aws-cdk-lib 2.195.0__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_verifiedpermissions/__init__.py

@@ -70,13 +70,26 @@ from .._jsii import *
 import constructs as _constructs_77d1e7e8
 from .. import (
     CfnResource as _CfnResource_9df397a6,
+    CfnTag as _CfnTag_f6864754,
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
+    TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_verifiedpermissions import (
+    IIdentitySourceRef as _IIdentitySourceRef_350a2caf,
+    IPolicyRef as _IPolicyRef_c6dc8a32,
+    IPolicyStoreRef as _IPolicyStoreRef_ac45e491,
+    IPolicyTemplateRef as _IPolicyTemplateRef_899f99c9,
+    IdentitySourceReference as _IdentitySourceReference_a313a3c3,
+    PolicyReference as _PolicyReference_c40df487,
+    PolicyStoreReference as _PolicyStoreReference_a5975c12,
+    PolicyTemplateReference as _PolicyTemplateReference_dcad6159,
+)
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IIdentitySourceRef_350a2caf)
 class CfnIdentitySource(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -88,7 +101,7 @@ class CfnIdentitySource(
 
     After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the `IsAuthorizedWithToken <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html>`_ operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.
 
-    Amazon Cognito Identity is not available in all of the same AWS Regions as Amazon Verified Permissions . Because of this, the ``AWS::VerifiedPermissions::IdentitySource`` type is not available to create from AWS CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create ``AWS::VerifiedPermissions::IdentitySource`` in those Regions, but only from the AWS CLI , Amazon Verified Permissions SDK, or from the AWS console.
+    Amazon Cognito Identity is not available in all of the same AWS Regions as  . Because of this, the ``AWS::VerifiedPermissions::IdentitySource`` type is not available to create from AWS CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create ``AWS::VerifiedPermissions::IdentitySource`` in those Regions, but only from the AWS CLI ,  SDK, or from the AWS console.
     .. epigraph::
 
        To reference a user from this identity source in your Cedar policies, use the following syntax.
@@ -155,7 +168,8 @@ class CfnIdentitySource(
         policy_store_id: builtins.str,
         principal_entity_type: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::VerifiedPermissions::IdentitySource``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param configuration: Contains configuration information used when creating a new identity source.
@@ -258,6 +272,12 @@ class CfnIdentitySource(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="identitySourceRef")
+    def identity_source_ref(self) -> _IdentitySourceReference_a313a3c3:
+        '''A reference to a IdentitySource resource.'''
+        return typing.cast(_IdentitySourceReference_a313a3c3, jsii.get(self, "identitySourceRef"))
+
     @builtins.property
     @jsii.member(jsii_name="configuration")
     def configuration(
@@ -1266,7 +1286,7 @@ class CfnIdentitySourceProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPolicyRef_c6dc8a32)
 class CfnPolicy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1340,7 +1360,8 @@ class CfnPolicy(
         definition: typing.Union[_IResolvable_da3f097b, typing.Union["CfnPolicy.PolicyDefinitionProperty", typing.Dict[builtins.str, typing.Any]]],
         policy_store_id: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::VerifiedPermissions::Policy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param definition: Specifies the policy type and content to use for the new or updated policy. The definition structure must include either a ``Static`` or a ``TemplateLinked`` element.
@@ -1410,6 +1431,12 @@ class CfnPolicy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="policyRef")
+    def policy_ref(self) -> _PolicyReference_c40df487:
+        '''A reference to a Policy resource.'''
+        return typing.cast(_PolicyReference_c40df487, jsii.get(self, "policyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="definition")
     def definition(
@@ -1895,7 +1922,7 @@ class CfnPolicyProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPolicyStoreRef_ac45e491, _ITaggableV2_4e6798f8)
 class CfnPolicyStore(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1921,10 +1948,18 @@ class CfnPolicyStore(
             ),
         
             # the properties below are optional
+            deletion_protection=verifiedpermissions.CfnPolicyStore.DeletionProtectionProperty(
+                mode="mode"
+            ),
             description="description",
             schema=verifiedpermissions.CfnPolicyStore.SchemaDefinitionProperty(
+                cedar_format="cedarFormat",
                 cedar_json="cedarJson"
-            )
+            ),
+            tags=[CfnTag(
+                key="key",
+                value="value"
+            )]
         )
     '''
 
@@ -1934,15 +1969,20 @@ class CfnPolicyStore(
         id: builtins.str,
         *,
         validation_settings: typing.Union[_IResolvable_da3f097b, typing.Union["CfnPolicyStore.ValidationSettingsProperty", typing.Dict[builtins.str, typing.Any]]],
+        deletion_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPolicyStore.DeletionProtectionProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         description: typing.Optional[builtins.str] = None,
         schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPolicyStore.SchemaDefinitionProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::VerifiedPermissions::PolicyStore``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param validation_settings: Specifies the validation setting for this policy store. Currently, the only valid and required value is ``Mode`` . .. epigraph:: We recommend that you turn on ``STRICT`` mode only after you define a schema. If a schema doesn't exist, then ``STRICT`` mode causes any policy to fail validation, and Verified Permissions rejects the policy. You can turn off validation by using the `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ . Then, when you have a schema defined, use `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ again to turn validation back on.
+        :param deletion_protection: Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted. The default state is ``DISABLED`` .
         :param description: Descriptive text that you can provide to help with identification of the current policy store.
         :param schema: Creates or updates the policy schema in a policy store. Cedar can use the schema to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.
+        :param tags: The list of key-value pairs to associate with the policy store.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__8cc0f2986096a74fa71e43f21c340737b2abb3e3f40afbfe29ca3f0bd9b39ee9)
@@ -1950,12 +1990,56 @@ class CfnPolicyStore(
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
         props = CfnPolicyStoreProps(
             validation_settings=validation_settings,
+            deletion_protection=deletion_protection,
             description=description,
             schema=schema,
+            tags=tags,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromPolicyStoreArn")
+    @builtins.classmethod
+    def from_policy_store_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IPolicyStoreRef_ac45e491:
+        '''Creates a new IPolicyStoreRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__16b99c7dccdce2e3ceeacefaee34bcbc943bbd0e8eaa9a769f60e8db3995f9fd)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IPolicyStoreRef_ac45e491, jsii.sinvoke(cls, "fromPolicyStoreArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromPolicyStoreId")
+    @builtins.classmethod
+    def from_policy_store_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        policy_store_id: builtins.str,
+    ) -> _IPolicyStoreRef_ac45e491:
+        '''Creates a new IPolicyStoreRef from a policyStoreId.
+
+        :param scope: -
+        :param id: -
+        :param policy_store_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__45b5cca57c73b13753d1aedfabb89ad909aa117845276b364d58f027f81d9263)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument policy_store_id", value=policy_store_id, expected_type=type_hints["policy_store_id"])
+        return typing.cast(_IPolicyStoreRef_ac45e491, jsii.sinvoke(cls, "fromPolicyStoreId", [scope, id, policy_store_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -2004,11 +2088,23 @@ class CfnPolicyStore(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrPolicyStoreId"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="policyStoreRef")
+    def policy_store_ref(self) -> _PolicyStoreReference_a5975c12:
+        '''A reference to a PolicyStore resource.'''
+        return typing.cast(_PolicyStoreReference_a5975c12, jsii.get(self, "policyStoreRef"))
+
     @builtins.property
     @jsii.member(jsii_name="validationSettings")
     def validation_settings(
@@ -2027,6 +2123,27 @@ class CfnPolicyStore(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "validationSettings", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="deletionProtection")
+    def deletion_protection(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnPolicyStore.DeletionProtectionProperty"]]:
+        '''Specifies whether the policy store can be deleted.
+
+        If enabled, the policy store can't be deleted.
+        '''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnPolicyStore.DeletionProtectionProperty"]], jsii.get(self, "deletionProtection"))
+
+    @deletion_protection.setter
+    def deletion_protection(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnPolicyStore.DeletionProtectionProperty"]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__57833e423b36e13e7920abdf1a2596b9080e63fa65941f6d185d155792d5ccf6)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "deletionProtection", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="description")
     def description(self) -> typing.Optional[builtins.str]:
@@ -2058,17 +2175,92 @@ class CfnPolicyStore(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "schema", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="tags")
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''The list of key-value pairs to associate with the policy store.'''
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "tags"))
+
+    @tags.setter
+    def tags(self, value: typing.Optional[typing.List[_CfnTag_f6864754]]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a4e637b2595daab8d8dca7da125f3bf21d442c1f8fb59f4caefd71bced88d6b5)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "tags", value) # pyright: ignore[reportArgumentType]
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_verifiedpermissions.CfnPolicyStore.DeletionProtectionProperty",
+        jsii_struct_bases=[],
+        name_mapping={"mode": "mode"},
+    )
+    class DeletionProtectionProperty:
+        def __init__(self, *, mode: builtins.str) -> None:
+            '''Specifies whether the policy store can be deleted.
+
+            :param mode: Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted. The default state is ``DISABLED`` . Default: - "DISABLED"
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-deletionprotection.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_verifiedpermissions as verifiedpermissions
+                
+                deletion_protection_property = verifiedpermissions.CfnPolicyStore.DeletionProtectionProperty(
+                    mode="mode"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__c70b9477a0dc9dad5a293d5f268b74672d7816a3722f79105d3236fca32076a9)
+                check_type(argname="argument mode", value=mode, expected_type=type_hints["mode"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "mode": mode,
+            }
+
+        @builtins.property
+        def mode(self) -> builtins.str:
+            '''Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted.
+
+            The default state is ``DISABLED`` .
+
+            :default: - "DISABLED"
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-deletionprotection.html#cfn-verifiedpermissions-policystore-deletionprotection-mode
+            '''
+            result = self._values.get("mode")
+            assert result is not None, "Required property 'mode' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "DeletionProtectionProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_verifiedpermissions.CfnPolicyStore.SchemaDefinitionProperty",
         jsii_struct_bases=[],
-        name_mapping={"cedar_json": "cedarJson"},
+        name_mapping={"cedar_format": "cedarFormat", "cedar_json": "cedarJson"},
     )
     class SchemaDefinitionProperty:
-        def __init__(self, *, cedar_json: typing.Optional[builtins.str] = None) -> None:
+        def __init__(
+            self,
+            *,
+            cedar_format: typing.Optional[builtins.str] = None,
+            cedar_json: typing.Optional[builtins.str] = None,
+        ) -> None:
             '''Contains a list of principal types, resource types, and actions that can be specified in policies stored in the same policy store.
 
             If the validation mode for the policy store is set to ``STRICT`` , then policies that can't be validated by this schema are rejected by Verified Permissions and can't be stored in the policy store.
 
+            :param cedar_format: 
             :param cedar_json: A JSON string representation of the schema supported by applications that use this policy store. For more information, see `Policy store schema <https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/schema.html>`_ in the AVP User Guide.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-schemadefinition.html
@@ -2081,16 +2273,28 @@ class CfnPolicyStore(
                 from aws_cdk import aws_verifiedpermissions as verifiedpermissions
                 
                 schema_definition_property = verifiedpermissions.CfnPolicyStore.SchemaDefinitionProperty(
+                    cedar_format="cedarFormat",
                     cedar_json="cedarJson"
                 )
             '''
             if __debug__:
                 type_hints = typing.get_type_hints(_typecheckingstub__40c95b318ee977eff43d9078495fc0215bd302506cf821187fe6998b1a04ee9f)
+                check_type(argname="argument cedar_format", value=cedar_format, expected_type=type_hints["cedar_format"])
                 check_type(argname="argument cedar_json", value=cedar_json, expected_type=type_hints["cedar_json"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if cedar_format is not None:
+                self._values["cedar_format"] = cedar_format
             if cedar_json is not None:
                 self._values["cedar_json"] = cedar_json
 
+        @builtins.property
+        def cedar_format(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-schemadefinition.html#cfn-verifiedpermissions-policystore-schemadefinition-cedarformat
+            '''
+            result = self._values.get("cedar_format")
+            return typing.cast(typing.Optional[builtins.str], result)
+
         @builtins.property
         def cedar_json(self) -> typing.Optional[builtins.str]:
             '''A JSON string representation of the schema supported by applications that use this policy store.
@@ -2182,8 +2386,10 @@ class CfnPolicyStore(
     jsii_struct_bases=[],
     name_mapping={
         "validation_settings": "validationSettings",
+        "deletion_protection": "deletionProtection",
         "description": "description",
         "schema": "schema",
+        "tags": "tags",
     },
 )
 class CfnPolicyStoreProps:
@@ -2191,14 +2397,18 @@ class CfnPolicyStoreProps:
         self,
         *,
         validation_settings: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.ValidationSettingsProperty, typing.Dict[builtins.str, typing.Any]]],
+        deletion_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.DeletionProtectionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         description: typing.Optional[builtins.str] = None,
         schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.SchemaDefinitionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnPolicyStore``.
 
         :param validation_settings: Specifies the validation setting for this policy store. Currently, the only valid and required value is ``Mode`` . .. epigraph:: We recommend that you turn on ``STRICT`` mode only after you define a schema. If a schema doesn't exist, then ``STRICT`` mode causes any policy to fail validation, and Verified Permissions rejects the policy. You can turn off validation by using the `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ . Then, when you have a schema defined, use `UpdatePolicyStore <https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore>`_ again to turn validation back on.
+        :param deletion_protection: Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted. The default state is ``DISABLED`` .
         :param description: Descriptive text that you can provide to help with identification of the current policy store.
         :param schema: Creates or updates the policy schema in a policy store. Cedar can use the schema to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.
+        :param tags: The list of key-value pairs to associate with the policy store.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html
         :exampleMetadata: fixture=_generated
@@ -2215,24 +2425,38 @@ class CfnPolicyStoreProps:
                 ),
             
                 # the properties below are optional
+                deletion_protection=verifiedpermissions.CfnPolicyStore.DeletionProtectionProperty(
+                    mode="mode"
+                ),
                 description="description",
                 schema=verifiedpermissions.CfnPolicyStore.SchemaDefinitionProperty(
+                    cedar_format="cedarFormat",
                     cedar_json="cedarJson"
-                )
+                ),
+                tags=[CfnTag(
+                    key="key",
+                    value="value"
+                )]
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__0f8a612a98cf26f16f9e9de3e5b0a5faaf9ae49bfb39376380ab1ee24d31ca9f)
             check_type(argname="argument validation_settings", value=validation_settings, expected_type=type_hints["validation_settings"])
+            check_type(argname="argument deletion_protection", value=deletion_protection, expected_type=type_hints["deletion_protection"])
             check_type(argname="argument description", value=description, expected_type=type_hints["description"])
             check_type(argname="argument schema", value=schema, expected_type=type_hints["schema"])
+            check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "validation_settings": validation_settings,
         }
+        if deletion_protection is not None:
+            self._values["deletion_protection"] = deletion_protection
         if description is not None:
             self._values["description"] = description
         if schema is not None:
             self._values["schema"] = schema
+        if tags is not None:
+            self._values["tags"] = tags
 
     @builtins.property
     def validation_settings(
@@ -2251,6 +2475,19 @@ class CfnPolicyStoreProps:
         assert result is not None, "Required property 'validation_settings' is missing"
         return typing.cast(typing.Union[_IResolvable_da3f097b, CfnPolicyStore.ValidationSettingsProperty], result)
 
+    @builtins.property
+    def deletion_protection(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnPolicyStore.DeletionProtectionProperty]]:
+        '''Specifies whether the policy store can be deleted. If enabled, the policy store can't be deleted.
+
+        The default state is ``DISABLED`` .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-deletionprotection
+        '''
+        result = self._values.get("deletion_protection")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnPolicyStore.DeletionProtectionProperty]], result)
+
     @builtins.property
     def description(self) -> typing.Optional[builtins.str]:
         '''Descriptive text that you can provide to help with identification of the current policy store.
@@ -2273,6 +2510,15 @@ class CfnPolicyStoreProps:
         result = self._values.get("schema")
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnPolicyStore.SchemaDefinitionProperty]], result)
 
+    @builtins.property
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''The list of key-value pairs to associate with the policy store.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-tags
+        '''
+        result = self._values.get("tags")
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -2285,7 +2531,7 @@ class CfnPolicyStoreProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPolicyTemplateRef_899f99c9)
 class CfnPolicyTemplate(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2323,7 +2569,8 @@ class CfnPolicyTemplate(
         statement: builtins.str,
         description: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::VerifiedPermissions::PolicyTemplate``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param policy_store_id: The unique identifier of the policy store that contains the template.
@@ -2386,6 +2633,12 @@ class CfnPolicyTemplate(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="policyTemplateRef")
+    def policy_template_ref(self) -> _PolicyTemplateReference_dcad6159:
+        '''A reference to a PolicyTemplate resource.'''
+        return typing.cast(_PolicyTemplateReference_dcad6159, jsii.get(self, "policyTemplateRef"))
+
     @builtins.property
     @jsii.member(jsii_name="policyStoreId")
     def policy_store_id(self) -> builtins.str:
@@ -2738,8 +2991,26 @@ def _typecheckingstub__8cc0f2986096a74fa71e43f21c340737b2abb3e3f40afbfe29ca3f0bd
     id: builtins.str,
     *,
     validation_settings: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.ValidationSettingsProperty, typing.Dict[builtins.str, typing.Any]]],
+    deletion_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.DeletionProtectionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     description: typing.Optional[builtins.str] = None,
     schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.SchemaDefinitionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__16b99c7dccdce2e3ceeacefaee34bcbc943bbd0e8eaa9a769f60e8db3995f9fd(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__45b5cca57c73b13753d1aedfabb89ad909aa117845276b364d58f027f81d9263(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    policy_store_id: builtins.str,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -2762,6 +3033,12 @@ def _typecheckingstub__f75a45bc8d480e61f7e4827904f9e4cfad1881a595a32bf1bebfb6efb
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__57833e423b36e13e7920abdf1a2596b9080e63fa65941f6d185d155792d5ccf6(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnPolicyStore.DeletionProtectionProperty]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__fc845780a5a1510b90c3ed3b31f4edddbe3eb47e0d043f7f9f7b3f43b1788034(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -2774,8 +3051,22 @@ def _typecheckingstub__59218b40bcf4539ad10409fa2f065ad910ceb568598b66b8276c1d884
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a4e637b2595daab8d8dca7da125f3bf21d442c1f8fb59f4caefd71bced88d6b5(
+    value: typing.Optional[typing.List[_CfnTag_f6864754]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c70b9477a0dc9dad5a293d5f268b74672d7816a3722f79105d3236fca32076a9(
+    *,
+    mode: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__40c95b318ee977eff43d9078495fc0215bd302506cf821187fe6998b1a04ee9f(
     *,
+    cedar_format: typing.Optional[builtins.str] = None,
     cedar_json: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -2791,8 +3082,10 @@ def _typecheckingstub__441c781d6c8944f199761ac7a1433da41be4b40fc2d3cbb5df9ccf860
 def _typecheckingstub__0f8a612a98cf26f16f9e9de3e5b0a5faaf9ae49bfb39376380ab1ee24d31ca9f(
     *,
     validation_settings: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.ValidationSettingsProperty, typing.Dict[builtins.str, typing.Any]]],
+    deletion_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.DeletionProtectionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     description: typing.Optional[builtins.str] = None,
     schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPolicyStore.SchemaDefinitionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass