@aws-cdk/aws-bedrock-agentcore-alpha 2.250.0-alpha.0 → 2.252.0-alpha.0

package/lib/policy/policy-base.d.ts

@@ -0,0 +1,194 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import type { IResource, ResourceProps } from 'aws-cdk-lib';
+import { Resource } from 'aws-cdk-lib';
+import type { IPolicyRef, PolicyReference } from 'aws-cdk-lib/aws-bedrockagentcore';
+import type { DimensionsMap, MetricOptions } from 'aws-cdk-lib/aws-cloudwatch';
+import { Metric } from 'aws-cdk-lib/aws-cloudwatch';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import type { Construct } from 'constructs';
+import type { IPolicyEngine } from './policy-engine-base';
+import type { PolicyValidationMode } from './policy-types';
+/******************************************************************************
+ *                                Interface
+ *****************************************************************************/
+/**
+ * Minimal reference interface for Policy resources.
+ * Used for resource identification and ARN construction.
+ */
+export interface IPolicy extends IResource, IPolicyRef, iam.IGrantable {
+    /**
+     * The ARN of the policy resource
+     * @attribute
+     */
+    readonly policyArn: string;
+    /**
+     * The ID of the policy
+     * @attribute
+     */
+    readonly policyId: string;
+    /**
+     * The name of the policy
+     * @attribute
+     */
+    readonly policyName: string;
+    /**
+     * The policy engine this policy belongs to
+     * @attribute
+     */
+    readonly policyEngine: IPolicyEngine;
+    /**
+     * The description of the policy
+     */
+    readonly description?: string;
+    /**
+     * The validation mode for the policy
+     */
+    readonly validationMode?: PolicyValidationMode;
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Grants read permissions on the Policy (data plane).
+     *
+     * This grants runtime read access to policy configuration. Use this for monitoring,
+     * audit, or read-only administrative roles that need to inspect policy definitions.
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Return the given named metric for this policy.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName: string, dimensions: DimensionsMap, props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the total number of evaluations for this policy.
+     *
+     * This metric tracks how many times this policy has been evaluated.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluations(props?: MetricOptions): Metric;
+    /**
+     * Return a metric measuring the evaluation latency for this policy.
+     *
+     * This metric represents the time taken to evaluate this specific policy.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluationLatency(props?: MetricOptions): Metric;
+}
+/**
+ * Attributes for importing an existing Policy
+ */
+export interface PolicyAttributes {
+    /**
+     * The ARN of the policy
+     */
+    readonly policyArn: string;
+    /**
+     * The policy engine this policy belongs to
+     * [disable-awslint:prefer-ref-interface]
+     */
+    readonly policyEngine: IPolicyEngine;
+}
+/******************************************************************************
+ *                        ABSTRACT BASE CLASS
+ *****************************************************************************/
+/**
+ * Abstract base class for a Policy.
+ * Contains methods and attributes valid for Policies either created with CDK or imported.
+ */
+export declare abstract class PolicyBase extends Resource implements IPolicy {
+    abstract readonly policyArn: string;
+    abstract readonly policyId: string;
+    abstract readonly policyName: string;
+    abstract readonly policyEngine: IPolicyEngine;
+    abstract readonly description?: string;
+    abstract readonly validationMode?: PolicyValidationMode;
+    /**
+     * The principal to grant permissions to
+     */
+    abstract readonly grantPrincipal: iam.IPrincipal;
+    /**
+     * A reference to this Policy resource.
+     */
+    get policyRef(): PolicyReference;
+    constructor(scope: Construct, id: string, props?: ResourceProps);
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Grants read permissions on the Policy (data plane).
+     *
+     * This grants runtime read access to policy configuration. Use this for monitoring,
+     * audit, or read-only administrative roles that need to inspect policy definitions
+     * and Cedar statements at runtime.
+     *
+     * IMPORTANT: This does NOT grant permissions to create/update/delete the Policy
+     * resource itself. Those are control plane operations performed by CloudFormation
+     * during `cdk deploy`, not by your application at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Return the given named metric for this policy.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName: string, dimensions: DimensionsMap, props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the total number of evaluations for this policy.
+     *
+     * This metric tracks how many times this policy has been evaluated.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluations(props?: MetricOptions): Metric;
+    /**
+     * Return a metric measuring the evaluation latency for this policy.
+     *
+     * This metric represents the time taken to evaluate this specific policy.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluationLatency(props?: MetricOptions): Metric;
+    /**
+     * Internal method to create a metric.
+     */
+    private configureMetric;
+}

package/lib/policy/policy-base.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyBase = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const iam = require("aws-cdk-lib/aws-iam");
+// Internal imports
+const perms_1 = require("./perms");
+/******************************************************************************
+ *                        ABSTRACT BASE CLASS
+ *****************************************************************************/
+/**
+ * Abstract base class for a Policy.
+ * Contains methods and attributes valid for Policies either created with CDK or imported.
+ */
+class PolicyBase extends aws_cdk_lib_1.Resource {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.PolicyBase", version: "2.252.0-alpha.0" };
+    /**
+     * A reference to this Policy resource.
+     */
+    get policyRef() {
+        return {
+            policyArn: this.policyArn,
+        };
+    }
+    constructor(scope, id, props = {}) {
+        super(scope, id, props);
+    }
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grant(grantee, ...actions) {
+        return iam.Grant.addToPrincipal({
+            grantee,
+            actions,
+            resourceArns: [this.policyArn],
+            scope: this,
+        });
+    }
+    /**
+     * Grants read permissions on the Policy (data plane).
+     *
+     * This grants runtime read access to policy configuration. Use this for monitoring,
+     * audit, or read-only administrative roles that need to inspect policy definitions
+     * and Cedar statements at runtime.
+     *
+     * IMPORTANT: This does NOT grant permissions to create/update/delete the Policy
+     * resource itself. Those are control plane operations performed by CloudFormation
+     * during `cdk deploy`, not by your application at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantRead(grantee) {
+        return this.grant(grantee, ...perms_1.POLICY_READ_PERMS);
+    }
+    // ------------------------------------------------------
+    // Metrics
+    // ------------------------------------------------------
+    /**
+     * Return the given named metric for this policy.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName, dimensions, props) {
+        const metricProps = {
+            namespace: 'AWS/Bedrock-AgentCore',
+            metricName,
+            dimensionsMap: { ...dimensions, Resource: this.policyArn },
+            ...props,
+        };
+        return this.configureMetric(metricProps);
+    }
+    /**
+     * Return a metric containing the total number of evaluations for this policy.
+     *
+     * This metric tracks how many times this policy has been evaluated.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluations(props) {
+        return this.metric('PolicyEvaluations', {}, { statistic: aws_cloudwatch_1.Stats.SUM, ...props });
+    }
+    /**
+     * Return a metric measuring the evaluation latency for this policy.
+     *
+     * This metric represents the time taken to evaluate this specific policy.
+     *
+     * @param props Optional metric configuration
+     */
+    metricEvaluationLatency(props) {
+        return this.metric('PolicyEvaluationLatency', {}, { statistic: aws_cloudwatch_1.Stats.AVERAGE, ...props });
+    }
+    /**
+     * Internal method to create a metric.
+     */
+    configureMetric(props) {
+        return new aws_cloudwatch_1.Metric({
+            ...props,
+            region: props?.region ?? this.stack.region,
+            account: props?.account ?? this.stack.account,
+        });
+    }
+}
+exports.PolicyBase = PolicyBase;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LWJhc2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwb2xpY3ktYmFzZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBY0EsNkNBQXVDO0FBR3ZDLCtEQUEyRDtBQUMzRCwyQ0FBMkM7QUFFM0MsbUJBQW1CO0FBQ25CLG1DQUE0QztBQWlINUM7OytFQUUrRTtBQUUvRTs7O0dBR0c7QUFDSCxNQUFzQixVQUFXLFNBQVEsc0JBQVE7O0lBYS9DOztPQUVHO0lBQ0gsSUFBVyxTQUFTO1FBQ2xCLE9BQU87WUFDTCxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7U0FDMUIsQ0FBQztLQUNIO0lBRUQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxRQUF1QixFQUFFO1FBQ2pFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO0tBQ3pCO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDSSxLQUFLLENBQUMsT0FBdUIsRUFBRSxHQUFHLE9BQWlCO1FBQ3hELE9BQU8sR0FBRyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUM7WUFDOUIsT0FBTztZQUNQLE9BQU87WUFDUCxZQUFZLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQzlCLEtBQUssRUFBRSxJQUFJO1NBQ1osQ0FBQyxDQUFDO0tBQ0o7SUFFRDs7Ozs7Ozs7Ozs7Ozs7O09BZUc7SUFDSSxTQUFTLENBQUMsT0FBdUI7UUFDdEMsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxHQUFHLHlCQUFpQixDQUFDLENBQUM7S0FDbEQ7SUFFRCx5REFBeUQ7SUFDekQsVUFBVTtJQUNWLHlEQUF5RDtJQUV6RDs7Ozs7Ozs7O09BU0c7SUFDSSxNQUFNLENBQUMsVUFBa0IsRUFBRSxVQUF5QixFQUFFLEtBQXFCO1FBQ2hGLE1BQU0sV0FBVyxHQUFnQjtZQUMvQixTQUFTLEVBQUUsdUJBQXVCO1lBQ2xDLFVBQVU7WUFDVixhQUFhLEVBQUUsRUFBRSxHQUFHLFVBQVUsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRTtZQUMxRCxHQUFHLEtBQUs7U0FDVCxDQUFDO1FBQ0YsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0tBQzFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksaUJBQWlCLENBQUMsS0FBcUI7UUFDNUMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLG1CQUFtQixFQUFFLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxzQkFBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssRUFBRSxDQUFDLENBQUM7S0FDakY7SUFFRDs7Ozs7O09BTUc7SUFDSSx1QkFBdUIsQ0FBQyxLQUFxQjtRQUNsRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMseUJBQXlCLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLHNCQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsS0FBSyxFQUFFLENBQUMsQ0FBQztLQUMzRjtJQUVEOztPQUVHO0lBQ0ssZUFBZSxDQUFDLEtBQWtCO1FBQ3hDLE9BQU8sSUFBSSx1QkFBTSxDQUFDO1lBQ2hCLEdBQUcsS0FBSztZQUNSLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTTtZQUMxQyxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU87U0FDOUMsQ0FBQyxDQUFDO0tBQ0o7O0FBdkhILGdDQXdIQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogIENvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuICpcbiAqICBMaWNlbnNlZCB1bmRlciB0aGUgQXBhY2hlIExpY2Vuc2UsIFZlcnNpb24gMi4wICh0aGUgXCJMaWNlbnNlXCIpLiBZb3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlXG4gKiAgd2l0aCB0aGUgTGljZW5zZS4gQSBjb3B5IG9mIHRoZSBMaWNlbnNlIGlzIGxvY2F0ZWQgYXRcbiAqXG4gKiAgICAgIGh0dHA6Ly93d3cuYXBhY2hlLm9yZy9saWNlbnNlcy9MSUNFTlNFLTIuMFxuICpcbiAqICBvciBpbiB0aGUgJ2xpY2Vuc2UnIGZpbGUgYWNjb21wYW55aW5nIHRoaXMgZmlsZS4gVGhpcyBmaWxlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICdBUyBJUycgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFU1xuICogIE9SIENPTkRJVElPTlMgT0YgQU5ZIEtJTkQsIGV4cHJlc3Mgb3IgaW1wbGllZC4gU2VlIHRoZSBMaWNlbnNlIGZvciB0aGUgc3BlY2lmaWMgbGFuZ3VhZ2UgZ292ZXJuaW5nIHBlcm1pc3Npb25zXG4gKiAgYW5kIGxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLlxuICovXG5cbmltcG9ydCB0eXBlIHsgSVJlc291cmNlLCBSZXNvdXJjZVByb3BzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgUmVzb3VyY2UgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IElQb2xpY3lSZWYsIFBvbGljeVJlZmVyZW5jZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCB0eXBlIHsgRGltZW5zaW9uc01hcCwgTWV0cmljT3B0aW9ucywgTWV0cmljUHJvcHMgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY2xvdWR3YXRjaCc7XG5pbXBvcnQgeyBNZXRyaWMsIFN0YXRzIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWNsb3Vkd2F0Y2gnO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHR5cGUgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbi8vIEludGVybmFsIGltcG9ydHNcbmltcG9ydCB7IFBPTElDWV9SRUFEX1BFUk1TIH0gZnJvbSAnLi9wZXJtcyc7XG5pbXBvcnQgdHlwZSB7IElQb2xpY3lFbmdpbmUgfSBmcm9tICcuL3BvbGljeS1lbmdpbmUtYmFzZSc7XG5pbXBvcnQgdHlwZSB7IFBvbGljeVZhbGlkYXRpb25Nb2RlIH0gZnJvbSAnLi9wb2xpY3ktdHlwZXMnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSW50ZXJmYWNlXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogTWluaW1hbCByZWZlcmVuY2UgaW50ZXJmYWNlIGZvciBQb2xpY3kgcmVzb3VyY2VzLlxuICogVXNlZCBmb3IgcmVzb3VyY2UgaWRlbnRpZmljYXRpb24gYW5kIEFSTiBjb25zdHJ1Y3Rpb24uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSVBvbGljeSBleHRlbmRzIElSZXNvdXJjZSwgSVBvbGljeVJlZiwgaWFtLklHcmFudGFibGUge1xuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgcG9saWN5IHJlc291cmNlXG4gICAqIEBhdHRyaWJ1dGVcbiAgICovXG4gIHJlYWRvbmx5IHBvbGljeUFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgSUQgb2YgdGhlIHBvbGljeVxuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICByZWFkb25seSBwb2xpY3lJZDogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgbmFtZSBvZiB0aGUgcG9saWN5XG4gICAqIEBhdHRyaWJ1dGVcbiAgICovXG4gIHJlYWRvbmx5IHBvbGljeU5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIHBvbGljeSBlbmdpbmUgdGhpcyBwb2xpY3kgYmVsb25ncyB0b1xuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICByZWFkb25seSBwb2xpY3lFbmdpbmU6IElQb2xpY3lFbmdpbmU7XG5cbiAgLyoqXG4gICAqIFRoZSBkZXNjcmlwdGlvbiBvZiB0aGUgcG9saWN5XG4gICAqL1xuICByZWFkb25seSBkZXNjcmlwdGlvbj86IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIHZhbGlkYXRpb24gbW9kZSBmb3IgdGhlIHBvbGljeVxuICAgKi9cbiAgcmVhZG9ubHkgdmFsaWRhdGlvbk1vZGU/OiBQb2xpY3lWYWxpZGF0aW9uTW9kZTtcblxuICAvKipcbiAgICogR3JhbnRzIElBTSBhY3Rpb25zIHRvIHRoZSBJQU0gUHJpbmNpcGFsXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgdG8gZ3JhbnQgcGVybWlzc2lvbnMgdG9cbiAgICogQHBhcmFtIGFjdGlvbnMgLSBUaGUgYWN0aW9ucyB0byBncmFudFxuICAgKi9cbiAgZ3JhbnQoZ3JhbnRlZTogaWFtLklHcmFudGFibGUsIC4uLmFjdGlvbnM6IHN0cmluZ1tdKTogaWFtLkdyYW50O1xuXG4gIC8qKlxuICAgKiBHcmFudHMgcmVhZCBwZXJtaXNzaW9ucyBvbiB0aGUgUG9saWN5IChkYXRhIHBsYW5lKS5cbiAgICpcbiAgICogVGhpcyBncmFudHMgcnVudGltZSByZWFkIGFjY2VzcyB0byBwb2xpY3kgY29uZmlndXJhdGlvbi4gVXNlIHRoaXMgZm9yIG1vbml0b3JpbmcsXG4gICAqIGF1ZGl0LCBvciByZWFkLW9ubHkgYWRtaW5pc3RyYXRpdmUgcm9sZXMgdGhhdCBuZWVkIHRvIGluc3BlY3QgcG9saWN5IGRlZmluaXRpb25zLlxuICAgKlxuICAgKiBAcGFyYW0gZ3JhbnRlZSAtIFRoZSBJQU0gcHJpbmNpcGFsIHRvIGdyYW50IHJlYWQgcGVybWlzc2lvbnMgdG9cbiAgICovXG4gIGdyYW50UmVhZChncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudDtcblxuICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAgLy8gTWV0cmljc1xuICAvLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuICAvKipcbiAgICogUmV0dXJuIHRoZSBnaXZlbiBuYW1lZCBtZXRyaWMgZm9yIHRoaXMgcG9saWN5LlxuICAgKlxuICAgKiBAcGFyYW0gbWV0cmljTmFtZSBUaGUgbmFtZSBvZiB0aGUgbWV0cmljXG4gICAqIEBwYXJhbSBkaW1lbnNpb25zIEFkZGl0aW9uYWwgZGltZW5zaW9ucyBmb3IgdGhlIG1ldHJpY1xuICAgKiBAcGFyYW0gcHJvcHMgT3B0aW9uYWwgbWV0cmljIGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIG1ldHJpYyhtZXRyaWNOYW1lOiBzdHJpbmcsIGRpbWVuc2lvbnM6IERpbWVuc2lvbnNNYXAsIHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYztcblxuICAvKipcbiAgICogUmV0dXJuIGEgbWV0cmljIGNvbnRhaW5pbmcgdGhlIHRvdGFsIG51bWJlciBvZiBldmFsdWF0aW9ucyBmb3IgdGhpcyBwb2xpY3kuXG4gICAqXG4gICAqIFRoaXMgbWV0cmljIHRyYWNrcyBob3cgbWFueSB0aW1lcyB0aGlzIHBvbGljeSBoYXMgYmVlbiBldmFsdWF0ZWQuXG4gICAqXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgbWV0cmljRXZhbHVhdGlvbnMocHJvcHM/OiBNZXRyaWNPcHRpb25zKTogTWV0cmljO1xuXG4gIC8qKlxuICAgKiBSZXR1cm4gYSBtZXRyaWMgbWVhc3VyaW5nIHRoZSBldmFsdWF0aW9uIGxhdGVuY3kgZm9yIHRoaXMgcG9saWN5LlxuICAgKlxuICAgKiBUaGlzIG1ldHJpYyByZXByZXNlbnRzIHRoZSB0aW1lIHRha2VuIHRvIGV2YWx1YXRlIHRoaXMgc3BlY2lmaWMgcG9saWN5LlxuICAgKlxuICAgKiBAcGFyYW0gcHJvcHMgT3B0aW9uYWwgbWV0cmljIGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIG1ldHJpY0V2YWx1YXRpb25MYXRlbmN5KHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYztcbn1cblxuLyoqXG4gKiBBdHRyaWJ1dGVzIGZvciBpbXBvcnRpbmcgYW4gZXhpc3RpbmcgUG9saWN5XG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUG9saWN5QXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBwb2xpY3lcbiAgICovXG4gIHJlYWRvbmx5IHBvbGljeUFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgcG9saWN5IGVuZ2luZSB0aGlzIHBvbGljeSBiZWxvbmdzIHRvXG4gICAqIFtkaXNhYmxlLWF3c2xpbnQ6cHJlZmVyLXJlZi1pbnRlcmZhY2VdXG4gICAqL1xuICByZWFkb25seSBwb2xpY3lFbmdpbmU6IElQb2xpY3lFbmdpbmU7XG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgQUJTVFJBQ1QgQkFTRSBDTEFTU1xuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEFic3RyYWN0IGJhc2UgY2xhc3MgZm9yIGEgUG9saWN5LlxuICogQ29udGFpbnMgbWV0aG9kcyBhbmQgYXR0cmlidXRlcyB2YWxpZCBmb3IgUG9saWNpZXMgZWl0aGVyIGNyZWF0ZWQgd2l0aCBDREsgb3IgaW1wb3J0ZWQuXG4gKi9cbmV4cG9ydCBhYnN0cmFjdCBjbGFzcyBQb2xpY3lCYXNlIGV4dGVuZHMgUmVzb3VyY2UgaW1wbGVtZW50cyBJUG9saWN5IHtcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IHBvbGljeUFybjogc3RyaW5nO1xuICBwdWJsaWMgYWJzdHJhY3QgcmVhZG9ubHkgcG9saWN5SWQ6IHN0cmluZztcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IHBvbGljeU5hbWU6IHN0cmluZztcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IHBvbGljeUVuZ2luZTogSVBvbGljeUVuZ2luZTtcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IGRlc2NyaXB0aW9uPzogc3RyaW5nO1xuICBwdWJsaWMgYWJzdHJhY3QgcmVhZG9ubHkgdmFsaWRhdGlvbk1vZGU/OiBQb2xpY3lWYWxpZGF0aW9uTW9kZTtcblxuICAvKipcbiAgICogVGhlIHByaW5jaXBhbCB0byBncmFudCBwZXJtaXNzaW9ucyB0b1xuICAgKi9cbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IGdyYW50UHJpbmNpcGFsOiBpYW0uSVByaW5jaXBhbDtcblxuICAvKipcbiAgICogQSByZWZlcmVuY2UgdG8gdGhpcyBQb2xpY3kgcmVzb3VyY2UuXG4gICAqL1xuICBwdWJsaWMgZ2V0IHBvbGljeVJlZigpOiBQb2xpY3lSZWZlcmVuY2Uge1xuICAgIHJldHVybiB7XG4gICAgICBwb2xpY3lBcm46IHRoaXMucG9saWN5QXJuLFxuICAgIH07XG4gIH1cblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogUmVzb3VyY2VQcm9wcyA9IHt9KSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCBwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogR3JhbnRzIElBTSBhY3Rpb25zIHRvIHRoZSBJQU0gUHJpbmNpcGFsXG4gICAqXG4gICAqIFtkaXNhYmxlLWF3c2xpbnQ6bm8tZ3JhbnRzXVxuICAgKlxuICAgKiBAcGFyYW0gZ3JhbnRlZSAtIFRoZSBJQU0gcHJpbmNpcGFsIHRvIGdyYW50IHBlcm1pc3Npb25zIHRvXG4gICAqIEBwYXJhbSBhY3Rpb25zIC0gVGhlIGFjdGlvbnMgdG8gZ3JhbnRcbiAgICogQHJldHVybnMgQW4gSUFNIEdyYW50IG9iamVjdCByZXByZXNlbnRpbmcgdGhlIGdyYW50ZWQgcGVybWlzc2lvbnNcbiAgICovXG4gIHB1YmxpYyBncmFudChncmFudGVlOiBpYW0uSUdyYW50YWJsZSwgLi4uYWN0aW9uczogc3RyaW5nW10pOiBpYW0uR3JhbnQge1xuICAgIHJldHVybiBpYW0uR3JhbnQuYWRkVG9QcmluY2lwYWwoe1xuICAgICAgZ3JhbnRlZSxcbiAgICAgIGFjdGlvbnMsXG4gICAgICByZXNvdXJjZUFybnM6IFt0aGlzLnBvbGljeUFybl0sXG4gICAgICBzY29wZTogdGhpcyxcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudHMgcmVhZCBwZXJtaXNzaW9ucyBvbiB0aGUgUG9saWN5IChkYXRhIHBsYW5lKS5cbiAgICpcbiAgICogVGhpcyBncmFudHMgcnVudGltZSByZWFkIGFjY2VzcyB0byBwb2xpY3kgY29uZmlndXJhdGlvbi4gVXNlIHRoaXMgZm9yIG1vbml0b3JpbmcsXG4gICAqIGF1ZGl0LCBvciByZWFkLW9ubHkgYWRtaW5pc3RyYXRpdmUgcm9sZXMgdGhhdCBuZWVkIHRvIGluc3BlY3QgcG9saWN5IGRlZmluaXRpb25zXG4gICAqIGFuZCBDZWRhciBzdGF0ZW1lbnRzIGF0IHJ1bnRpbWUuXG4gICAqXG4gICAqIElNUE9SVEFOVDogVGhpcyBkb2VzIE5PVCBncmFudCBwZXJtaXNzaW9ucyB0byBjcmVhdGUvdXBkYXRlL2RlbGV0ZSB0aGUgUG9saWN5XG4gICAqIHJlc291cmNlIGl0c2VsZi4gVGhvc2UgYXJlIGNvbnRyb2wgcGxhbmUgb3BlcmF0aW9ucyBwZXJmb3JtZWQgYnkgQ2xvdWRGb3JtYXRpb25cbiAgICogZHVyaW5nIGBjZGsgZGVwbG95YCwgbm90IGJ5IHlvdXIgYXBwbGljYXRpb24gYXQgcnVudGltZS5cbiAgICpcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgdG8gZ3JhbnQgcmVhZCBwZXJtaXNzaW9ucyB0b1xuICAgKiBAcmV0dXJucyBBbiBJQU0gR3JhbnQgb2JqZWN0IHJlcHJlc2VudGluZyB0aGUgZ3JhbnRlZCBwZXJtaXNzaW9uc1xuICAgKi9cbiAgcHVibGljIGdyYW50UmVhZChncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudCB7XG4gICAgcmV0dXJuIHRoaXMuZ3JhbnQoZ3JhbnRlZSwgLi4uUE9MSUNZX1JFQURfUEVSTVMpO1xuICB9XG5cbiAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4gIC8vIE1ldHJpY3NcbiAgLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbiAgLyoqXG4gICAqIFJldHVybiB0aGUgZ2l2ZW4gbmFtZWQgbWV0cmljIGZvciB0aGlzIHBvbGljeS5cbiAgICpcbiAgICogQnkgZGVmYXVsdCwgdGhlIG1ldHJpYyB3aWxsIGJlIGNhbGN1bGF0ZWQgYXMgYSBzdW0gb3ZlciBhIHBlcmlvZCBvZiA1IG1pbnV0ZXMuXG4gICAqIFlvdSBjYW4gY3VzdG9taXplIHRoaXMgYnkgdXNpbmcgdGhlIGBzdGF0aXN0aWNgIGFuZCBgcGVyaW9kYCBwcm9wZXJ0aWVzLlxuICAgKlxuICAgKiBAcGFyYW0gbWV0cmljTmFtZSBUaGUgbmFtZSBvZiB0aGUgbWV0cmljXG4gICAqIEBwYXJhbSBkaW1lbnNpb25zIEFkZGl0aW9uYWwgZGltZW5zaW9ucyBmb3IgdGhlIG1ldHJpY1xuICAgKiBAcGFyYW0gcHJvcHMgT3B0aW9uYWwgbWV0cmljIGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIHB1YmxpYyBtZXRyaWMobWV0cmljTmFtZTogc3RyaW5nLCBkaW1lbnNpb25zOiBEaW1lbnNpb25zTWFwLCBwcm9wcz86IE1ldHJpY09wdGlvbnMpOiBNZXRyaWMge1xuICAgIGNvbnN0IG1ldHJpY1Byb3BzOiBNZXRyaWNQcm9wcyA9IHtcbiAgICAgIG5hbWVzcGFjZTogJ0FXUy9CZWRyb2NrLUFnZW50Q29yZScsXG4gICAgICBtZXRyaWNOYW1lLFxuICAgICAgZGltZW5zaW9uc01hcDogeyAuLi5kaW1lbnNpb25zLCBSZXNvdXJjZTogdGhpcy5wb2xpY3lBcm4gfSxcbiAgICAgIC4uLnByb3BzLFxuICAgIH07XG4gICAgcmV0dXJuIHRoaXMuY29uZmlndXJlTWV0cmljKG1ldHJpY1Byb3BzKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm4gYSBtZXRyaWMgY29udGFpbmluZyB0aGUgdG90YWwgbnVtYmVyIG9mIGV2YWx1YXRpb25zIGZvciB0aGlzIHBvbGljeS5cbiAgICpcbiAgICogVGhpcyBtZXRyaWMgdHJhY2tzIGhvdyBtYW55IHRpbWVzIHRoaXMgcG9saWN5IGhhcyBiZWVuIGV2YWx1YXRlZC5cbiAgICpcbiAgICogQHBhcmFtIHByb3BzIE9wdGlvbmFsIG1ldHJpYyBjb25maWd1cmF0aW9uXG4gICAqL1xuICBwdWJsaWMgbWV0cmljRXZhbHVhdGlvbnMocHJvcHM/OiBNZXRyaWNPcHRpb25zKTogTWV0cmljIHtcbiAgICByZXR1cm4gdGhpcy5tZXRyaWMoJ1BvbGljeUV2YWx1YXRpb25zJywge30sIHsgc3RhdGlzdGljOiBTdGF0cy5TVU0sIC4uLnByb3BzIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIFJldHVybiBhIG1ldHJpYyBtZWFzdXJpbmcgdGhlIGV2YWx1YXRpb24gbGF0ZW5jeSBmb3IgdGhpcyBwb2xpY3kuXG4gICAqXG4gICAqIFRoaXMgbWV0cmljIHJlcHJlc2VudHMgdGhlIHRpbWUgdGFrZW4gdG8gZXZhbHVhdGUgdGhpcyBzcGVjaWZpYyBwb2xpY3kuXG4gICAqXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgcHVibGljIG1ldHJpY0V2YWx1YXRpb25MYXRlbmN5KHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYyB7XG4gICAgcmV0dXJuIHRoaXMubWV0cmljKCdQb2xpY3lFdmFsdWF0aW9uTGF0ZW5jeScsIHt9LCB7IHN0YXRpc3RpYzogU3RhdHMuQVZFUkFHRSwgLi4ucHJvcHMgfSk7XG4gIH1cblxuICAvKipcbiAgICogSW50ZXJuYWwgbWV0aG9kIHRvIGNyZWF0ZSBhIG1ldHJpYy5cbiAgICovXG4gIHByaXZhdGUgY29uZmlndXJlTWV0cmljKHByb3BzOiBNZXRyaWNQcm9wcykge1xuICAgIHJldHVybiBuZXcgTWV0cmljKHtcbiAgICAgIC4uLnByb3BzLFxuICAgICAgcmVnaW9uOiBwcm9wcz8ucmVnaW9uID8/IHRoaXMuc3RhY2sucmVnaW9uLFxuICAgICAgYWNjb3VudDogcHJvcHM/LmFjY291bnQgPz8gdGhpcy5zdGFjay5hY2NvdW50LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/policy/policy-engine-base.d.ts

@@ -0,0 +1,260 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import type { IResource, ResourceProps } from 'aws-cdk-lib';
+import { Resource } from 'aws-cdk-lib';
+import type { IPolicyEngineRef, PolicyEngineReference } from 'aws-cdk-lib/aws-bedrockagentcore';
+import type { DimensionsMap, MetricOptions } from 'aws-cdk-lib/aws-cloudwatch';
+import { Metric } from 'aws-cdk-lib/aws-cloudwatch';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import type * as kms from 'aws-cdk-lib/aws-kms';
+import type { Construct } from 'constructs';
+import type { IGateway } from '../gateway/gateway-base';
+/******************************************************************************
+ *                                Interface
+ *****************************************************************************/
+/**
+ * Contains all properties and methods for both created and imported policy engines.
+ */
+export interface IPolicyEngine extends IResource, IPolicyEngineRef, iam.IGrantable {
+    /**
+     * The ARN of the policy engine resource
+     * @attribute
+     */
+    readonly policyEngineArn: string;
+    /**
+     * The ID of the policy engine
+     * @attribute
+     */
+    readonly policyEngineId: string;
+    /**
+     * The name of the policy engine
+     * @attribute
+     */
+    readonly policyEngineName: string;
+    /**
+     * The description of the policy engine
+     */
+    readonly description?: string;
+    /**
+     * The KMS key used for encryption
+     */
+    readonly kmsKey?: kms.IKey;
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Grants read permissions on the PolicyEngine.
+     *
+     * This grants runtime read access to policy engine configuration. Use this for
+     * monitoring, observability, or read-only administrative roles.
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Grants permissions to evaluate policies at runtime .
+     *
+     * This is the primary permission needed by Gateway execution roles to evaluate
+     * authorization decisions during agent requests. Grant this to roles that need
+     * to call AuthorizeAction or PartiallyAuthorizeActions.
+     *
+     * @param grantee - The IAM principal to grant evaluation permissions to
+     */
+    grantEvaluate(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Grants the full set of permissions required for a gateway execution role to use
+     * this policy engine, correctly scoped to both the policy engine and gateway ARNs.
+     *
+     * Per the AWS docs, `AuthorizeAction` and `PartiallyAuthorizeActions` require
+     * both the policy engine ARN and the gateway ARN as resources, while
+     * `GetPolicyEngine` only needs the policy engine ARN.
+     *
+     * This follows the same pattern as Lambda's `grantInvokeVersion(grantee, version)`.
+     *
+     * @param grantee - The IAM principal (gateway execution role) to grant permissions to
+     * @param gateway - The gateway that will use this policy engine [disable-awslint:prefer-ref-interface]
+     */
+    grantEvaluateForGateway(grantee: iam.IGrantable, gateway: IGateway): iam.Grant;
+    /**
+     * Return the given named metric for this policy engine.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName: string, dimensions: DimensionsMap, props?: MetricOptions): Metric;
+    /**
+     * Return a metric measuring the authorization latency for this policy engine.
+     *
+     * This metric represents the time taken to evaluate authorization policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricAuthorizationLatency(props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the number of denied authorization requests for this policy engine.
+     *
+     * This metric tracks authorization requests that were explicitly denied by policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricDeniedRequests(props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the number of errors during authorization for this policy engine.
+     *
+     * This metric tracks errors encountered during policy evaluation.
+     *
+     * @param props Optional metric configuration
+     */
+    metricErrors(props?: MetricOptions): Metric;
+}
+/**
+ * Attributes for importing an existing PolicyEngine
+ */
+export interface PolicyEngineAttributes {
+    /**
+     * The ARN of the policy engine
+     */
+    readonly policyEngineArn: string;
+    /**
+     * The KMS key ARN used for encryption (optional)
+     *
+     * @default - No KMS key
+     */
+    readonly kmsKeyArn?: string;
+}
+/******************************************************************************
+ *                        ABSTRACT BASE CLASS
+ *****************************************************************************/
+/**
+ * Abstract base class for a PolicyEngine.
+ * Contains methods and attributes valid for PolicyEngines either created with CDK or imported.
+ */
+export declare abstract class PolicyEngineBase extends Resource implements IPolicyEngine {
+    abstract readonly policyEngineArn: string;
+    abstract readonly policyEngineId: string;
+    abstract readonly policyEngineName: string;
+    abstract readonly description?: string;
+    abstract readonly kmsKey?: kms.IKey;
+    /**
+     * The principal to grant permissions to
+     */
+    abstract readonly grantPrincipal: iam.IPrincipal;
+    /**
+     * A reference to this PolicyEngine resource.
+     */
+    get policyEngineRef(): PolicyEngineReference;
+    constructor(scope: Construct, id: string, props?: ResourceProps);
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
+    /**
+     * Grants read permissions on the PolicyEngine (data plane).
+     *
+     * This grants runtime read access to policy engine configuration. Use this for
+     * monitoring, observability, or read-only administrative roles that need to inspect
+     * policy engine settings at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantRead(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Grants permissions to evaluate policies at runtime (data plane operations).
+     *
+     * This is the primary permission needed by Gateway execution roles to evaluate
+     * authorization decisions during agent requests. Grant this to roles that need
+     * to call AuthorizeAction or PartiallyAuthorizeActions at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant evaluation permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantEvaluate(grantee: iam.IGrantable): iam.Grant;
+    /**
+     * Grants the full set of permissions required for a gateway execution role to use
+     * this policy engine, correctly scoped to both the policy engine and gateway ARNs.
+     *
+     * Per the AWS docs:
+     * - `GetPolicyEngine` → policy engine ARN only
+     * - `AuthorizeAction` + `PartiallyAuthorizeActions` → policy engine ARN **and** gateway ARN
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal (gateway execution role) to grant permissions to
+     * @param gateway - The gateway that will use this policy engine [disable-awslint:prefer-ref-interface]
+     * @returns A combined IAM Grant representing all granted permissions
+     */
+    grantEvaluateForGateway(grantee: iam.IGrantable, gateway: IGateway): iam.Grant;
+    /**
+     * Return the given named metric for this policy engine.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName: string, dimensions: DimensionsMap, props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the total number of authorizations for this policy engine.
+     *
+     * This metric tracks all authorization requests processed by the policy engine.
+     *
+     * @param props Optional metric configuration
+     */
+    metricAuthorizations(props?: MetricOptions): Metric;
+    /**
+     * Return a metric measuring the authorization latency for this policy engine.
+     *
+     * This metric represents the time taken to evaluate authorization policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricAuthorizationLatency(props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the number of denied authorization requests for this policy engine.
+     *
+     * This metric tracks authorization requests that were explicitly denied by policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricDeniedRequests(props?: MetricOptions): Metric;
+    /**
+     * Return a metric containing the number of errors during authorization for this policy engine.
+     *
+     * This metric tracks errors encountered during policy evaluation.
+     *
+     * @param props Optional metric configuration
+     */
+    metricErrors(props?: MetricOptions): Metric;
+    /**
+     * Internal method to create a metric.
+     */
+    private configureMetric;
+}