policy_engines

Creates, updates, deletes, gets or lists a policy_engines resource.

Overview

Name	policy_engines
Type	Resource
Id	aws.bedrock_agentcore_control.policy_engines

Fields

The following fields are returned by SELECT queries:

get_policy_engine

Name	Datatype	Description
name	string	The customer-assigned name of the policy engine. This is the human-readable identifier that was specified when the policy engine was created. (pattern: <code>[A-Za-z][A-Za-z0-9_]*</code>)
created_at	string (date-time)	The timestamp when the policy engine was originally created.
description	string	The human-readable description of the policy engine's purpose and scope. This helps administrators understand the policy engine's role in governance.
encryption_key_arn	string	The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data. (pattern: <code>arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}</code>)
policy_engine_arn	string	The Amazon Resource Name (ARN) of the policy engine. This globally unique identifier can be used for cross-service references and IAM policy statements. (pattern: <code>arn:aws[-a-z]{0,7}:bedrock-agentcore:[a-z0-9-]{9,15}:[0-9]{12}:policy-engine/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}</code>)
policy_engine_id	string	The unique identifier of the retrieved policy engine. This matches the policy engine ID provided in the request and serves as the system identifier. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
status	string	The current status of the policy engine. (CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED)
status_reasons	array	Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine.
updated_at	string (date-time)	The timestamp when the policy engine was last modified. This tracks the most recent changes to the policy engine configuration.

list_policy_engines

Name	Datatype	Description
name	string	The customer-assigned immutable name for the policy engine. This human-readable identifier must be unique within the account and cannot exceed 48 characters. (pattern: <code>[A-Za-z][A-Za-z0-9_]*</code>)
created_at	string (date-time)	The timestamp when the policy engine was originally created. This is automatically set by the service and used for auditing and lifecycle management.
description	string	A human-readable description of the policy engine's purpose and scope. Limited to 4,096 characters, this helps administrators understand the policy engine's role in the overall governance strategy.
encryption_key_arn	string	The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data. (pattern: <code>arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}</code>)
policy_engine_arn	string	The Amazon Resource Name (ARN) of the policy engine. This globally unique identifier can be used for cross-service references and IAM policy statements. (pattern: <code>arn:aws[-a-z]{0,7}:bedrock-agentcore:[a-z0-9-]{9,15}:[0-9]{12}:policy-engine/[a-zA-Z][a-zA-Z0-9-]{0,47}-[a-zA-Z0-9]{10}</code>)
policy_engine_id	string	The unique identifier for the policy engine. This system-generated identifier consists of the user name plus a 10-character generated suffix and serves as the primary key for policy engine operations. (pattern: <code>[A-Za-z][A-Za-z0-9_]*-[a-z0-9_]{10}</code>)
status	string	The current status of the policy engine. (CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED)
status_reasons	array	Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine lifecycle.
updated_at	string (date-time)	The timestamp when the policy engine was last modified. This tracks the most recent changes to the policy engine configuration or metadata.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy_engine	select	policy_engine_id, region		Retrieves detailed information about a specific policy engine within the AgentCore Policy system. This operation returns the complete policy engine configuration, metadata, and current status, allowing administrators to review and manage policy engine settings.
list_policy_engines	select	region	nextToken, maxResults	Retrieves a list of policy engines within the AgentCore Policy system. This operation supports pagination to help administrators discover and manage policy engines across their account. Each policy engine serves as a container for related policies.
create_policy_engine	insert	region, name		Creates a new policy engine within the AgentCore Policy system. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with Gateways (each Gateway can be associated with at most one policy engine, but multiple Gateways can be associated with the same engine), the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.
update_policy_engine	update	policy_engine_id, region		Updates an existing policy engine within the AgentCore Policy system. This operation allows modification of the policy engine description while maintaining its identity. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.
delete_policy_engine	delete	policy_engine_id, region		Deletes an existing policy engine from the AgentCore Policy system. The policy engine must not have any associated policies before deletion. Once deleted, the policy engine and all its configurations become unavailable for policy management and evaluation. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policy_engine_id	string	The unique identifier of the policy engine to be deleted. This must be a valid policy engine ID that exists within the account.
region	string	AWS region (default: us-east-1)
maxResults	integer	The maximum number of policy engines to return in a single response. If not specified, the default is 10 policy engines per page, with a maximum of 100 per page.
nextToken	string	A pagination token returned from a previous ListPolicyEngines call. Use this token to retrieve the next page of results when the response is paginated.

SELECT examples

get_policy_engine

Retrieves detailed information about a specific policy engine within the AgentCore Policy system. This operation returns the complete policy engine configuration, metadata, and current status, allowing administrators to review and manage policy engine settings.

SELECT
name,
created_at,
description,
encryption_key_arn,
policy_engine_arn,
policy_engine_id,
status,
status_reasons,
updated_at
FROM aws.bedrock_agentcore_control.policy_engines
WHERE policy_engine_id = '{{ policy_engine_id }}' -- required
AND region = '{{ region }}' -- required
;

list_policy_engines

Retrieves a list of policy engines within the AgentCore Policy system. This operation supports pagination to help administrators discover and manage policy engines across their account. Each policy engine serves as a container for related policies.

SELECT
name,
created_at,
description,
encryption_key_arn,
policy_engine_arn,
policy_engine_id,
status,
status_reasons,
updated_at
FROM aws.bedrock_agentcore_control.policy_engines
WHERE region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;

INSERT examples

create_policy_engine

Creates a new policy engine within the AgentCore Policy system. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with Gateways (each Gateway can be associated with at most one policy engine, but multiple Gateways can be associated with the same engine), the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.

INSERT INTO aws.bedrock_agentcore_control.policy_engines (
name,
description,
clientToken,
encryptionKeyArn,
tags,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ description }}',
'{{ clientToken }}',
'{{ encryptionKeyArn }}',
'{{ tags }}',
'{{ region }}'
RETURNING
name,
created_at,
description,
encryption_key_arn,
policy_engine_arn,
policy_engine_id,
status,
status_reasons,
updated_at
;

Manifest

# Description fields are for documentation purposes
- name: policy_engines
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the policy_engines resource.
  - name: name
    value: "{{ name }}"
  - name: description
    value: "{{ description }}"
  - name: clientToken
    value: "{{ clientToken }}"
  - name: encryptionKeyArn
    value: "{{ encryptionKeyArn }}"
  - name: tags
    value: "{{ tags }}"

UPDATE examples

update_policy_engine

Updates an existing policy engine within the AgentCore Policy system. This operation allows modification of the policy engine description while maintaining its identity. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.

UPDATE aws.bedrock_agentcore_control.policy_engines
SET 
description = '{{ description }}'
WHERE 
policy_engine_id = '{{ policy_engine_id }}' --required
AND region = '{{ region }}' --required
RETURNING
name,
created_at,
description,
encryption_key_arn,
policy_engine_arn,
policy_engine_id,
status,
status_reasons,
updated_at;

DELETE examples

delete_policy_engine

Deletes an existing policy engine from the AgentCore Policy system. The policy engine must not have any associated policies before deletion. Once deleted, the policy engine and all its configurations become unavailable for policy management and evaluation. This is an asynchronous operation. Use the GetPolicyEngine operation to poll the status field to track completion.

DELETE FROM aws.bedrock_agentcore_control.policy_engines
WHERE policy_engine_id = '{{ policy_engine_id }}' --required
AND region = '{{ region }}' --required
;