+        description;
+        /**
+         * The validation mode for the policy.
+         */
+        validationMode;
+        /**
+         * The principal to grant permissions to.
+         */
+        grantPrincipal;
+        // ------------------------------------------------------
+        // Internal Only
+        // ------------------------------------------------------
+        __resource;
+        // ------------------------------------------------------
+        // CONSTRUCTOR
+        // ------------------------------------------------------
+        constructor(scope, id, props) {
+            super(scope, id, {
+                // Maximum name length of 48 characters
+                physicalName: props?.policyName ??
+                    aws_cdk_lib_1.Lazy.string({
+                        produce: () => aws_cdk_lib_1.Names.uniqueResourceName(this, { maxLength: 48 }),
+                    }),
+            });
+            try {
+                jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_PolicyProps(props);
+            }
+            catch (error) {
+                if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                    Error.captureStackTrace(error, Policy);
+                }
+                throw error;
+            }
+            // Enhanced CDK Analytics Telemetry
+            (0, metadata_resource_1.addConstructMetadata)(this, props);
+            // ------------------------------------------------------
+            // Validate definition vs statement
+            // ------------------------------------------------------
+            if (!props.definition && !props.statement) {
+                throw new errors_1.ValidationError((0, helpers_internal_1.lit) `PolicyDefinitionRequired`, `Policy '${this.physicalName}' must specify either 'definition' (raw Cedar string) or 'statement' (PolicyStatement builder), but neither was provided.`, this);
+            }
+            if (props.definition && props.statement) {
+                throw new errors_1.ValidationError((0, helpers_internal_1.lit) `PolicyDefinitionConflict`, `Policy '${this.physicalName}' must specify either 'definition' OR 'statement', but not both. ` +
+                    'Use definition for raw Cedar strings, or statement for the type-safe builder.', this);
+            }
+            // ------------------------------------------------------
+            // Set properties and defaults
+            // ------------------------------------------------------
+            this.policyName = this.physicalName;
+            this.policyEngine = props.policyEngine;
+            this.definition = props.statement ? props.statement.toCedar() : props.definition;
+            this.description = props.description;
+            this.validationMode = props.validationMode ?? policy_types_1.PolicyValidationMode.FAIL_ON_ANY_FINDINGS;
+            this.grantPrincipal = new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com');
+            // ------------------------------------------------------
+            // Validations
+            // ------------------------------------------------------
+            (0, validation_helpers_1.throwIfInvalidPolicyName)(this.policyName, this);
+            (0, validation_helpers_1.throwIfInvalidPolicyDefinition)(this.definition, this);
+            if (this.description) {
+                (0, validation_helpers_1.throwIfInvalidDescription)(this.description, this);
+            }
+            // ------------------------------------------------------
+            // CFN Props
+            // ------------------------------------------------------
+            const cfnProps = {
+                name: this.policyName,
+                policyEngineId: this.policyEngine.policyEngineId,
+                definition: {
+                    cedar: {
+                        statement: this.definition,
+                    },
+                },
+                description: this.description,
+                validationMode: this.validationMode?.value,
+            };
+            this.__resource = new aws_bedrockagentcore_1.CfnPolicy(this, 'Resource', cfnProps);
+            // Create dependency ONLY on the PolicyEngine's CFN resource to avoid circular dependencies with the PolicyEngine construct
+            this.__resource.node.addDependency(this.policyEngine.node.defaultChild);
+            this.policyId = this.__resource.attrPolicyId;
+            this.policyArn = this.__resource.attrPolicyArn;
+        }
+        static {
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+    };
+    return Policy = _classThis;
+})();
+exports.Policy = Policy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDZDQUEwRDtBQUUxRCwyRUFBNkQ7QUFDN0QsMkNBQTJDO0FBQzNDLHdEQUE4RDtBQUM5RCw0RUFBNEQ7QUFDNUQsOEVBQThFO0FBQzlFLDBFQUEwRTtBQUkxRSwrQ0FBMkM7QUFHM0MsaURBQXNEO0FBQ3RELDZEQUEySDtBQW1FM0g7Ozs7Ozs7R0FPRztJQUVVLE1BQU07NEJBRGxCLG9DQUFrQjs7OztzQkFDUyx3QkFBVTtzQkFBbEIsU0FBUSxXQUFVOzs7O1lBQXRDLDZLQXFLQzs7Ozs7UUFwS0Msc0NBQXNDO1FBQy9CLE1BQU0sQ0FBVSxxQkFBcUIsR0FBVyw2Q0FBNkMsQ0FBQztRQUVyRzs7Ozs7OztXQU9HO1FBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXVCOzs7Ozs7Ozs7O1lBQ3RGLE1BQU0sTUFBTyxTQUFRLHdCQUFVO2dCQUNiLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDO2dCQUM1QixRQUFRLEdBQUcsaUJBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSx1QkFBUyxDQUFDLG1CQUFtQixDQUFDLENBQUMsWUFBYSxDQUFDO2dCQUNuRixVQUFVLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQztnQkFDM0IsV0FBVyxHQUFHLFNBQVMsQ0FBQztnQkFDeEIsY0FBYyxHQUFHLFNBQVMsQ0FBQztnQkFDM0IsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7Z0JBQ2xDLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2FBQy9FO1lBRUQsT0FBTyxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7U0FDOUI7UUFFRCx5REFBeUQ7UUFDekQsYUFBYTtRQUNiLHlEQUF5RDtRQUV6RDs7O1dBR0c7UUFDYSxTQUFTLENBQVM7UUFFbEM7Ozs7V0FJRztRQUNhLFVBQVUsQ0FBUztRQUVuQzs7O1dBR0c7UUFDYSxRQUFRLENBQVM7UUFFakM7Ozs7V0FJRztRQUNhLFlBQVksQ0FBZ0I7UUFFNUM7O1dBRUc7UUFDYSxVQUFVLENBQVM7UUFFbkM7O1dBRUc7UUFDYSxXQUFXLENBQVU7UUFFckM7O1dBRUc7UUFDYSxjQUFjLENBQXdCO1FBRXREOztXQUVHO1FBQ2EsY0FBYyxDQUFpQjtRQUUvQyx5REFBeUQ7UUFDekQsZ0JBQWdCO1FBQ2hCLHlEQUF5RDtRQUN4QyxVQUFVLENBQVk7UUFFdkMseURBQXlEO1FBQ3pELGNBQWM7UUFDZCx5REFBeUQ7UUFDekQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFrQjtZQUMxRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtnQkFDZix1Q0FBdUM7Z0JBQ3ZDLFlBQVksRUFDVixLQUFLLEVBQUUsVUFBVTtvQkFDakIsa0JBQUksQ0FBQyxNQUFNLENBQUM7d0JBQ1YsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLG1CQUFLLENBQUMsa0JBQWtCLENBQUMsSUFBSSxFQUFFLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxDQUFDO3FCQUNqRSxDQUFDO2FBQ0wsQ0FBQyxDQUFDOzs7Ozs7bURBNUZNLE1BQU07Ozs7WUE4RmYsbUNBQW1DO1lBQ25DLElBQUEsd0NBQW9CLEVBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBRWxDLHlEQUF5RDtZQUN6RCxtQ0FBbUM7WUFDbkMseURBQXlEO1lBQ3pELElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO2dCQUMxQyxNQUFNLElBQUksd0JBQWUsQ0FDdkIsSUFBQSxzQkFBRyxFQUFBLDBCQUEwQixFQUM3QixXQUFXLElBQUksQ0FBQyxZQUFZLDJIQUEySCxFQUN2SixJQUFJLENBQ0wsQ0FBQztZQUNKLENBQUM7WUFFRCxJQUFJLEtBQUssQ0FBQyxVQUFVLElBQUksS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO2dCQUN4QyxNQUFNLElBQUksd0JBQWUsQ0FDdkIsSUFBQSxzQkFBRyxFQUFBLDBCQUEwQixFQUM3QixXQUFXLElBQUksQ0FBQyxZQUFZLG1FQUFtRTtvQkFDL0YsK0VBQStFLEVBQy9FLElBQUksQ0FDTCxDQUFDO1lBQ0osQ0FBQztZQUVELHlEQUF5RDtZQUN6RCw4QkFBOEI7WUFDOUIseURBQXlEO1lBQ3pELElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQztZQUNwQyxJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7WUFFdkMsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsVUFBVyxDQUFDO1lBRWxGLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsQ0FBQztZQUNyQyxJQUFJLENBQUMsY0FBYyxHQUFHLEtBQUssQ0FBQyxjQUFjLElBQUksbUNBQW9CLENBQUMsb0JBQW9CLENBQUM7WUFFeEYsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO1lBRWxGLHlEQUF5RDtZQUN6RCxjQUFjO1lBQ2QseURBQXlEO1lBRXpELElBQUEsNkNBQXdCLEVBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUVoRCxJQUFBLG1EQUE4QixFQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFFdEQsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ3JCLElBQUEsOENBQXlCLEVBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUNwRCxDQUFDO1lBRUQseURBQXlEO1lBQ3pELFlBQVk7WUFDWix5REFBeUQ7WUFDekQsTUFBTSxRQUFRLEdBQW1CO2dCQUMvQixJQUFJLEVBQUUsSUFBSSxDQUFDLFVBQVU7Z0JBQ3JCLGNBQWMsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLGNBQWM7Z0JBQ2hELFVBQVUsRUFBRTtvQkFDVixLQUFLLEVBQUU7d0JBQ0wsU0FBUyxFQUFFLElBQUksQ0FBQyxVQUFVO3FCQUMzQjtpQkFDRjtnQkFDRCxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7Z0JBQzdCLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLEtBQUs7YUFDM0MsQ0FBQztZQUVGLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxnQ0FBUyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFFNUQsMkhBQTJIO1lBQzNILElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxZQUFhLENBQUMsQ0FBQztZQUV6RSxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQzdDLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7U0FDaEQ7O1lBcEtVLHVEQUFNOzs7OztBQUFOLHdCQUFNIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQXJuLCBBcm5Gb3JtYXQsIExhenksIE5hbWVzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBDZm5Qb2xpY3lQcm9wcyB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCB7IENmblBvbGljeSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFZhbGlkYXRpb25FcnJvciB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUvbGliL2Vycm9ycyc7XG5pbXBvcnQgeyBsaXQgfSBmcm9tICdhd3MtY2RrLWxpYi9jb3JlL2xpYi9oZWxwZXJzLWludGVybmFsJztcbmltcG9ydCB7IGFkZENvbnN0cnVjdE1ldGFkYXRhIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZS9saWIvbWV0YWRhdGEtcmVzb3VyY2UnO1xuaW1wb3J0IHsgcHJvcGVydHlJbmplY3RhYmxlIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZS9saWIvcHJvcC1pbmplY3RhYmxlJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG4vLyBJbnRlcm5hbCBpbXBvcnRzXG5pbXBvcnQgdHlwZSB7IElQb2xpY3ksIFBvbGljeUF0dHJpYnV0ZXMgfSBmcm9tICcuL3BvbGljeS1iYXNlJztcbmltcG9ydCB7IFBvbGljeUJhc2UgfSBmcm9tICcuL3BvbGljeS1iYXNlJztcbmltcG9ydCB0eXBlIHsgSVBvbGljeUVuZ2luZSB9IGZyb20gJy4vcG9saWN5LWVuZ2luZS1iYXNlJztcbmltcG9ydCB0eXBlIHsgUG9saWN5U3RhdGVtZW50IH0gZnJvbSAnLi9wb2xpY3ktc3RhdGVtZW50JztcbmltcG9ydCB7IFBvbGljeVZhbGlkYXRpb25Nb2RlIH0gZnJvbSAnLi9wb2xpY3ktdHlwZXMnO1xuaW1wb3J0IHsgdGhyb3dJZkludmFsaWRQb2xpY3lOYW1lLCB0aHJvd0lmSW52YWxpZERlc2NyaXB0aW9uLCB0aHJvd0lmSW52YWxpZFBvbGljeURlZmluaXRpb24gfSBmcm9tICcuL3ZhbGlkYXRpb24taGVscGVycyc7XG5cbi8qKlxuICogUHJvcGVydGllcyBmb3IgY3JlYXRpbmcgYSBQb2xpY3kgcmVzb3VyY2VcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQb2xpY3lQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgbmFtZSBvZiB0aGUgcG9saWN5LlxuICAgKiBWYWxpZCBjaGFyYWN0ZXJzOiBhLXosIEEtWiwgMC05LCBfICh1bmRlcnNjb3JlKVxuICAgKiBNdXN0IHN0YXJ0IHdpdGggYSBsZXR0ZXIsIDEtNDggY2hhcmFjdGVyc1xuICAgKiBQYXR0ZXJuOiBeW0EtWmEtel1bQS1aYS16MC05X10qJFxuICAgKlxuICAgKiBAZGVmYXVsdCAtIEF1dG8tZ2VuZXJhdGVkIHVuaXF1ZSBuYW1lXG4gICAqL1xuICByZWFkb25seSBwb2xpY3lOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgcG9saWN5IGVuZ2luZSB0aGlzIHBvbGljeSBiZWxvbmdzIHRvLlxuICAgKiBbZGlzYWJsZS1hd3NsaW50OnByZWZlci1yZWYtaW50ZXJmYWNlXVxuICAgKi9cbiAgcmVhZG9ubHkgcG9saWN5RW5naW5lOiBJUG9saWN5RW5naW5lO1xuXG4gIC8qKlxuICAgKiBDZWRhciBwb2xpY3kgc3RhdGVtZW50LlxuICAgKiBUaGUgYXV0aG9yaXphdGlvbiBwb2xpY3kgd3JpdHRlbiBpbiBDZWRhciBwb2xpY3kgbGFuZ3VhZ2UuXG4gICAqXG4gICAqIENlZGFyIHN1cHBvcnRzIHBlcm1pdCBhbmQgZm9yYmlkIHJ1bGVzIHdpdGggY29uZGl0aW9ucy5cbiAgICogVGhlIHN0YXRlbWVudCB3aWxsIGJlIHdyYXBwZWQgaW4gYSBQb2xpY3lEZWZpbml0aW9uIHN0cnVjdHVyZSBpbnRlcm5hbGx5LlxuICAgKlxuICAgKiBQYXNzIHRoZSByYXcgQ2VkYXIgc3RhdGVtZW50IGFzIGEgc3RyaW5nLiBGb3IgZXhhbXBsZTpcbiAgICogLSBcInBlcm1pdChwcmluY2lwYWwsIGFjdGlvbiwgcmVzb3VyY2UpO1wiXG4gICAqIC0gXCJwZXJtaXQocHJpbmNpcGFsIGluIEdyb3VwOjpcXFwiQWRtaW5zXFxcIiwgYWN0aW9uID09IEFjdGlvbjo6XFxcIkludm9rZU1vZGVsXFxcIiwgcmVzb3VyY2UpIHdoZW4geyBjb250ZXh0LmVudmlyb25tZW50ID09IFxcXCJwcm9kdWN0aW9uXFxcIiB9O1wiXG4gICAqXG4gICAqIFlvdSBtdXN0IHNwZWNpZnkgZWl0aGVyIGBkZWZpbml0aW9uYCBvciBgc3RhdGVtZW50YCwgYnV0IG5vdCBib3RoLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIE11c3QgcHJvdmlkZSBlaXRoZXIgZGVmaW5pdGlvbiBvciBzdGF0ZW1lbnRcbiAgICovXG4gIHJlYWRvbmx5IGRlZmluaXRpb24/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFR5cGUtc2FmZSBDZWRhciBwb2xpY3kgc3RhdGVtZW50IGJ1aWx0IHVzaW5nIFBvbGljeVN0YXRlbWVudCBidWlsZGVyLlxuICAgKlxuICAgKiBVc2UgdGhpcyBmb3IgYSB0eXBlLXNhZmUsIGZvcm0tbGlrZSBBUEkgdG8gYnVpbGQgQ2VkYXIgcG9saWNpZXMgd2l0aG91dFxuICAgKiB3cml0aW5nIHJhdyBDZWRhciBzeW50YXguIFRoZSBidWlsZGVyIHZhbGlkYXRlcyBhdCBzeW50aGVzaXMgdGltZS5cbiAgICpcbiAgICogWW91IG11c3Qgc3BlY2lmeSBlaXRoZXIgYGRlZmluaXRpb25gIG9yIGBzdGF0ZW1lbnRgLCBidXQgbm90IGJvdGguXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gTXVzdCBwcm92aWRlIGVpdGhlciBkZWZpbml0aW9uIG9yIHN0YXRlbWVudFxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGVtZW50PzogUG9saWN5U3RhdGVtZW50O1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkZXNjcmlwdGlvbiBmb3IgdGhlIHBvbGljeS5cbiAgICogTWF4aW11bSBsZW5ndGggb2YgNDA5Ni5cbiAgICogQGRlZmF1bHQgLSBObyBkZXNjcmlwdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgZGVzY3JpcHRpb24/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRpb24gbW9kZSBmb3IgdGhlIHBvbGljeS5cbiAgICogQ29udHJvbHMgaG93IENlZGFyIGFuYWx5emVyIHZhbGlkYXRpb24gZmluZGluZ3MgYXJlIGhhbmRsZWQuXG4gICAqXG4gICAqIEBkZWZhdWx0IFBvbGljeVZhbGlkYXRpb25Nb2RlLkZBSUxfT05fQU5ZX0ZJTkRJTkdTXG4gICAqL1xuICByZWFkb25seSB2YWxpZGF0aW9uTW9kZT86IFBvbGljeVZhbGlkYXRpb25Nb2RlO1xufVxuXG4vKipcbiAqIEluZGl2aWR1YWwgQ2VkYXIgcG9saWN5IGRlZmluaW5nIHdoYXQgYWdlbnRzIGNhbiBhY2Nlc3MuXG4gKiBQb2xpY2llcyB1c2UgQ2VkYXIgbGFuZ3VhZ2UgdG8gc3BlY2lmeSBwcmVjaXNlIGFjY2VzcyBjb250cm9sIHJ1bGVzXG4gKiB0aGF0IGFyZSBldmFsdWF0ZWQgZGV0ZXJtaW5pc3RpY2FsbHkgYnkgdGhlIFBvbGljeUVuZ2luZS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9iZWRyb2NrLWFnZW50Y29yZS9sYXRlc3QvZGV2Z3VpZGUvcG9saWN5Lmh0bWxcbiAqIEByZXNvdXJjZSBBV1M6OkJlZHJvY2tBZ2VudENvcmU6OlBvbGljeVxuICovXG5AcHJvcGVydHlJbmplY3RhYmxlXG5leHBvcnQgY2xhc3MgUG9saWN5IGV4dGVuZHMgUG9saWN5QmFzZSB7XG4gIC8qKiBVbmlxdWVseSBpZGVudGlmaWVzIHRoaXMgY2xhc3MuICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgUFJPUEVSVFlfSU5KRUNUSU9OX0lEOiBzdHJpbmcgPSAnQGF3cy1jZGsuYXdzLWJlZHJvY2stYWdlbnRjb3JlLWFscGhhLlBvbGljeSc7XG5cbiAgLyoqXG4gICAqIENyZWF0ZXMgYSBQb2xpY3kgcmVmZXJlbmNlIGZyb20gYW4gZXhpc3RpbmcgcG9saWN5J3MgYXR0cmlidXRlcy5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIC0gVGhlIGNvbnN0cnVjdCBzY29wZVxuICAgKiBAcGFyYW0gaWQgLSBJZGVudGlmaWVyIG9mIHRoZSBjb25zdHJ1Y3RcbiAgICogQHBhcmFtIGF0dHJzIC0gQXR0cmlidXRlcyBvZiB0aGUgZXhpc3RpbmcgcG9saWN5XG4gICAqIEByZXR1cm5zIEFuIElQb2xpY3kgcmVmZXJlbmNlIHRvIHRoZSBleGlzdGluZyBwb2xpY3lcbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbVBvbGljeUF0dHJpYnV0ZXMoc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgYXR0cnM6IFBvbGljeUF0dHJpYnV0ZXMpOiBJUG9saWN5IHtcbiAgICBjbGFzcyBJbXBvcnQgZXh0ZW5kcyBQb2xpY3lCYXNlIHtcbiAgICAgIHB1YmxpYyByZWFkb25seSBwb2xpY3lBcm4gPSBhdHRycy5wb2xpY3lBcm47XG4gICAgICBwdWJsaWMgcmVhZG9ubHkgcG9saWN5SWQgPSBBcm4uc3BsaXQoYXR0cnMucG9saWN5QXJuLCBBcm5Gb3JtYXQuU0xBU0hfUkVTT1VSQ0VfTkFNRSkucmVzb3VyY2VOYW1lITtcbiAgICAgIHB1YmxpYyByZWFkb25seSBwb2xpY3lOYW1lID0gdGhpcy5wb2xpY3lJZDtcbiAgICAgIHB1YmxpYyByZWFkb25seSBkZXNjcmlwdGlvbiA9IHVuZGVmaW5lZDtcbiAgICAgIHB1YmxpYyByZWFkb25seSB2YWxpZGF0aW9uTW9kZSA9IHVuZGVmaW5lZDtcbiAgICAgIHB1YmxpYyByZWFkb25seSBwb2xpY3lFbmdpbmUgPSBhdHRycy5wb2xpY3lFbmdpbmU7XG4gICAgICBwdWJsaWMgcmVhZG9ubHkgZ3JhbnRQcmluY2lwYWwgPSBuZXcgaWFtLlVua25vd25QcmluY2lwYWwoeyByZXNvdXJjZTogdGhpcyB9KTtcbiAgICB9XG5cbiAgICByZXR1cm4gbmV3IEltcG9ydChzY29wZSwgaWQpO1xuICB9XG5cbiAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gIC8vIEF0dHJpYnV0ZXNcbiAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbiAgLyoqXG4gICAqIFRoZSBBUk4gb2YgdGhlIHBvbGljeSByZXNvdXJjZS5cbiAgICogQGF0dHJpYnV0ZVxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHBvbGljeUFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgbmFtZSBvZiB0aGUgcG9saWN5LlxuICAgKlxuICAgKiBbZGlzYWJsZS1hd3NsaW50OmF0dHJpYnV0ZS10YWddXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgcG9saWN5TmFtZTogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgSUQgb2YgdGhlIHBvbGljeS5cbiAgICogQGF0dHJpYnV0ZVxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHBvbGljeUlkOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBwb2xpY3kgZW5naW5lIHRoaXMgcG9saWN5IGJlbG9uZ3MgdG8uXG4gICAqXG4gICAqIFtkaXNhYmxlLWF3c2xpbnQ6YXR0cmlidXRlLXRhZ11cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBwb2xpY3lFbmdpbmU6IElQb2xpY3lFbmdpbmU7XG5cbiAgLyoqXG4gICAqIFRoZSBDZWRhciBwb2xpY3kgZGVmaW5pdGlvbi5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBkZWZpbml0aW9uOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBkZXNjcmlwdGlvbiBvZiB0aGUgcG9saWN5LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGRlc2NyaXB0aW9uPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgdmFsaWRhdGlvbiBtb2RlIGZvciB0aGUgcG9saWN5LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHZhbGlkYXRpb25Nb2RlPzogUG9saWN5VmFsaWRhdGlvbk1vZGU7XG5cbiAgLyoqXG4gICAqIFRoZSBwcmluY2lwYWwgdG8gZ3JhbnQgcGVybWlzc2lvbnMgdG8uXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgZ3JhbnRQcmluY2lwYWw6IGlhbS5JUHJpbmNpcGFsO1xuXG4gIC8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuICAvLyBJbnRlcm5hbCBPbmx5XG4gIC8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuICBwcml2YXRlIHJlYWRvbmx5IF9fcmVzb3VyY2U6IENmblBvbGljeTtcblxuICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAgLy8gQ09OU1RSVUNUT1JcbiAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBQb2xpY3lQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLy8gTWF4aW11bSBuYW1lIGxlbmd0aCBvZiA0OCBjaGFyYWN0ZXJzXG4gICAgICBwaHlzaWNhbE5hbWU6XG4gICAgICAgIHByb3BzPy5wb2xpY3lOYW1lID8/XG4gICAgICAgIExhenkuc3RyaW5nKHtcbiAgICAgICAgICBwcm9kdWNlOiAoKSA9PiBOYW1lcy51bmlxdWVSZXNvdXJjZU5hbWUodGhpcywgeyBtYXhMZW5ndGg6IDQ4IH0pLFxuICAgICAgICB9KSxcbiAgICB9KTtcblxuICAgIC8vIEVuaGFuY2VkIENESyBBbmFseXRpY3MgVGVsZW1ldHJ5XG4gICAgYWRkQ29uc3RydWN0TWV0YWRhdGEodGhpcywgcHJvcHMpO1xuXG4gICAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gICAgLy8gVmFsaWRhdGUgZGVmaW5pdGlvbiB2cyBzdGF0ZW1lbnRcbiAgICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAgICBpZiAoIXByb3BzLmRlZmluaXRpb24gJiYgIXByb3BzLnN0YXRlbWVudCkge1xuICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgbGl0YFBvbGljeURlZmluaXRpb25SZXF1aXJlZGAsXG4gICAgICAgIGBQb2xpY3kgJyR7dGhpcy5waHlzaWNhbE5hbWV9JyBtdXN0IHNwZWNpZnkgZWl0aGVyICdkZWZpbml0aW9uJyAocmF3IENlZGFyIHN0cmluZykgb3IgJ3N0YXRlbWVudCcgKFBvbGljeVN0YXRlbWVudCBidWlsZGVyKSwgYnV0IG5laXRoZXIgd2FzIHByb3ZpZGVkLmAsXG4gICAgICAgIHRoaXMsXG4gICAgICApO1xuICAgIH1cblxuICAgIGlmIChwcm9wcy5kZWZpbml0aW9uICYmIHByb3BzLnN0YXRlbWVudCkge1xuICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgbGl0YFBvbGljeURlZmluaXRpb25Db25mbGljdGAsXG4gICAgICAgIGBQb2xpY3kgJyR7dGhpcy5waHlzaWNhbE5hbWV9JyBtdXN0IHNwZWNpZnkgZWl0aGVyICdkZWZpbml0aW9uJyBPUiAnc3RhdGVtZW50JywgYnV0IG5vdCBib3RoLiBgICtcbiAgICAgICAgJ1VzZSBkZWZpbml0aW9uIGZvciByYXcgQ2VkYXIgc3RyaW5ncywgb3Igc3RhdGVtZW50IGZvciB0aGUgdHlwZS1zYWZlIGJ1aWxkZXIuJyxcbiAgICAgICAgdGhpcyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gICAgLy8gU2V0IHByb3BlcnRpZXMgYW5kIGRlZmF1bHRzXG4gICAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gICAgdGhpcy5wb2xpY3lOYW1lID0gdGhpcy5waHlzaWNhbE5hbWU7XG4gICAgdGhpcy5wb2xpY3lFbmdpbmUgPSBwcm9wcy5wb2xpY3lFbmdpbmU7XG5cbiAgICB0aGlzLmRlZmluaXRpb24gPSBwcm9wcy5zdGF0ZW1lbnQgPyBwcm9wcy5zdGF0ZW1lbnQudG9DZWRhcigpIDogcHJvcHMuZGVmaW5pdGlvbiE7XG5cbiAgICB0aGlzLmRlc2NyaXB0aW9uID0gcHJvcHMuZGVzY3JpcHRpb247XG4gICAgdGhpcy52YWxpZGF0aW9uTW9kZSA9IHByb3BzLnZhbGlkYXRpb25Nb2RlID8/IFBvbGljeVZhbGlkYXRpb25Nb2RlLkZBSUxfT05fQU5ZX0ZJTkRJTkdTO1xuXG4gICAgdGhpcy5ncmFudFByaW5jaXBhbCA9IG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnYmVkcm9jay1hZ2VudGNvcmUuYW1hem9uYXdzLmNvbScpO1xuXG4gICAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gICAgLy8gVmFsaWRhdGlvbnNcbiAgICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuICAgIHRocm93SWZJbnZhbGlkUG9saWN5TmFtZSh0aGlzLnBvbGljeU5hbWUsIHRoaXMpO1xuXG4gICAgdGhyb3dJZkludmFsaWRQb2xpY3lEZWZpbml0aW9uKHRoaXMuZGVmaW5pdGlvbiwgdGhpcyk7XG5cbiAgICBpZiAodGhpcy5kZXNjcmlwdGlvbikge1xuICAgICAgdGhyb3dJZkludmFsaWREZXNjcmlwdGlvbih0aGlzLmRlc2NyaXB0aW9uLCB0aGlzKTtcbiAgICB9XG5cbiAgICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAgICAvLyBDRk4gUHJvcHNcbiAgICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAgICBjb25zdCBjZm5Qcm9wczogQ2ZuUG9saWN5UHJvcHMgPSB7XG4gICAgICBuYW1lOiB0aGlzLnBvbGljeU5hbWUsXG4gICAgICBwb2xpY3lFbmdpbmVJZDogdGhpcy5wb2xpY3lFbmdpbmUucG9saWN5RW5naW5lSWQsXG4gICAgICBkZWZpbml0aW9uOiB7XG4gICAgICAgIGNlZGFyOiB7XG4gICAgICAgICAgc3RhdGVtZW50OiB0aGlzLmRlZmluaXRpb24sXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgZGVzY3JpcHRpb246IHRoaXMuZGVzY3JpcHRpb24sXG4gICAgICB2YWxpZGF0aW9uTW9kZTogdGhpcy52YWxpZGF0aW9uTW9kZT8udmFsdWUsXG4gICAgfTtcblxuICAgIHRoaXMuX19yZXNvdXJjZSA9IG5ldyBDZm5Qb2xpY3kodGhpcywgJ1Jlc291cmNlJywgY2ZuUHJvcHMpO1xuXG4gICAgLy8gQ3JlYXRlIGRlcGVuZGVuY3kgT05MWSBvbiB0aGUgUG9saWN5RW5naW5lJ3MgQ0ZOIHJlc291cmNlIHRvIGF2b2lkIGNpcmN1bGFyIGRlcGVuZGVuY2llcyB3aXRoIHRoZSBQb2xpY3lFbmdpbmUgY29uc3RydWN0XG4gICAgdGhpcy5fX3Jlc291cmNlLm5vZGUuYWRkRGVwZW5kZW5jeSh0aGlzLnBvbGljeUVuZ2luZS5ub2RlLmRlZmF1bHRDaGlsZCEpO1xuXG4gICAgdGhpcy5wb2xpY3lJZCA9IHRoaXMuX19yZXNvdXJjZS5hdHRyUG9saWN5SWQ7XG4gICAgdGhpcy5wb2xpY3lBcm4gPSB0aGlzLl9fcmVzb3VyY2UuYXR0clBvbGljeUFybjtcbiAgfVxufVxuXG4iXX0=

package/lib/policy/validation-helpers.d.ts

@@ -0,0 +1,139 @@
+import type { IConstruct } from 'constructs';
+/**
+ * Validation constants for PolicyEngine
+ */
+export declare const POLICY_ENGINE_NAME_MIN_LENGTH = 1;
+export declare const POLICY_ENGINE_NAME_MAX_LENGTH = 48;
+export declare const POLICY_ENGINE_NAME_PATTERN: RegExp;
+/**
+ * Validation constants for Policy
+ */
+export declare const POLICY_NAME_MIN_LENGTH = 1;
+export declare const POLICY_NAME_MAX_LENGTH = 48;
+export declare const POLICY_NAME_PATTERN: RegExp;
+/**
+ * Validation constants for Cedar policy definitions
+ */
+export declare const POLICY_DEFINITION_MIN_LENGTH = 35;
+export declare const POLICY_DEFINITION_MAX_LENGTH = 153600;
+/**
+ * Validation constants for descriptions
+ */
+export declare const DESCRIPTION_MAX_LENGTH = 4096;
+/**
+ * Validation constants for tags
+ */
+export declare const MAX_TAGS = 50;
+export declare const TAG_KEY_MIN_LENGTH = 1;
+export declare const TAG_KEY_MAX_LENGTH = 128;
+export declare const TAG_VALUE_MAX_LENGTH = 256;
+export declare const TAG_KEY_PATTERN: RegExp;
+export declare const TAG_VALUE_PATTERN: RegExp;
+/**
+ * Validates a policy engine name.
+ * Names must:
+ * - Start with a letter (a-z, A-Z)
+ * - Contain only letters, numbers, and underscores
+ * - Be between 1 and 48 characters
+ *
+ * @param name - The policy engine name to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export declare function validatePolicyEngineName(name: string, scope?: IConstruct): string[];
+/**
+ * Validates a policy name.
+ * Names must:
+ * - Start with a letter (a-z, A-Z)
+ * - Contain only letters, numbers, and underscores
+ * - Be between 1 and 48 characters
+ *
+ * @param name - The policy name to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export declare function validatePolicyName(name: string, scope?: IConstruct): string[];
+/**
+ * Validates a Cedar policy definition string.
+ * Definitions must be between 35 and 153,600 characters.
+ *
+ * @param definition - The Cedar policy definition to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export declare function validatePolicyDefinition(definition: string, scope?: IConstruct): string[];
+/**
+ * Validates a description string.
+ * Descriptions must not exceed 4,096 characters.
+ *
+ * @param description - The description to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export declare function validateDescription(description: string, scope?: IConstruct): string[];
+/**
+ * Validates a policy engine name and throws if invalid.
+ *
+ * @param name - The policy engine name to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns The validated name
+ * @throws ValidationError if validation fails
+ */
+export declare function throwIfInvalidPolicyEngineName(name: string, scope?: IConstruct): string;
+/**
+ * Validates a policy name and throws if invalid.
+ *
+ * @param name - The policy name to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns The validated name
+ * @throws ValidationError if validation fails
+ */
+export declare function throwIfInvalidPolicyName(name: string, scope?: IConstruct): string;
+/**
+ * Validates a policy definition and throws if invalid.
+ *
+ * @param definition - The Cedar policy definition to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns The validated definition
+ * @throws ValidationError if validation fails
+ */
+export declare function throwIfInvalidPolicyDefinition(definition: string, scope?: IConstruct): string;
+/**
+ * Validates a description and throws if invalid.
+ *
+ * @param description - The description to validate
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns The validated description
+ * @throws ValidationError if validation fails
+ */
+export declare function throwIfInvalidDescription(description: string, scope?: IConstruct): string;
+/**
+ * Validates tags for a PolicyEngine.
+ * Tags must:
+ * - Not exceed 50 tags
+ * - Have keys between 1 and 128 characters
+ * - Have values between 0 and 256 characters
+ * - Match allowed character patterns
+ *
+ * @param tags - The tags object to validate
+ * @param resourceName - The name of the resource being tagged (for error messages)
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns Array of validation error messages, empty if valid
+ */
+export declare function validateTags(tags: {
+    [key: string]: string;
+}, resourceName: string, _scope?: IConstruct): string[];
+/**
+ * Validates tags and throws if invalid.
+ *
+ * @param tags - The tags object to validate
+ * @param resourceName - The name of the resource being tagged (for error messages)
+ * @param scope - The construct scope for error reporting (optional)
+ * @returns The validated tags
+ * @throws ValidationError if validation fails
+ */
+export declare function throwIfInvalidTags(tags: {
+    [key: string]: string;
+}, resourceName: string, scope?: IConstruct): {
+    [key: string]: string;
+};